Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I got this email from service@intl.paypal.com, with the title:

Your account has been limited until we hear from you.

I think this is a scam / spoof email because I don't see any notification in my Paypal account and this is Hotmail account is not used as my Paypal login. (It used to be not any more for more than a year.)

But the troubling thing is, the TO: field has my old password as my name, then my email in brackets. A screenshot below should clarify what I'm saying. I've blurred my email and the two red arrows are pointing to what was my old password in plain text.

Is there anything I could do to protect myself? Does that mean the sender has me under their "contact book" with my name as my password? I have already forwarded the email to spoof@paypal.com.

enter image description here

share|improve this question
24  
Looks like a sloppy phisher has done you a huge favor by notifying you. –  Digital Chris May 5 at 15:20
3  
Is your old password a common phrase or name? It might just be a coincidence. –  Kami May 6 at 14:21
1  
I don't know how the spoofer obtained your password, but It should not have been from PayPal. Even PayPal should not know your password. When you open an account and set a password the password is mangled to create a string which is stored in the database. When you log in again the password you enter in the web form is mangled again using the same algorithm, and this compared with the string stored in the database. The string stored in the database is created using an irreversible algorithm so that while the string can be created from the password, the password cannot be created from the strin –  user46126 May 6 at 17:46
4  
Did you use your password on another site? –  Quora Feans May 6 at 18:26
4  
You might want to run your email through haveibeenpwned.com –  Bobson May 6 at 19:16

3 Answers 3

up vote 53 down vote accepted

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail.

When you are still using the password somewhere, you should change it ASAP. In the future you should avoid using the same password for different services. Data breaches become more and more frequent, and they even hit larger companies which really should know how to secure their systems. Using a password manager like KeePass can help you to manage all the different passwords.

share|improve this answer
34  
"honest" mistake from a spammer? I didn't know there was anything honest about those people. –  corsiKa May 5 at 21:05
2  
He meant the fact that the password was sent as the name was an "honest mistake" on their end. –  Ninjakreborn May 6 at 3:05
4  
This is not a spammer, but a scammer. –  Quora Feans May 6 at 18:24
4  
@corsiKa TODO: Start a "spam" business where we download data breaches and notify the users included in them along with their included personal information because some people aren't bright enough to notice the severity of the situation. Then we'll be the good guys –  Cole Johnson May 7 at 1:05
1  
@ColeJohnson I like the sarcasm, ironically such legitimate businesses already exist e.g. LifeLock in the US and Garlik in the UK to name just two examples –  RobV May 8 at 9:16

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one).

  1. At some point you could have accessed a fake PayPal website, via an external source. Perhaps you clicked a link in an email and didn't check the URL and put your Username/Password (old one) into a fake site which recorded your information. Then perhaps they were trying to obtain updated information from you, and made a mistake on their spammer with your password as your username. This might be explained by you possibly putting your "password" into the username field when you went to this fake site, by mistake. That is one possibility. To protect against this ALWAYS check for https://www.paypal.com as the login URL at the top. Anything else would be fake. Also you can always type it in directly instead of following any In-email links to be safe. As per the comment, the Heart bleed issue could also be the explanation. However, as a side note.. from what I read, PayPal was not affected by this bug. I checked and verified this from several sources.

  2. You could have a trojan or keylogger on your computer (or had one in there at the time of entering). Again you could have accidentally entered your password as your username so the keylogger could have detected it wrong, or just could have gotten them mixed up when they submitted it to an external source. Just make sure you have strong virus scanning software to protect against this.

  3. Internet explorer is another possible culprit. I have read a lot lately where they were telling everyone not to use IE anymore, as it had a huge security vulnerability. If you used IE for this in the past, that could have been another possible cause.

These are three possible situations.

Someone in the comments requested for me to provide resources in regards to the IE security vunerability. A google search for the term "IE Security Vunerability" will return some results.

Also the following link has some details pertaining to the specific security issue that I am speaking about in this answer.

http://www.cnet.com/news/stop-using-ie-until-bug-is-fixed-says-us/

http://www.reuters.com/article/2014/04/28/us-cybersecurity-microsoft-browser-idUSBREA3Q0PB20140428

http://www.geekwire.com/2014/u-s-government-advises-everyone-stop-using-internet-explorer-security-hole-surfaces/

Other sources can also be found by performing similar searches on Google, and other major search engines.

share|improve this answer
1  
Expanding on point 1.. In light of the recent heartbleed bug(not sure how effected paypal was), an attacker may have been able to spoof the paypal SSL certificate. –  Cruncher May 5 at 15:04
4  
4. Password re-use for an account with this email address on any other website/forum which was breached and didn't have anything to do with paypal. –  nvuono May 5 at 21:14
1  
@Cruncher, I just wanted to point out that spoofing the PayPal certificate would be an extreme measure for an attacker. There are much more probable ways they could have exploited HeartBleed to gain the password. –  David Houde May 5 at 22:46
    
@DavidHoude I was mainly alluding to To protect against this ALWAYS check for https://www.paypal.com as the login URL at the top which wouldn't have been enough had the ssl certificate leaked. And in general, point 1. was about visiting a fake paypal site. (The point doesn't matter anymore anyway. OP confirmed that paypal was not effected) –  Cruncher May 6 at 13:08
1  
@Kevin I have edited my original answer above. I have added 3 major sources for #3, and explained how further sources can also be found. –  Ninjakreborn May 7 at 1:09

"Is there anything I could do to protect myself?"
Change your passwords! Good grief, in the midst of debating the what and how of this scam, someone has suggested that you're safe, and don't need to change your PayPal password. I really hope that was the first thing you did, way before posting here.

Passwords are like underwear: Change them regularly whether you need to or not.

The passwords on your PayPal and email accounts should definitely be considered compromised. In fact, in light of Heartbleed, all your passwords should be changed--and there will always be another Heartbleed. We were just lucky to find out about this one. You were lucky enough to get notice from some crooks that they were fixin to rip you off.

Meanwhile, learn how to examine email headers to find out the sender's real address. Good, clear instructions can be found here .

share|improve this answer
    
Yes I have changed all passwords way before I even considered posting here. I just wanted to learn more about the situation. –  vermilions May 19 at 12:50

protected by Rory Alsop May 7 at 11:38

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.