This weekend, Paypal started sending me emails with discount offers based on websites I visit in incognito mode on my phone.
- I have an Android smartphone and am browsing in incognito mode in Chrome. I have the latest security updates for my phone installed (they're issued monthly) and Chrome is up-to-date
- I have a Paypal account but only use it rarely; I have never logged into my Paypal account on my phone, but have logged into my account from my PC on the same home network (and therefore same IP address).
- I close all my incognito tabs (thus clearing any cookies) every day or two
- On two separate occasions over two days, about an hour after I visited the website for a retailer, Paypal sent me an email offer to save $5 if I made a purchase on that retailer's website with Paypal (these were two different retailers). I have never before received this kind of email offer from Paypal.
I do not believe this is a phishing scam. The emails from Paypal look completely legit, with the correct email address and none of the typos, misplaced graphics, or other telltale signs of a copycat email. The emails do not ask me for my credentials or include a link to a login page; they do include a valid link to the retailer's real website (not a similar looking phishing website). They instruct me to purchase an item from the website and use Paypal as my payment method in order to redeem the offer.
I am trying to think of an explanation for this disturbing invasion of my privacy. Unless Paypal is knowingly using illegal spyware to monitor web browsing on smartphones, this seems like the most likely explanation (though I'm not sure if it's legal): The retailers have an agreement with Paypal to send Paypal a list of every IP address that visits their website; Paypal correlates this with a list of known IP addresses of their users and emails the users it recognizes with offers.
Are there other possibilities I haven't considered? What can I do to protect myself from Paypal's monitoring of my private web browsing, other than resetting my modem to change my IP address?