Paypal sent an email addressing me with one of my old passwords as my name

Question

I got this email from [email protected], with the title:

Your account has been limited until we hear from you.

I think this is a scam / spoof email because I don't see any notification in my Paypal account and this is Hotmail account is not used as my Paypal login. (It used to be not any more for more than a year.)

But the troubling thing is, the TO: field has my old password as my name, then my email in brackets. A screenshot below should clarify what I'm saying. I've blurred my email and the two red arrows are pointing to what was my old password in plain text.

Is there anything I could do to protect myself? Does that mean the sender has me under their "contact book" with my name as my password? I have already forwarded the email to [email protected].

Answer 1

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail.

When you are still using the password somewhere, you should change it ASAP. In the future you should avoid using the same password for different services. Data breaches become more and more frequent, and they even hit larger companies which really should know how to secure their systems. Using a password manager like KeePass can help you to manage all the different passwords.

Answer 2

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one).

1. At some point you could have accessed a fake PayPal website, via an external source. Perhaps you clicked a link in an email and didn't check the URL and put your Username/Password (old one) into a fake site which recorded your information. Then perhaps they were trying to obtain updated information from you, and made a mistake on their spammer with your password as your username. This might be explained by you possibly putting your "password" into the username field when you went to this fake site, by mistake. That is one possibility. To protect against this ALWAYS check for https://www.paypal.com as the login URL at the top. Anything else would be fake. Also you can always type it in directly instead of following any In-email links to be safe. As per the comment, the Heart bleed issue could also be the explanation. However, as a side note.. from what I read, PayPal was not affected by this bug. I checked and verified this from several sources.

2. You could have a trojan or keylogger on your computer (or had one in there at the time of entering). Again you could have accidentally entered your password as your username so the keylogger could have detected it wrong, or just could have gotten them mixed up when they submitted it to an external source. Just make sure you have strong virus scanning software to protect against this.

3. Internet explorer is another possible culprit. I have read a lot lately where they were telling everyone not to use IE anymore, as it had a huge security vulnerability. If you used IE for this in the past, that could have been another possible cause.

These are three possible situations.

Someone in the comments requested for me to provide resources in regards to the IE security vunerability. A google search for the term "IE Security Vunerability" will return some results.

Also the following link has some details pertaining to the specific security issue that I am speaking about in this answer.

http://www.cnet.com/news/stop-using-ie-until-bug-is-fixed-says-us/

http://www.reuters.com/article/2014/04/28/us-cybersecurity-microsoft-browser-idUSBREA3Q0PB20140428

http://www.geekwire.com/2014/u-s-government-advises-everyone-stop-using-internet-explorer-security-hole-surfaces/

Other sources can also be found by performing similar searches on Google, and other major search engines.

Answer 3

"Is there anything I could do to protect myself?"
Change your passwords! Good grief, in the midst of debating the what and how of this scam, someone has suggested that you're safe, and don't need to change your PayPal password. I really hope that was the first thing you did, way before posting here.

Passwords are like underwear: Change them regularly whether you need to or not.

The passwords on your PayPal and email accounts should definitely be considered compromised. In fact, in light of Heartbleed, all your passwords should be changed--and there will always be another Heartbleed. We were just lucky to find out about this one. You were lucky enough to get notice from some crooks that they were fixin to rip you off.

Meanwhile, learn how to examine email headers to find out the sender's real address. Good, clear instructions can be found here .

Answer 4

Quite sure there was a breach on Epsilon's side, the data handler for PayPal I believe. This was quite a while ago though since I cant remember what data was leaked. I am not sure if it is related to that, or a breach from another site with a shared password. What you should do is if you didn't format your PC since you used that password you should format your PC and then change the passwords after. Make sure any backups are clean from malware too. At this point it is hard to know if the breach is from malware or a data leak, but since you are opening such emails it could be malware, I would recommend checking about the XSS attacks that can be used via tracking pixels, as you are using outlook you should be using view source and looking at headers before even deciding if the email should be opened.