I got this email from [email protected], with the title:

Your account has been limited until we hear from you.

I think this is a scam / spoof email because I don't see any notification in my Paypal account and this is Hotmail account is not used as my Paypal login. (It used to be not any more for more than a year.)

But the troubling thing is, the TO: field has my old password as my name, then my email in brackets. A screenshot below should clarify what I'm saying. I've blurred my email and the two red arrows are pointing to what was my old password in plain text.

Is there anything I could do to protect myself? Does that mean the sender has me under their "contact book" with my name as my password? I have already forwarded the email to [email protected].

enter image description here

  • 32
    Looks like a sloppy phisher has done you a huge favor by notifying you. May 5, 2014 at 15:20
  • 1
    Paypal doesn't start their emails with 'dear customer', but with your full name. They know your name, you provided it to them. The spammer/scammer probably doesn't know your full name.
    – user46060
    May 5, 2014 at 20:09
  • 3
    Is your old password a common phrase or name? It might just be a coincidence.
    – Kami
    May 6, 2014 at 14:21
  • 7
    Did you use your password on another site? May 6, 2014 at 18:26
  • 6
    You might want to run your email through haveibeenpwned.com
    – Bobson
    May 6, 2014 at 19:16

4 Answers 4


It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail.

When you are still using the password somewhere, you should change it ASAP. In the future you should avoid using the same password for different services. Data breaches become more and more frequent, and they even hit larger companies which really should know how to secure their systems. Using a password manager like KeePass can help you to manage all the different passwords.

  • 38
    "honest" mistake from a spammer? I didn't know there was anything honest about those people.
    – corsiKa
    May 5, 2014 at 21:05
  • 3
    He meant the fact that the password was sent as the name was an "honest mistake" on their end. May 6, 2014 at 3:05
  • 5
    This is not a spammer, but a scammer. May 6, 2014 at 18:24
  • 6
    @corsiKa TODO: Start a "spam" business where we download data breaches and notify the users included in them along with their included personal information because some people aren't bright enough to notice the severity of the situation. Then we'll be the good guys
    – Cole Tobin
    May 7, 2014 at 1:05
  • 3
    @ColeJohnson I like the sarcasm, ironically such legitimate businesses already exist e.g. LifeLock in the US and Garlik in the UK to name just two examples
    – RobV
    May 8, 2014 at 9:16

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one).

  1. At some point you could have accessed a fake PayPal website, via an external source. Perhaps you clicked a link in an email and didn't check the URL and put your Username/Password (old one) into a fake site which recorded your information. Then perhaps they were trying to obtain updated information from you, and made a mistake on their spammer with your password as your username. This might be explained by you possibly putting your "password" into the username field when you went to this fake site, by mistake. That is one possibility. To protect against this ALWAYS check for https://www.paypal.com as the login URL at the top. Anything else would be fake. Also you can always type it in directly instead of following any In-email links to be safe. As per the comment, the Heart bleed issue could also be the explanation. However, as a side note.. from what I read, PayPal was not affected by this bug. I checked and verified this from several sources.

  2. You could have a trojan or keylogger on your computer (or had one in there at the time of entering). Again you could have accidentally entered your password as your username so the keylogger could have detected it wrong, or just could have gotten them mixed up when they submitted it to an external source. Just make sure you have strong virus scanning software to protect against this.

  3. Internet explorer is another possible culprit. I have read a lot lately where they were telling everyone not to use IE anymore, as it had a huge security vulnerability. If you used IE for this in the past, that could have been another possible cause.

These are three possible situations.

Someone in the comments requested for me to provide resources in regards to the IE security vunerability. A google search for the term "IE Security Vunerability" will return some results.

Also the following link has some details pertaining to the specific security issue that I am speaking about in this answer.




Other sources can also be found by performing similar searches on Google, and other major search engines.

  • 1
    Expanding on point 1.. In light of the recent heartbleed bug(not sure how effected paypal was), an attacker may have been able to spoof the paypal SSL certificate.
    – Cruncher
    May 5, 2014 at 15:04
  • 4
    4. Password re-use for an account with this email address on any other website/forum which was breached and didn't have anything to do with paypal.
    – nvuono
    May 5, 2014 at 21:14
  • 1
    @Cruncher, I just wanted to point out that spoofing the PayPal certificate would be an extreme measure for an attacker. There are much more probable ways they could have exploited HeartBleed to gain the password. May 5, 2014 at 22:46
  • @DavidHoude I was mainly alluding to To protect against this ALWAYS check for https://www.paypal.com as the login URL at the top which wouldn't have been enough had the ssl certificate leaked. And in general, point 1. was about visiting a fake paypal site. (The point doesn't matter anymore anyway. OP confirmed that paypal was not effected)
    – Cruncher
    May 6, 2014 at 13:08
  • 1
    @Kevin I have edited my original answer above. I have added 3 major sources for #3, and explained how further sources can also be found. May 7, 2014 at 1:09

"Is there anything I could do to protect myself?"
Change your passwords! Good grief, in the midst of debating the what and how of this scam, someone has suggested that you're safe, and don't need to change your PayPal password. I really hope that was the first thing you did, way before posting here.

Passwords are like underwear: Change them regularly whether you need to or not.

The passwords on your PayPal and email accounts should definitely be considered compromised. In fact, in light of Heartbleed, all your passwords should be changed--and there will always be another Heartbleed. We were just lucky to find out about this one. You were lucky enough to get notice from some crooks that they were fixin to rip you off.

Meanwhile, learn how to examine email headers to find out the sender's real address. Good, clear instructions can be found here .

  • Yes I have changed all passwords way before I even considered posting here. I just wanted to learn more about the situation.
    – apertur
    May 19, 2014 at 12:50

Quite sure there was a breach on Epsilon's side, the data handler for PayPal I believe. This was quite a while ago though since I cant remember what data was leaked. I am not sure if it is related to that, or a breach from another site with a shared password. What you should do is if you didn't format your PC since you used that password you should format your PC and then change the passwords after. Make sure any backups are clean from malware too. At this point it is hard to know if the breach is from malware or a data leak, but since you are opening such emails it could be malware, I would recommend checking about the XSS attacks that can be used via tracking pixels, as you are using outlook you should be using view source and looking at headers before even deciding if the email should be opened.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .