0

[This is a "soft" question and as such I'm not sure it's appropriate for this site. However, it does involve information security.]

I have an email address, me@gmail.com that is not associated with a PayPal account, but which is associated with my real name. I.e., if you google my name you will find mailing list posts and so on from this address.

On 6/16 I received a pair of strange emails sent to this me@gmail.com address, which were then auto-forwarded to my main non-gmail address: 

21:10 - "joe schmoe sent you $8.00 USD"
21:11 - "joe schmoe canceled this PayPal payment"

A couple of relevant facts/observations:

  • I don't know this person joe schmoe (name changed).
  • From header is "joe schmoe via PayPal "

  • I run my own restrictive Postfix server, and the message seems to have passed dkim:

    Authentication-Results: mail.mydomain.com; dkim=pass reason="2048-bit key" header.d=paypal.com header.i=@paypal.com header.b=nxnKW97L; dkim-adsp=pass Authentication-Results: mx.google.com; spf=pass (google.com: domain of member@paypal.com designates 173.0.84.226 as permitted sender) smtp.mail=member@paypal.com; dkim=pass header.i=@paypal.com; dmarc=pass (p=REJECT dis=NONE) header.from=paypal.com

This passed spf/dkim at both the Gmail level and my local mail server.

Therefore, it seems like the messages were legitimately from PayPal.

Which in my mind leads to 2 general possibilities

  1. This was a mere accident, and the person figured it out and caught it.
  2. This is some kind of sophisticated attempt to hack/steal identity/???

Thanks in advance for any light your expertise can shed on this.

|improve this question
  • Looks like "Joe" mistyped the intended recipient's address. Do the links in the email point to PayPal? – schroeder♦ Jun 30 '14 at 17:41
  • Yes. However, I get the nagging feeling that this "mistype" could have been an attempt at some kind of hacking. Perhaps using PayPal for email verification? Or maybe that's paranoid... – g33kz0r Jun 30 '14 at 17:43
  • That's a convoluted method for email verification. "When you see hoofprints, think 'horses' not 'zebras'". Unless there was some force prompting you to act in some way, this looks like an honest mistake. – schroeder♦ Jun 30 '14 at 17:47
  • Fair enough. The reason my mind went elsewhere is that my Gmail address is a relatively uncommon 8-letter English word. I can't imagine how someone could possibly accidentally type it instead of something else. It does, however, seem like a word that would be used in a dictionary-based attack. – g33kz0r Jun 30 '14 at 17:49
  • 1
    @AndrewHoffman, you're actually asking them to purchase it :-). – LSerni Jun 30 '14 at 21:42
1

As things stand, there's not yet anything that makes me think of an attack.

It could conceivably be a really, really convoluted and unlikely confidence scam:

  • step 1: I make a payment to you (but I'd do that with a larger sum)
  • step 2: I withdraw the payment

Most confidence scams are based on the victim's dishonesty; their willingness to do something fishy for gain, and their belief in being smarter than the attacker, who they're led to see as their victim.

So, while farfetched, I could then proceed with:

  • step 3: send an email to you asking whether you've received my payment.

This step has the purpose of separating honest people (who will answer "I got this payment and saw it rejected, but who are you? You owe me nothing! What payment is this? You probably got the wrong person...") from gullible marks, who will try and see if they can milk me and, for example, entice me into repeating the payment (you'd be surprised...).

So if I get a "honest reply" I don't even bother answering and proceed to the next mark.

If I get an evasive or shady answer though, I can proceed with

  • step 4 (repeatedly): I start fretting for some "merchandise" to be sent, and send over emails and error messages to show that I'm a complete idiot that can't complete a Web payment. Again, a honest person will come clean; a "mark" will be brought to a frenzy, sure that a lump of money is going to head his way Very Soon Now.

  • step 5: at last I "surrender" and tell that, let's see, my bank manager has agreed to do everything himself and get the matter off my chest if only I can supply him with your bank account details and access codes.

Of course, it will only work in a very small minority of cases - it's a variation on the basic 419 Nigerian scam - but give a look at 419's victims' statistics. They're still falling for it. And this time there was, albeit fleetingly and soon taken back, some Paypal money coming.

The cost for the scammer is still negligible.

So if things stay as they are, compatible with a Stage 2 but no more, I wouldn't worry overmuch. A genuine, if unlikely, typing mistake. Or maybe a Freudian slip - your username is destrier and the intended recipient was called courser, for example.

Should they proceed with Stage 3, though, improbable as it is, I'd send the whole conversation to the nearest appropriate authority, as well as Paypal. Let them sort it out.

|improve this answer
  • Welp, looks like I can finally quit my day job. – g33kz0r Jul 1 '14 at 3:47
0

Legitimate emails from Paypal appear to come from the user email sending the payment. As to why this is, I do not know.

I would attempt to see if you can gain access to the associated Paypal account that this payment has gone to, if it is indeed under your name and email address.

Here is a Paypal community post that clarifies the issue from the sender's perspective: https://www.paypal-community.com/t5/How-to-use-PayPal-Archive/Remove-your-paypal-email-from-Payment-receipt-email-notification/m-p/13655/highlight/true#M32703

To answer your question:

As with any attack, I'd look at the motivation. Are there any red flags other than this supposed mistake that leads you to believe that you are under attack? Do you have a fairly common name that could have lead to a mistake that was easy to make? Have you seen any other reconnaissance type attacks? Anything suspicious at your firewall?

|improve this answer
  • Yours is an interesting observation, and link, but I'm not sure it answers my central question - which is again, whether this series of emails was a mistake or something nefarious. – g33kz0r Jun 30 '14 at 17:51
  • I'd keep an eye out, but for the most part, it could possibly be a mistake, especially if you have a rather simple email address. – vbiqvitovs Jun 30 '14 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.