cicerone imposter wrote:BTW, PayPal sent out a notice informing customers that they never ask for personal info by email, and to make sure that the adress line shows <http://www.PayPal.com>. Other senders are unable to use their email address.
Woah, that's dangerous counsel.
ANYONE can send email and make it look like it comes from their address and it's very easy (requiring no computer skills).
When they say to verify the URL they are talking about when you log in to your account
through your browser, not email.
For example, it would be easy for someone to send you an email with paypal.com as the return address (forging this header). In the email they could have a link that looks like paypal.com but that directs you to a different site.
e.g.
www.paypal.com
That's a link to Able2Know's home page.
Now if they trick you into getting to a page they control they will have that page designed exactly like paypal hoping you will log in (and send them your account name and password through their page).
So paypal is saying to make sure that whenever you enter your password, you ONLY do it on a a page on the paypal.com website. Do not enter it on any other variation, someone could easily register something similar to paypal and then pull the email trick.
As long as you never type that password in
any emails or on
webpages other than paypal.com you are safe from this very simple trick.