[Aky786UK]

I get the odd phishing email from "Paypal" which immediately goes to their spoof department.

However, had a Paypal email officially saying my account's been restricted. Slightly worried with the phishing emails I've had and it says it won't allow me to do various things. Logged in OK but got no information when logging that I had to un-restrict my account.

I've not used my PP for a while with not buying/selling on ebay, anyone know if it's anything to be worried about and how do I unrestrict the account?

I've got a link in the email but hesitant to click it..

Help appreciated.

[moonmonkey812]

Try calling them up tomorrow, my account got restricted once, really annoying

[whyumadtho]

It should say something in the right-hand 'To Do' column. Are you sure the e-mail is legitimate?

[Illusionary]

(Original post by Aky786UK)
I get the odd phishing email from "Paypal" which immediately goes to their spoof department.

However, had a Paypal email officially saying my account's been restricted. Slightly worried with the phishing emails I've had and it says it won't allow me to do various things. Logged in OK but got no information when logging that I had to un-restrict my account.

I've not used my PP for a while with not buying/selling on ebay, anyone know if it's anything to be worried about and how do I unrestrict the account?

I've got a link in the email but hesitant to click it..

Help appreciated.

What exactly does the email say? Can you copy/paste it here?

[Aky786UK]

(Original post by Illusionary)
What exactly does the email say? Can you copy/paste it here?

Dear xxx,

You may have noticed that some limitations have been placed on your PayPal account. As a valued PayPal customer, we want to let you know what this means and how to resolve the situation.

What does it mean to have limited access?
Your account may be restricted for a number of reasons; you'll find out when you next log in to PayPal. As a result, you'll notice that some of the following options are now unavailable:
• Send money to other PayPal users
• Request or receive money from other users
• Edit or remove account details
• Close your PayPal account

How do I resolve the issue?
To assist us in our review, please log in to your account at www.paypal.co.uk. You will see a message explaining why your account has been restricted, with details of what to do next.

The account limitation process helps to maintain PayPal as a safer way to buy and sell. It's similar to passing through a security checkpoint. When we limit an account we often simply ask the user to supply information to verify their identity, financial information or the merchandise they're selling.
Lift your restriction now
PayPal aims to review account information within 48 hours* so please aim to get the information to us as soon as possible.

Yours sincerely,

PayPal

*Reviews are performed in the order they are received.

How do I know this is not a Spoof email? Spoof or ‘phishing’ emails tend to have generic greetings such as "Dear PayPal member". Emails from PayPal will always address you by your first and last name. Find out more here.

Frustrating thing is, I'm trying to follow their steps to give them the information and I can't find anything. Go to Resolution Centre and nothing appears, no message when I log in to unrestrict my account. Emailed them, if no reply, might have to call them.

[Illusionary]

(Original post by Aky786UK)
Frustrating thing is, I'm trying to follow their steps to give them the information and I can't find anything. Go to Resolution Centre and nothing appears, no message when I log in to unrestrict my account. Emailed them, if no reply, might have to call them.

A search for "You may have noticed that some limitations have been placed on your PayPal account. As a valued PayPal customer, we want to let you know what this means and how to resolve the situation." pulls up numerous phishing reports so I think you're right to be suspicious, especially if your account shows no such restrictions when logging in. Calling them is a good plan.

Does the email have your actual name in place of "xxx" your PayPal username, or something else? Also, what email program (or online service if this is via a webpage) do you use? If you can tell me that, I can explain how to see the email source code which may help to verify this one way or the other.

[Aky786UK]

Yeah, it had my username in place of the XXX's. Email was sent to my normal Yahoo page.

It's worrying, I did send some phishing emails to them last week or so, which I didn't get a response from Paypal saying thanks for sending them etc.

[Illusionary]

(Original post by Aky786UK)
Yeah, it had my username in place of the XXX's. Email was sent to my normal Yahoo page.

It's worrying, I did send some phishing emails to them last week or so, which I didn't get a response from Paypal saying thanks for sending them etc.

Under the "more actions" button, can you paste here what you get when you select "view full headers" (feel free to censor your own email address out from there). Also, when you hover your mouse over the link, what address shows up in the status bar at the bottom of your browser?

[de_monies]

PayPal will never call you by your username. They'll always call you by name, but not username

[Aky786UK]

(Original post by Illusionary)
Under the "more actions" button, can you paste here what you get when you select "view full headers" (feel free to censor your own email address out from there). Also, when you hover your mouse over the link, what address shows up in the status bar at the bottom of your browser?

From PayPal Fri Mar 16 0503 2012
X-Apparently-To: XXX@yahoo.co.uk via 87.248.103.57; Fri, 16 Mar 2012 0525 +0000
Return-Path: <www-data@csjfyy.com>
X-YahooFilteredBulk: 218.4.227.210
Received-SPF: none (domain of csjfyy.com does not designate permitted sender hosts)
X-YMailISG: V_7mRHIWLDvQ7UaG5btAAofOjEqAbYIQ HD42lAFXuagJ62c2
49ycYYj90GGOi26cAc0kuH05avoBI_Zu C28gg6zha3N8wjz59EJdl5OOP3EY
XHIdaE_XhRgbQyvsRmed5rKZTg7ZRCnB Tbl6xiMxarQiud7nrQueG6nhktgA
L_Tm8E.IzXP1UUJcqTEAH4x_5F7mq8.E bYdyhVB0BcgtWVgCswEhVS6PlYMn
WPWv0w4VwzswsGmfNCfE84bia4L26VOH am3I_ht6oMJMBJ2yUgCsk_b8aRCP
voIYUJQyDz6BaLJOpG3X94V_hl4b0CR8 pkp1hZKawJlITT_3XnEWswW6GCOZ
6oKRnh3x_pwR1ag_J4Kbqzh6gFuRf1uV tF5v_EdDETeJw_0DE5d_HMDCSKSX
J4CFaaCQ0H._hLM3unzv1KRHRLHpQnDb ozQm7CDu8l3l3Uj.HUV4Df9R3dKb
LnvghVguYtfnM2UGEh6qOrHBaULcmH1T 6rwDu18puerksZgN_NyeM5nQ.GKr
enFe1rPe7q2tfSlMnRk9pREGoyyIPIis 0Jq3TIjuRyd5IBt0g.XseIUFPCRR
jkQsqM64kKDMGlJtVgC6fuJPkSIJEYM5 BkJbrpRTQoZ3kCz.OOlYx94NUVs8
Dga9n0gJk9dUdl.yAPA49RkFpNDuDj5X AJfDdlAudlDbzd9xfqfjcBVa0ttG
n7.WR5QH6lMJudOLGTZLDiZE8WxHWakS YxKq.ohVYGrJgACRu1sOsbm1qjN.
khsNfe4gmaYi5gQd67C0l51jFQ4LZSA9 Jq65EnSn6XqbtLQ6lqkXNU0nhe8p
9mEGm5uBmnAylPgxq86c7WdLBGjBAfg_ wlQMwJSkoxZwnpzFpWvGjaAHNW1C
F9_zuPuCDaZ0FQnA97CHDWNagouO3fyF ZWn_w7X4u6rDItQdX0l0bkDPvKi2
4eBn9mPEOWg5jkrV6kU9fy7KvTU87ol5 RyF7QHFRAfZvUXY4kQALb5TXhw_J
qoFBHmSAICBOcmbC1KUrWtZcmFgoZufX jQ_U6UU365frb44au5fd3lxPl1MI
U7fYO3zLp798EZ3sWbVrgcTG7uYZ7FZt rV4pWWgVgHLlMDQwzcp33eFQhMc7
9fi0WFZbLjw11U_kpeh23ry3G3l8Fdks li4y5HehddEp91LN8g--
X-Originating-IP: [218.4.227.210]
Authentication-Results: mta1052.mail.ird.yahoo.com from=paypal.co.uk; domainkeys=neutral (no sig); from=paypal.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO dellt300.csjfyy.com) (218.4.227.210)
by mta1052.mail.ird.yahoo.com with SMTP; Fri, 16 Mar 2012 0525 +0000
Received: by dellt300.csjfyy.com (wjzx, from userid 33)
id 809E2E61EB2; Fri, 16 Mar 2012 1303 +0800 (CST)
To: XX@yahoo.co.uk
Subject: Your Account is Restricted.
From: PayPal <service@paypal.co.uk>
Content-Type: text/html
Message-Id: <20120316055503.809E2E61EB2@dell t300.csjfyy.com>
Date: Fri, 16 Mar 2012 1303 +0800 (CST)
Content-Length: 16232

The address at the bottom:

http://weld-unlim.vpn.mgn.ru/reposit...yemailusername

[Illusionary]

(Original post by Aky786UK)
The address at the bottom:

Scam, 100% definite. The link does't point to PayPal and see these parts in bold here:

From PayPal Fri Mar 16 05:55:03 2012
X-Apparently-To: XXX@yahoo.co.uk via 87.248.103.57; Fri, 16 Mar 2012 05:58:25 +0000
Return-Path: <www-data@csjfyy.com>
X-YahooFilteredBulk: 218.4.227.210
Received-SPF: none (domain of csjfyy.com does not designate permitted sender hosts)
X-YMailISG: V_7mRHIWLDvQ7UaG5btAAofOjEqAbYIQ HD42lAFXuagJ62c2
49ycYYj90GGOi26cAc0kuH05avoBI_Zu C28gg6zha3N8wjz59EJdl5OOP3EY
XHIdaE_XhRgbQyvsRmed5rKZTg7ZRCnB Tbl6xiMxarQiud7nrQueG6nhktgA
L_Tm8E.IzXP1UUJcqTEAH4x_5F7mq8.E bYdyhVB0BcgtWVgCswEhVS6PlYMn
WPWv0w4VwzswsGmfNCfE84bia4L26VOH am3I_ht6oMJMBJ2yUgCsk_b8aRCP
voIYUJQyDz6BaLJOpG3X94V_hl4b0CR8 pkp1hZKawJlITT_3XnEWswW6GCOZ
6oKRnh3x_pwR1ag_J4Kbqzh6gFuRf1uV tF5v_EdDETeJw_0DE5d_HMDCSKSX
J4CFaaCQ0H._hLM3unzv1KRHRLHpQnDb ozQm7CDu8l3l3Uj.HUV4Df9R3dKb
LnvghVguYtfnM2UGEh6qOrHBaULcmH1T 6rwDu18puerksZgN_NyeM5nQ.GKr
enFe1rPe7q2tfSlMnRk9pREGoyyIPIis 0Jq3TIjuRyd5IBt0g.XseIUFPCRR
jkQsqM64kKDMGlJtVgC6fuJPkSIJEYM5 BkJbrpRTQoZ3kCz.OOlYx94NUVs8
Dga9n0gJk9dUdl.yAPA49RkFpNDuDj5X AJfDdlAudlDbzd9xfqfjcBVa0ttG
n7.WR5QH6lMJudOLGTZLDiZE8WxHWakS YxKq.ohVYGrJgACRu1sOsbm1qjN.
khsNfe4gmaYi5gQd67C0l51jFQ4LZSA9 Jq65EnSn6XqbtLQ6lqkXNU0nhe8p
9mEGm5uBmnAylPgxq86c7WdLBGjBAfg_ wlQMwJSkoxZwnpzFpWvGjaAHNW1C
F9_zuPuCDaZ0FQnA97CHDWNagouO3fyF ZWn_w7X4u6rDItQdX0l0bkDPvKi2
4eBn9mPEOWg5jkrV6kU9fy7KvTU87ol5 RyF7QHFRAfZvUXY4kQALb5TXhw_J
qoFBHmSAICBOcmbC1KUrWtZcmFgoZufX jQ_U6UU365frb44au5fd3lxPl1MI
U7fYO3zLp798EZ3sWbVrgcTG7uYZ7FZt rV4pWWgVgHLlMDQwzcp33eFQhMc7
9fi0WFZbLjw11U_kpeh23ry3G3l8Fdks li4y5HehddEp91LN8g--
X-Originating-IP: [218.4.227.210]
Authentication-Results: mta1052.mail.ird.yahoo.com from=paypal.co.uk; domainkeys=neutral (no sig); from=paypal.co.uk; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO dellt300.csjfyy.com) (218.4.227.210)
by mta1052.mail.ird.yahoo.com with SMTP; Fri, 16 Mar 2012 05:58:25 +0000
Received: by dellt300.csjfyy.com (wjzx, from userid 33)
id 809E2E61EB2; Fri, 16 Mar 2012 13:55:03 +0800 (CST)
To: XX@yahoo.co.uk
Subject: Your Account is Restricted.
From: PayPal <service@paypal.co.uk>
Content-Type: text/html
Message-Id: <20120316055503.809E2E61EB2@dell t300.csjfyy.com>
Date: Fri, 16 Mar 2012 13:55:03 +0800 (CST)
Content-Length: 16232

"csjfyy.com" is quite a way from being "paypal.com" and that IP address - 218.4.227.210 - for the point of origination is some random place in the middle of China.

Plus yes, PayPal wil never address you by your username.

[Aky786UK]

Phew! Thanks alot mate for that, really really appreciate. After seen a few phishing ones, I thought this one was the real deal but thanks for the alert on this one. Is it still worth ringing them up to be on the safe side? I logged into my account successfully without any issues so was bricking it abit.

[hannahhaworth]

illusionary is a hero

[Illusionary]

(Original post by Aky786UK)
Phew! Thanks alot mate for that, really really appreciate. After seen a few phishing ones, I thought this one was the real deal but thanks for the alert on this one. Is it still worth ringing them up to be on the safe side? I logged into my account successfully without any issues so was bricking it abit.

I doubt they'd do much about a single email report in isolation, to be honest, so I wouldn't bother with a call (especially given that it's an 0870 number). I'd suggest that you just forward it on to their spoof reporting address and leave it at that.

(Original post by hannahhaworth)
illusionary is a hero

Thanks

[Aky786UK]

^He's lived up to his hero billing very aptly, saving me from this attempt by some geek in China...

[ak137]

Illusionary <3

[Deja Vu]

Fake e-mail is fake.

As already mentioned, they always address you using Firstname Lastname. I think any super important/sensitive ones also include the first part of your post code in the top right hand side too.

[Aky786UK]

I just wanted to show you guys the difference in the normal spoof emails and the one I got last night.

Attached is the first one, which is boring text which is easy to figure. But the second one was a better presentationally, and which nearly had me hooked.