Identity & eBay/Paypal frauds

[Sheepman]

I recently got the following mail (which appeared in my Spam mail - immediately arousing suspicions) -

from: PayPal UK <online@paypal.co.uk>
Subject: A Message Regarding Your Account!

Dear PayPal Member,

We have reason to suspect that your PayPal account may be in use by an
unauthorized party.

Your account has recently been accessed from a foreign country, while we
understand that you may be on vacation or traveling abroad, PayPal
Security has a obligation to protect our user's security. Within 24
hours of this message, your account will be placed on hold to ensure
your personal account safety. Verification of your specific account
details will enable you to once again have full access to your PayPal
account.


To ensure that your service is not interrupted, please submit your
billing information today:
http://paypal.co.uk/users/xxxrenewobligation?start=ok
Or contact PayPal Member Services Team. We're available 24 hours a day,
7 days a week.

Regards,
PayPal Team.

It all sounds very feasible, although I didn't see how my account could have been accessed, my security information is very obscure! So I checked my account, no problems, and got the following reply after forwarding the above mail to Paypal.
(I've put some xs into the link, so it shouldn't work.)

Dear Greg,
Thank you for contacting PayPal about a fraudulent (spoof) email or Web
site. We appreciate you bringing this suspicious email to our attention.

We can confirm that the email you received was not sent by PayPal. Any
website which may be linked to this email is not authorized or used by
PayPal.

Our fraud prevention team is working to disable any website linked to
this email. In the meantime, please do not enter any information into
this website. If you have already done so, you should immediately log
into your PayPal account and change your password, as well as your
security questions and answers. We also recommend that you contact your
bank and credit card company immediately.

If you notice any unauthorized activity on your PayPal account, please
report it to us by following the instructions below:
1. Log in to your account at https://www.paypal.com/
2. Click on the Security Center link at the bottom of the page.
3. Click on the "Unauthorized Transaction" link under the Report a
Problem column.
4. Follow the instructions on this page in order to access the
appropriate form.

Lastly, we recommend taking a few steps to protect yourself from
identity theft:

1. Download the SafetyBar, a toolbar for Outlook and Outlook Express,
which identifies known spoof emails.
2. Get eBay Toolbar with Account Guard which warns you when you're on a
potentially fraudulent (spoof) Web site.
3. Sign up for Equifax Credit Alerts for PayPal Users, a program that
provides an early warning detection system in the event of identity
theft. Find out more by visiting the PayPal Identity Protection Center
at www.paypal.com/idprotection.
4. Frequently monitor your PayPal account for suspicious activity.

For additional tips please visit the PayPal Security Center at
https://www.paypal.com/security.

Thank you again for sending us your report. We appreciate your efforts
to keep PayPal safe.

Sincerely,

PayPal
PayPal Account Review Department
__________________________________________________ ____________

Important: PayPal and its representatives will NEVER ask you to reveal
your password. There are NO EXCEPTIONS to this policy. If anyone
claiming to work for PayPal asks for your password under any
circumstances, by email or by phone, please refuse and immediately
contact us via our secure webform online.

I hope that helps somebody avoid problems.

Greg

[Northants Girly]

It's not just eBay/Paypal users that need to be careful.

A friend of mine thinks she has just had her id stolen through using Freecycle. Someone replied to a post she had made to give something away and she gave them her home address and mobile number so they could pick it up. She never heard from them again but has since had worrying messages left on the mobile.

[Sheepman]

And for the paranoid (What, me?) Here's some tips I've seen regarding bank account security.

Banking Tip
Banks often ask you for a secret question/answer security pair

Use Intelligent Word Association for this (not real-life responses)

Examples
"What is you Mother's Maiden Name?"
NEVER use your mother's maiden name here use something obscure like your mother's pet name for you

"What Town/City was your place of birth?"
NEVER put the town/city you were born in here use say a memorable town that you have been to

"What was you first school?"
NEVER put your first school in here use a response that you can relate to your first school (ie. a friends first school or something more obscure)

Why? Your place of birth, mother's maiden name etc exist in public records
(anyone can look them up)

It's not generally a case of not being able to trust the bank, but if someone targets you, you wouldn't want them to easily find the information that will give them access to your accounts.
The problem is, if you start using obscure information, then it becomes impossible to remember it all, so you have to write it down, which is just what all the advice tells you not to do.
Roll on biometric IDs...?

Greg

[Northants Girly]

The message left on my friend's mobile said something like "Jane Smith (not her real name) eats ****".
It was especially not nice and worrying as it sounded like a real voice as opposed to a recorded message and they used her name.

Later, she had a call which she answered. Someone with the same voice was pretending to be from somewhere or other and asking for info like her D.O.B. so she got suspicious and hung up.

[Dreadful Scathe]

Roll on biometric IDs...?

it would just introduce other loopholes

"Government IT" is an oxymoron

[Sheepman]

An interesting item on the radio today was describing how recycled hard drives purchased in a market in Nigeria, provided full personal details of the previous owners of the computer.

The presenter rang up this guy in Essex, to tell him everything they knew, his CV, family details, N.I. number and bank account details. He was, to say the least, shocked.

So if you're recycling a computer, make sure you delete all data from the hard drive, (just deleting the files, or even drilling a hole in the hard drive isn't sufficient) free downloads to do this are available at http://www.howtowipeyourdrive.com/

Curiously I can't find any reference to the item on the BBC site, I suppose it must have been deleted...

Greg

[Icey]

Curiously I can't find any reference to the item on the BBC site, I suppose it must have been deleted...

Greg

Try BBC News Article

[Barry Shnikov]

{SNIP}
Examples
"What is you Mother's Maiden Name?"
NEVER use your mother's maiden name here use something obscure like your mother's pet name for you

"What Town/City was your place of birth?"
NEVER put the town/city you were born in here use say a memorable town that you have been to

"What was you first school?"
NEVER put your first school in here use a response that you can relate to your first school (ie. a friends first school or something more obscure)

Why? Your place of birth, mother's maiden name etc exist in public records
(anyone can look them up)
{SNIP}

The object of the exercise is to allow the web site operator to prompt you to remember something that you will not readily forget so you can get a prompt if you forget your password.

If you pick something as an obscure alternative, and you don't need to use the prompting question for 2 years, you are going to feel pretty stupid that you didn't use your mother's maiden name but cannot remember what you did use.

[LemonCake]

The object of the exercise is to allow the web site operator to prompt you to remember something that you will not readily forget so you can get a prompt if you forget your password.

If you pick something as an obscure alternative, and you don't need to use the prompting question for 2 years, you are going to feel pretty stupid that you didn't use your mother's maiden name but cannot remember what you did use.

This is true but what about when your mother uses her maiden name? I have a couple of alternatives and use them under particular circumstances. Most of the information the bank asks me for is stuff that would be quite simple to find out for anyone with even a modicum of determination and a computer, so I'd rather go with something unrelated/obscure.

I'm just reactivating a couple of online accounts for which I'd forgotten passwords. While it is tedious to have to wait for snail mail, it is comforting that they are taking the care to make sure I am who I claim to be by getting written confirmation from me. If that's what it takes to make sure my ID won't get hijacked, I'll be patient.

[philsmove]

I have an old computer that’s broken

I can’t turn even turn it on

So how do I wipe the hard disk?

[Dreadful Scathe]

attach it to a computer that does work through an external USB cable/enclosure (about £12) or internally by adding it to the IDE cable inside the machine.

Or buy huge magnets and put them on top for a week, boil it in a vat of oil for 20 hours or so then send 30,000 volts through it afterward just to make sure.

I used to work for a computer tape drive company and when the engineers were sent out for warranty repairs to military installations they were allowed to check the drives to see that there was a problem (whilst supervised) ;the drive was then physically destroyed before their eyes. So no "repairs" as such , new drive every time.

[El Salsero Gringo]

I have an old computer that’s broken

I can’t turn even turn it on

So how do I wipe the hard disk?

If it's an old computer then the hard drive is no use any more, new drives having vastly bigger capacities for small sums of money. So by far the best way to prevent the data being read is physical destruction, which is easier than it sounds:

Take the lid off, to expose the platters then take a pair of pliers to them and bend them out of shape. The high tolerances required in a working drive mean that even if someone tried to straighten them they'd never work.

If you haven't got the right tool to get the lid off the drive pack (usually a torx driver) then just take the unit outside, wrap it in a old towel, put it on a paving stone - then hit it, repeatedly, and very hard, with a regular 16 oz. hammer until you achieve the same end. (No, I'm not kidding.)

[Tiggerbabe]

If you haven't got the right tool to get the lid off the drive pack (usually a torx driver) then just take the unit outside, wrap it in a old towel, put it on a paving stone - then hit it, repeatedly, and very hard, with a regular 16 oz. hammer until you achieve the same end. (No, I'm not kidding.)

Ooooh, I've still got my old (and dead) pc hanging about in the garage, but that sounds like a lot of fun. I think I'll have to try it

[whitetiger1518]

Sounds like a good destressing tool... I work at my computer all day at work (except when on here (oops there goes my job! )) so breaking a computer up would definitely work for destressing me

Whitetiger

[Barry Shnikov]

This is true but what about when your mother uses her maiden name? I have a couple of alternatives and use them under particular circumstances. Most of the information the bank asks me for is stuff that would be quite simple to find out for anyone with even a modicum of determination and a computer, so I'd rather go with something unrelated/obscure.
I'm just reactivating a couple of online accounts for which I'd forgotten passwords. While it is tedious to have to wait for snail mail, it is comforting that they are taking the care to make sure I am who I claim to be by getting written confirmation from me. If that's what it takes to make sure my ID won't get hijacked, I'll be patient.

You must do whatever you feel comfortable with to protect your private data.
All I'm saying is that the suggestion above - that the user put in some irrelevant data - is not going to much help unless they also remember the connection between the prompt question from the operator (What was your first dog's name?) and what you actually put in, which was your favourite football team.


(A prize to anyone who thought "Rovers!")

[Sheepman]

- that the user put in some irrelevant data - is not going to much help

But the whole point is that the data is not irrelevant to you, but it is also not on public records. So I imagine for most people. their dog's name would be fine, unless it was a very famous dog.

Greg

[El Salsero Gringo]

that sounds like a lot of fun

if it's a computer that you've struggled with a lot while it was alive, then you have *no idea* how satisfying it is until you try it!