In the lead up to Christmas when PayPal members may be using their accounts more often than usual, be wary of authentic-looking emails doing the rounds purporting to be from the company.
Phishing emails are fakes that attempt to collect your personal and financial information for use by criminal scammers. Generally they take you through to spoof websites that encourage you to enter personal information like credit card numbers, bank details and account passwords.
Several have landed in my inbox recently, so convincing in appearance that even I – supposedly an experienced personal finance writer – initially thought they may be genuine .
The first appeared to be a receipt for a payment made from my PayPal account to Asda for a Motorola baby monitor, a purchase I had definitely not made. Having been the victim of identity theft in the past, it rang true. This email was followed by two more warning me that because, "our security system has detected unusual charges to a card linked to your PayPal account", a "limitation" had been put on to my account.
One said that the screening had picked up potentially fraudulent attempts to use my account details by someone overseas and I needed to let them know if it had, in fact, been me. It told me that I could sort things out and remove the limitation by filling out and submitting an attached form.
These emails were professional and convincing in tone and had all the "right" logos, letterheads and so on.
But two things alerted me. First, I had recently used my PayPal account to make a genuine payment so I knew there was no "limitation". Neither were there any suspicious payments to Asda or any other recipient recorded on my latest statement. But what really set the alarm bells ringing was that the attached form asked me to fill in my credit card details – something any reputable bank or financial institution would never ask you to do.
There are several ways to tell if an email purporting to be from PayPal is fake:
• It uses a generic greeting like "Dear user" or "Hello, PayPal member" or no greeting at all. Genuine PayPal emails always address you by the name on your PayPal account.
• It requests personal/financial details, such as your bank account or card numbers, your full name, your account password or the answers to your PayPal security questions. Genuine PayPal emails never ask you to send information via email. If details are needed from you, the email will ask you to log in to your account separately via the PayPal website.
• It includes an attachment. Genuine PayPal emails never do.
• It contains spelling mistakes and grammatical errors.
If you receive what you suspect is a phishing email, PayPal asks that you report it to the company, "to help us combat online fraud".
"We investigate the emails and try to take action against the people responsible," said a spokesperson. Forward it to spoof@paypal.co.uk, without changing the subject line. You should then delete the email from your inbox.
