PayPal – Notification of Limited Account Access

Another variation of PayPal Phishing fraud is making the rounds.

While it claims to come from “report@paypal.com” these messages actually originate from already infected personal computers throughout the world.

The email begins:

From: “PayPal”
Subject: Notification of Limited Account Access RXI034

Note that the subject line ends with a random string of letters and numbers in an attempt to make each email appear different in the hopes that spam filters won’t see the messages as being identical.

Dear Member,

As part of our efforts to provide a safe and secure environment for the online community, we regularly screen account activity.

Our review of your account has identified an issue regarding its safe use. We have placed a restriction on your account as a precaution.

To lift the restriction we will require some further information from you.

If, once we review your further information and we’re confident that the use of your account does not present a safety risk to our service and customers, we’ll be happy to reinstate your account.

We have sent you an attachment which contains all the necessary steps in order to restore your account access. Download and open it in your browser.

After we have gathered the necessary information, you will regain full access to your account.

We thank you for your prompt attention to this matter.

Very sincerely,

PayPal Review Department

Despite being cordial and fairly well written (many Phishing/Virus emails tend to be quite sloppy) the attachments are viruses:

* agreement.exe
* agreement.zip

If such an email should be received it can simply be deleted. Only by executing either of these attachments will the user’s computer become infected.