PayPal Flaw allows for credit card and identity theft
 

I'm glad I boycotted them years ago.

http://news.netcraft.com/archives/20...ity_theft.html

I don't understand - this fraud pops up if you click on something on Paypal's website or is it by following a link from an email to Paypal's site?

If there is a button on their site that is causing this problem, that's one thing. If someone is stupid enough to follow a link from an email to what they think is Paypal's site, that's quite another.

I believe it is an email, but it links to the real paypal site, which these folks have altered.

No one should ever click on a link to Paypal, no matter the reason.

Seriously, that's like Net Security 101.

I often receive paypal plishing emails. Look at the link and it's always outside of ebay domain.

Sometimes when I get bored, I would just click on one of those links and it brings up what it seems like the paypal home page (and unsurprisingly no SSL).Then I proceed and entered F?CKYOU into those fields just for the hack of it.

I've used Paypal enough to detect when something isn't right. And like The Reaper said, never click on any links, in e-mails or on the site.

Got scammed with this yesterday - charges started coming this morning. Card's canceled and charges withdrawn. Sucks.

I was at work and just wasn't thinking when I filled in my info. Hotmail even flagged it, but I didn't notice that till after...

I've gotten one of these e-mails in my Hotmail. Funny thing is, I don't have that address associated with my PayPal account.

I receive at least 10-12 "phishing" emails a week, some for places where I have accounts but many more on email addresses NOT associated with the website in any way.

Can't say it often enough, apparently: <b>NEVER LINK TO A SECURE SITE VIA AN EMAIL.</b>

And for the OP (with apologies to the literati): the "flaw", my friend, lies not in the stars but in ourselves.

According to that article, "Information requested includes social security number, credit card number, expiration date, card verification number and ATM PIN." Why exactly would someone believe they need this information, especially the ATM PIN.

The difference between genius and stupidity is that genius has its limits.

- Albert Einstein

I've seen them where every link in the email is legitimate, sourced from paypal [or whatever bank it's phishing for], except the one that wants your account informaton.
They can link to a page that looks just like the Paypal [or Citi or USBank or Wamu] site, but is obviously a gateway somewhere more nefarious.
I've gotten phishing attempts in emails i don't use anymore, and to banks I've never heard of. It's the shotgun approach, and unfortunately, too many people are either not alert or not aware enough to be safe.

There are plenty of legit reasons to boycott paypal. This isn't even remotely close to one of them.

Because people are sheep and they want to be led.

I agree. I have my own reasons for boycotting them, and was merely saying that I'm glad I did.