A PayPal text message phishing campaign is underway to try to steal your account credentials and other sensitive information that can be used for identity theft.
When PayPal detects suspicious or fraudulent activity on an account, the status of the account is set to “limited”, which imposes temporary restrictions on withdrawing, sending or receiving money.
A new SMS text phishing campaign pretends to be from PayPal, stating that your account has been permanently limited, unless you verify your account by clicking on a link.
“PayPal: We permanently limit your account, click the link below to verify,” says the smishing text message.
Clicking the attached link will take you to a phishing page that prompts you to log in to your account, as shown below.
If you log in to the phishing page, the entered PayPal credentials will be sent to the threat agents. The phishing page goes a step further as it will try to collect more details about you, including your name, date of birth, address, bank details and more.
The information collected is used to conduct identity theft attacks, gain access to your other accounts, or conduct targeted spear-phishing attacks.
Yesterday, two other people I know received these phishing texts, so it’s a very active campaign and everyone needs to be aware of these messages.
Smishing scams are becoming increasingly popular, so it is always important to treat any text message containing links as suspicious. As with all phishing emails, never click on suspicious links, but go to the main website domain to confirm that there is a problem with your account.
What should you do if you enter information on this link?
If you received this text and logged into your PayPal account by mistake or provided other information, you should immediately go to Paypal.com and change your password.
If you use the same password on other sites, change them there as well.
Finally, you should look for other targeted phishing campaigns using the data sent. BleepingComputer also suggests that you monitor your credit report to ensure that fraudulent accounts are not created in your name.
To avoid identity theft, you can also temporarily freeze your credit report to prevent banks and other companies from issuing credit on your behalf.