Say goodbye to eBay and PayPal fraudsters

Posted October 4th, 2007 at 7:51 am by Nicki Dugan, Blog Editor

 40 Comments / Filed in: Trends & News

You’ve no doubt received an email or two (or thirty) telling you that your PayPal account has been compromised. Or that someone has a question about an item you’re not selling on eBay. And maybe you even fell for it (hey, it looked official enough) and unwittingly gave up your precious password to digital thugs who swiped it and ran amok with your identity.

Thugs, beware! As of today, it’ll be much harder for these malcontents to scam unsuspecting Yahoo! Mail account owners. We’ve teamed up with eBay and PayPal to become the first Web mail service to block the delivery of unauthenticated eBay and PayPal emails, reducing your risks of receiving phishing scams or fraudulent emails. Our weapon is a technology Yahoo! spearheaded called DomainKeys, which uses cryptography to verify the domain of the sender. In overly simplified terms, if the email’s originating domain ain’t really eBay.com or PayPal.com, it ain’t going through. More detailed and accurate description here. The technology will be rolled out globally over the next several weeks to all Yahoo! Mail users.

DomainKeys is seeing terrific industry adoption, in part due to the widespread consensus about the promise of proposed internet standard DomainKeys Identified Mail. About 40% of the email we deliver on Yahoo! Mail is signed with DomainKeys. And we hope today’s news gets the attention of information security officers at some of the more obvious phishing targets so we can help protect even more consumers from the havoc these scams wreak. We’re already actively working with many financial institutions, for example, and hope to continue the momentum.

We’re doing our best to make your inbox safe from bad guys. We want to make sure they don’t get the best of you.

Nicki Dugan
Blog Editor

Post a Comment Bookmark This Digg This

40 Comments Add your own

nick | October 4th, 2007 at 8:53 am

There is a reason I’ve never left Yahoo’s Mail service (I’m a Plus subscriber) especially with all those other free providers out there… and here you give another reason for saying “THANKS!”

Matt Cox | October 4th, 2007 at 12:02 pm

Ace! I user Phishtank anyway and am pretty scam-savvy. But yeah, good news for the general user.

Dinger | October 4th, 2007 at 1:52 pm

I am a Plus subscriber as well and I am thrilled to see this. My sister was cleaned out by one of those phishing mails and I am glad to see this coming about. A BIG THANK YOU!

Dusty | October 4th, 2007 at 4:09 pm

I was really getting tired of the emails that didn’t come from ebay and paypal. I was sending them to ebay for any verification. Its good that yahoo came up with this, finally a little protection means a lot

JustaPerson | October 4th, 2007 at 8:49 pm

Simply fabulous. Now I would all the others to follow. It’s too easy for the casual user to be fooled by these criminals.

A big thumbs up to Yahoo.

Tere | October 5th, 2007 at 3:29 am

I have to agree with the other comments. Now, I just want to know: when can I pick up all the free HDTVs I’ve won, all the laptops I’ve won, and how many bank accounts do I have, anyway, that keep getting suspended? (Hint: NONE). The eBay and PayPal scams were the worst, and I hope you can come up with a way to get rid of the rest of them, too. One day, I had won ONE HUNDRED EIGHTY laptops. !!!

Thanks, Yahoo!

Glenno | October 5th, 2007 at 8:46 am

If you Yahoo, Ebay and Paypal (and others) would use Commtouch RPD – Zero Hour Protection they would not have this problem!

Dake | October 5th, 2007 at 11:22 am

If anyone actually believes that Yahoo Inc. is fighting phishes or spam, they need to take a powder.

Matt Cox | October 5th, 2007 at 11:42 am

Actually, I just mentioned Phishtank (http://www.phishtank.com) in a post above. Why doesn’t Yahoo! actually do something *really* good and respectable in working with a company such as Phishtank to have each external-linking url received in your Inbox emails run through Phishtank’s Fraud Protection check before redirecting you.

With Phishtank’s loyal and committed user-base submitting fraudulent urls to the database by the minute, it’ll ensure a lot more security for Yahoo! Mail users.

I’ve noticed most Yahoo! links run through some weird tracking url first – especially from search results. Can in-body links in email not display as:

http://phishtank.yahoo.com/fraudcheck?url=http://www.royalbankofscotland.givemeyourbankdetails.com

Which then, on clicking, performs the fraud check and takes you through to your website instantly if no problems were found. If the url were believed to be fraudulent, it could show a Yahoo! branded screen.

“We believe this page may be fraudulent. Continue at your own risk:

http://www.royalbankofscotland.givemeyourbankdetails.com (active link)”

Surely spending some Yahoo! cash on something like this would be far better for the internet than making another social network (Mash doesn’t seem to cut it just yet, and will be just full of idiots, like 360 is).

Jo G | October 5th, 2007 at 11:48 pm

Thank you – thank you – THANK YOU! I love Yahoo even more now!

Ramone O. Bey | October 6th, 2007 at 2:52 am

I have yet to Fall for such unnecessary Phishing E-mails…Besides Paypal & Ebay….There are the Phishing Female Porn Cam Sites as well….They are Popping up everywhere…Just delete them or hit the Word Spam….. :-)

panfisher2708 | October 6th, 2007 at 6:30 am

Guess I will have to rent a wharehouse for all the free stuff I’ve been promised I won from all these folks whoe have no valit email response address. Keep up the good work Yahoo Plus

Sandy | October 6th, 2007 at 9:42 am

Bravo! Another perk to subscribing to the Yahoo Mail Plus :-)
Keep up the great work to keep us subscribers safe and happy. ~Sandy~

Jane Button | October 6th, 2007 at 3:14 pm

Great news!! What about getting IRS to join with you? The phishing claiming to be from them is getting more common. Wouldn’t you like a refund?

Becky | October 6th, 2007 at 7:17 pm

Thanks!!! I am a plus user. I thank you!!!! for all your hard work.

Michael Kraft | October 6th, 2007 at 7:38 pm

I think more than DomainKeys will be required. About 20% of the spam that comes into my Inbox has a certified DomainKey (usually from Yahoo.com itself!).

Dennis | October 6th, 2007 at 9:52 pm

Matt Cox, you wouldn’t happen to work for Phishtank by any chance, would you.
Nice sales pitch.
I am happy with what Yahoo! mail is taking the initiative to do on their own.
Cheers to Yahoo!, job well done.

Hollywood | October 6th, 2007 at 10:01 pm

It is easy to see how people fall for these pranks – the emails and the tactics have gotten much more sophisticated over the years.

Hopefully this strategy can be expanded to cover emails pretending to originate from banks contacting account holders.

Art Franciz D. Bernales | October 7th, 2007 at 12:33 am

This development is welcome indeed. However, I still get emails with the subject “Your Ebay success kit has arrived”.

Ollie Bourque | October 7th, 2007 at 2:10 am

I’ve always liked Yahoo’s mail service, especially the filters. I’ve got my SPAM under control. Now, inovatively, Yahoo is working on a Phishing control? Way to go, YAHOO!!!

Mike P in San Fran | October 7th, 2007 at 9:09 am

Finally, some DKIM and email-authentication in general have grown some teeth! This is a great start to getting rid of spam email.

Now that the technology exists to more reliably determine the source (or determine whether the purported domain is actually the sending domain) of an email, we can start to better assign accountability for email practices.

I love it. My Inbox will love it even more.

-Mike

Terri | October 7th, 2007 at 9:18 am

THUGS BEWARE!!!!THIS IS WONDERFUL NEWS!!

WACIPIMAN | October 7th, 2007 at 6:33 pm

I WAS JUST ON eBAY, AS I WAS GETTING OUT OF IT, IT MENTION SOMETHING ABOUT THIS DOMAINKEY TELL ME MORE

Rahayu | October 7th, 2007 at 7:51 pm

Say goodbye to eBay and PayPal fraudsters?????

Of it stopped!!! I’m the one that stop it. Because I am the owner that a victim ID THEFT. I have to stop them to still my business!!!

Stanley Hallwood | October 7th, 2007 at 9:03 pm

Glad to know something is being done at last,the really serious fraud attempts,especially those from So called Bank Directors or Solicitors from African Banks/Businesses I forward to Fraud Alert at the Met.Fraud squad.

Lynda | October 8th, 2007 at 11:11 am

Another Reason why I have been a loyal Yahoo User Since 19(ahem)something :)

Jeff Newman | October 10th, 2007 at 10:03 am

This is great news. I know a lot of people that don’t even know what phishing is. It is great that Yahoo is taking a stance to protect people from getting their identity stolen.

Robert Palmer | October 10th, 2007 at 4:04 pm

Hey, this is Great News! I get tons of emails that appear to be from Paypal, Ebay, etc. I always wonder how many people have fallen for this type of scam. As a website designer I’m used to looking at source codes, but most people don’t even know it exists. Keep up the good work!

Dixie | October 10th, 2007 at 9:11 pm

Thanks Yahoo!! I knew someone would eventually come through.

Most of this fraud stuff comes from people on eBay. Almost every time I get on there and buy something, I get some kind of suspicious email asking me to do something I know not to do. I always forward it to ebay, but all I get back is a canned email that has nothing to do with the complaint. I know they are a large company, and it is hard to police everyone. If they are going to send out a “canned” email, it should at least say that they are doing something about it. I always get the feeling that it is just brushed aside.

Thanks again Yahoo. It’s nice to know that someone is really in our corner. You have my business too !!

Kathie | October 11th, 2007 at 9:52 am

I use Iconix for PayPal & eBay emails, it’s in beta with PayPal, I love it. You can use Yahoo search and type in “paypal iconix” it’s the second result titled “Iconix® Truemark Email Identification (beta) – PayPal”

I posted this on the The PayPal Blog as well……..

For many Yahoo members, when they received an email that is from a bad guy, the member puts the email address service@paypal.com in their Blocked Addresses section, not fully understanding that the email address they are blocking is not where the email really came from. Now these members are blocking the legitimate PayPal emails & become frustrated when they do not receive PayPal emails.

Is there anything Yahoo can do to alert these members of the change they made in your announcement & to Unblock this email address so they receive legitimate emails too?

Thanks for doing this Yahoo!!! I hope the other ISP’s follow and do this as well. :)

Kath

jiri | October 14th, 2007 at 8:39 am

Kath,

Not sure if I get your comment… What you are asking for is actually what they did. Going forward any emails coming from …@paypal.com are going to be only and only PayPal real emails. That’s what DomainKeys does – it does not deliver any email which looks like …@paypal.com if it does not come from paypal smtp server.

Sally, design guru | October 21st, 2007 at 10:34 am

Nice mouse on the picture. I like her red shoes. :)
I’m joking.
Concerning PayPal – I receive its spam letters on my yahoo mail box actually every day.

I. M. Youyng | October 22nd, 2007 at 4:42 am

Way to go Yahoo!!

charles | October 25th, 2007 at 12:54 pm

Please tell me more. How do you set it up. As of today 11/25 I’m still getting over 50 of these emails per day.

EdSF | December 4th, 2007 at 8:54 am

Seems ok on the surface. Whats not immediately apparent is that you may not be getting all your email and you’ll never even know.

That’s the big problem. I’m in IT and it’s not just about blocking email, it’s about blocking the RIGHT email, and letting the RIGHT email through.

Domain keys is good, but blocking without any recourse is like your postal service not delivering postal mail to you and not even letting you know. How’d you feel about that? I’m sure that’s even some type of invitation for some lawyer out there to exploit with a lawsuit.

Why isn’t there a way to “vet” (aka test) things. You know, if your domain somehow doesn’t pass? And more importantly some recourse? Want some inspiration for how this can be done? Just take a cue from Spamhaus.

If a Y! person is reading this, yes, it’s my personal email domain that has an issue (the one I provided in this form). Before someone says, “oh, it’s just your personal email” – yeah, but when theres one, theres always more. And although my domain isn’t as “classy” as those with DK, it does at least have SPF.

Rick Erazo | December 12th, 2007 at 1:22 pm

Interesting…as a Y! subscriber, I continue to receive “eBay Success Kit” spam on a daily basis (sometimes several per day).

Michael Doman | December 22nd, 2007 at 6:17 am

Hello.
I am pretty new to e.bay and yahoo etc. and, the ammount of spam I recieve, especially from Canadian Phanmacies and some herbal penus enlargement company.Means I very rarely look at the spam a/c now [I have 1400] in there in 12 days[ thats when i last cleaned it out. I need all my storage just for rubbish.
How can I clean it up .
By the way. It all comes from yahoo, there is not one peice of spam on the Googlea/c

Lomini Mathias | January 2nd, 2008 at 5:13 am

Hello,
It gives me to breath in fresh air after being assured of security against fraudulents practiced by some of the computer wizards.But what surprises me most is how the yahoo mail let these guys use the website.There are also cases in the bulk box where people send nonsence,I hope you will also guard against that. As I have given a comment earlier on, afriend of mine was email that he worn a huge amount of money $1,000,000 dollars and this guy called Garry Wool claimed tobe yahoo winning prize Boss for last year christmas a ward to find out who uses email more frequently.I just wanted to find from Andrew and Nicki Dugan whether you guys have such allocation and the above fellow as the Director?

peyman | February 3rd, 2008 at 12:57 pm

lol

selorm | October 3rd, 2008 at 12:41 pm

I love the pic