An e-mail message purporting to be from PayPal warns the recipient that their PayPal account has automatically sent money to any unfamiliar person. But if the person clicks on "Cancel Transaction," that's when the real problems begin. (Click on the image above to see the complete "phishing" e-mail.)
[ Photo: J. Fox ]

I've been getting e-mail phishing scams for several years and thought I'd seen it all. But this week I received an e-mail that wasn't the usual "We're doing a security check and need your password" scam.

The e-mail appears to come from PayPal, a popular institution often imitated by scammers. What's unusual is that it seems to be a confirmation of a purchase, for more than $400, paid from my PayPal account. There's even a realistic-looking transaction, including the name and address of the person whom you're supposed to assume made the purchase.

I picked this up as a scam fairly quickly because I've trained myself to recognize such cons. But I suspect that a consumer fearful that their PayPal account had been incorrectly charged would hastily follow the scam's instructions to click on the “CANCEL TRANSACTION” link to sign into their account.

If that link were still active (it wasn't when I tried it), doing that would give the criminals the information they need to immediately access the account and drain its funds. (Based on our most recent State of the Net Survey, we estimate that, over the past two years, about 7 million American consumers gave such phishers personal information and that, nationally, phishers stole nearly half a billion dollars from online consumers.)

Here's how to avoid becoming a cybervictim: