Thread: GMail: Fighting phishing with eBay and Paypal

Phishing messages are a form of spam that attempt to deceive recipients to gain access to their personal information. A classic one is a message that appears to come from PayPal and attempts to get someone's PayPal password in order to drain his or her account. These fraudulent messages often look very official and can fool people into responding with personal information.

Gmail does its best to put a red warning label on phishing messages, but it can be hard for us to know sometimes and we can't be 100% perfect. So, for the fraction of a time when Gmail misses it, you may end up squinting three times and turning the message sideways before suspecting that it's phishing. Wouldn't it be better if you never saw phishing messages at all, not even in your spam folder? Since 2004, we've been supporting email authentication standards including DomainKeys and DomainKeys Identified Mail (DKIM) to verify senders and help identify forged messages. This is a key tool we use to keep spam out of Gmail inboxes. But these systems can only be effective when high volume senders consistently use them to sign their mail -- if they're sending some mail without signatures, it's harder to tell whether it's phishing or not. Well, I'm happy to announce today that by working with eBay and PayPal, we're one step closer to stopping all phishing messages in their tracks.

Now any email that claims to come from "paypal.com" or "ebay.com" (and their international versions) is authenticated by Gmail and -- here comes the important part -- rejected if it fails to verify as actually coming from PayPal or eBay. That's right: you won't even see the phishing message in your spam folder. Gmail just won't accept it at all. Conversely, if you get an message in Gmail where the "From" says "@paypal.com" or "@ebay.com," then you'll know it actually came from PayPal or eBay. It's email the way it should be.

eBay and PayPal have worked hard to ensure that all their email is signed with DomainKeys and DKIM. Armed with this information, Gmail can easily reject as a fake anything that doesn't authenticate. We've been testing this for a few weeks now and it's working so well that few people really noticed.

We think it's great that PayPal and eBay have taken on the challenge of securing email, and we're pleased to have put our best efforts together to make this work. It's a bold move, but one that will really help fight phishing. Our hope is that this will set a good example for other organizations to follow (yes, it can be done!) and that over time more and more email will become trustworthy.

I get those Paypal emails all the time.
You can actually detect if an email is fraud before you respond to it. Just move your mouse on the link they are asking you click; don't click on it; and on the status bar you would see the link url. The last part of the link url would not be paypal of course, would be some other site. But the first part is almost always paypal type.

Exactly the reason I now forward all my company email to my gmail account. Plus I don't have to check 20 some emails.

I get fake emails as well but Firefox detects it and warns me when I click on it.

Originally Posted by himoacs

I get fake emails as well but Firefox detects it and warns me when I click on it.

Yea I love firefox.

I can remember the first time I got a fake Paypal email years ago. It was right after signing up and they said my account was banned. LOL the thing looked so real I almost fell for it. I decided to contact Paypal support instead and they told me to send them the email. Think of all the people who do fall for them still and lose thousands of dollars in the process.

Originally Posted by Hostnetric

Yea I love firefox.

I can remember the first time I got a fake Paypal email years ago. It was right after signing up and they said my account was banned. LOL the thing looked so real I almost fell for it. I decided to contact Paypal support instead and they told me to send them the email. Think of all the people who do fall for them still and lose thousands of dollars in the process.

If even 1 in 10000 people fall for this; still it would be a profitable thing for spammers.

Originally Posted by Hostnetric

Yea I love firefox.

I can remember the first time I got a fake Paypal email years ago. It was right after signing up and they said my account was banned. LOL the thing looked so real I almost fell for it. I decided to contact Paypal support instead and they told me to send them the email. Think of all the people who do fall for them still and lose thousands of dollars in the process.

i once got such an email and I was about to sign in but then firefox warned me so I didn't. Then soon I found out from others that there was a spam paypal email going on and that they had lost their account completely!!