Archive for the ‘Electronic Payment’ Category



Fake PayPal phishing scam

Saturday, June 16th, 2007

It’s been that kind of week.

Following hot on the heels of the email spoofing incident, I received this fake email pretending to be from PayPal, with the subject line ‘Account Authentication Required’:

[PayPal logo was copied here]

Dear PayPal Customer,

Due to recent fraudulent activities on some of PayPal online
accounts we are launching a new security system to make
PayPal online accounts more secure and safe. Before we can
activate it we will be checking all PayPal online accounts to confirm
the authenticity of the holder.

We will require a confirmation that your account has not been
stolen or hacked. Your account has not been suspended or frozen.

To confirm your account status please Login

-complete the required information to authenticate and reset your account

-make sure your account balance has not been changed

-make sure your details have not been changed

-review recent transactions in your account history for any unauthorized
transfer

If you find any type of suspicious activities please contact us immediately.
Please include in your message your account number, your account name
and the unauthorized transfer date & time.

Please do not reply to this message. For any inquiries, contact Customer Service.

PayPal Copyright © 2007

Although the ‘reply-to’ field says PayPal, the email address given is ‘account2 @payprocorp.com’ (though as I’ve learned, reply-to addresses can be faked to look like anyone). Links in emails such as this (see the ‘Login’ link) will often lead to a fake website designed to trick you into entering your account details. PayPal, like online banks and eBay, advise against ever trying to log into your account from an emailed link. Instead, they recommend always going directly to the website. Pay Pal themselves say:

Many phishing emails have links that look valid, but send you to fraudulent sites instead. Here’s what you should do: Open a new browser window, type https://www.paypal.com and log in to your PayPal account directly.

Try out PayPal’s ‘Can you spot Phishing?’ Challenge.


PayPal’s web page on security and protecting against identity theft, fraud and phishing is here
.

EBay also provide a very clear and helpful tutorial on recognising spoof emails and fake websites.

Slashdot: New Targeted E-mail Attack Hits Business Execs

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

Bad data validation: How many digits make a bank account number?

Sunday, April 15th, 2007

In which Amazon UK Associates have finally paid me - Hooray!

Back in November I applied to be an Amazon Associate, and was lucky enough to make about £20 from the Christmas shopping season.

Later in January I received an earnings report from them, and when I logged into my Amazon Associates account it said they had paid me 2 weeks earlier, but nothing had arrived in my bank account.

I emailed customer support and we went back and forth 3 times with them asking me to check my account again each time in case the payment had turned up. In the meantime, I had figured out what must have happened.

My bank account, which is at one of the biggest banks in the UK, has a seven digit number. Many e-commerce websites apparently assume an eight digit number. In some cases, eg TradeDoublerTradeDoubler, the company that owns the website obviously knows about this and either provides instructions or deals with the shorter account number in its own way, but in either case it works. In other cases, such as when signing up for PayPal UK, the data entry form includes data validation that does not allow a ‘non-standard’ account number to get through. The first time this happened, I emailed my bank’s technical support and got a helpful reply telling me to add an extra zero at the beginning of the number, and this has also worked. But the Amazon Associates UK application form just took my number without saying anything, and then 3 months later when it was time to pay me it didn’t work.

So I suggested to customer services that this could have been what happened, and I re-entered my bank account number with an extra zero at the start, and my query was eventually passed to the finance department.

A few weeks later I logged into my Amazon Associates account again and saw they had posted messages telling people about problems with bank account numbers, and that they should update their details if there had been payment problems they would email if a repeat attempt at payment didn’t go through. But I still hadn’t received my payment. So I updated my details again in case that would trigger off some new automated process that they had set up to deal with this sort of thing, and the message went away.

And then it took ages for my bank statement to arrive. Nothing had changed in my Amazon payment record, but when I eventually got my statement I found the payment had gone through on 4th April.

I was massively relieved, because I’ve heard of other big companies that just have a policy of not paying people.

I don’t know what was going on behind the scenes at Amazon UK - their application form obviously had a serious data validation error, and I never heard anything from their finance department, but to be fair their initial customer services people were polite and helpful, they kept their associates informed as a group, and they did get there in the end with the payment. I’d say my faith has been restored - perhaps I’ll go for the aStore after all!

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

I open a ‘Turnkey’ Affiliate Shop

Tuesday, April 3rd, 2007

In which I operate a Web Design Template Store

After my experiments with hosting affiliate banners and text ads, I decided to try out another affiliate money making technique: the ‘turnkey’ online shop. I considered an Amazon ‘aStore’ for books on website planning, setup and marketing, but with my Amazon (non) payment issues still dragging on (see post number 3 from February 19th!), I thought I’d leave that one for a while and try a different company instead.

I went back to an earlier problem of customising a set of free templates from my web hosting service, while wondering what else might be a useful product I could sell.

The templates are an economy option I’m offering for web design packages, in the theory that saving time on design will cut down costs and get the websites finished more quickly. I was building template sites with the free templates and site builder program, and finding they weren’t the most polished looking and it took a long time to make the code validate.

On a Google-break from the free templates, I found some much nicer ones on sale from Template Monster, who also had an affiliate programme. I could have recommended their website with text ads and banners or sold the templates separately, but their affiliate programme could also set up a turnkey shop selling the same templates for the same prices from my own website. I liked the sound of the turnkey option and thought it might be worth a try - and also something new to test out for my blog and include as an e-commerce customisation service.

All I had to do was register with them, giving my email and website details, and validating them by following a link from an email they sent me. As a non-US affiliate, the most convenient payment option was via Moneybookers electronic payment, so I checked out their service and signed up with them too.

Back on the Template Monster website, I went for the ‘Ready made affiliate shops’ option and chose the template that looked closest to the general colour scheme of my website. I entered the name of the shop, previewed it, pressed the button for their code to generate it and downloaded it in a zip file.

Here’s what it looks like:

Web Design Template shop screenshot
Screenshot of my web design template shop

Then I had to decide what to do with it!

The first decision I made was to host it as part of my web hosting site (as yet very unfinished) rather than my web design site, as it would be more complementary and less in conflict with the custom web design side of the business.

The next decision was which parts of the default content I wanted to keep. Some of the template types require software that I don’t own, and so I wouldn’t be able to work on them if people bought them and came back for customisation. But as I thought people might be more likely to choose a template and move on, I decided to offer the full range, and specify which types would be workable when referring customers for economy web design packages. Plus, I’m not usually a fan of Flash, but some of the templates were really nice. I wondered what the code in the templates would be like, but decided in any case it would be easier to spend time fixing up non-standard code than getting the graphic design issues right.

However, I did want to remove some of the more obvious affiliate links, as well as links to other affiliated web designers that weren’t paying commission - after all it’s no good giving free advertising to your outright competition! So I edited the files to remove those links, and added links to my design and hosting websites instead, to link it up with the rest of my website’s content. Removing some of the affiliate material has also left a gap, which I will eventually aim to fill with something promoting my own economy website packages, extra e-commerce services and products.

Being wary of the whims of Google, I also realised a turnkey shop like this would be duplicated quite a few times around the web. In fact, I ran a quick Copyscape check on the home page and found 8 other template shops. A mass of identical affiliate content like that on an otherwise almost nonexistent website could easily trigger off a duplicate content penalty and leave me trailing on page 700 in the search engines’ results. So I created a file called robots.txt for my hosting site, which I designed to prevent search engines from indexing my turnkey store. The obvious downside is that visitors will not be finding this site’s content through search engines - they will only be coming in through advertising or from the rest of my site. So I’d have to promote this shop in other ways to make it sell anything, but at least the rest of my websites’ content would not be suffering.

The next thing I noticed was that the template prices were all in US dollars. I had a look around in the Template Monster affiliate area, but could not find a way to change the currency. So I integrated the foreign currency conversion tool from xe.com into the resources section of my web design site, with customised number entry and results pages. I added links to the currency converter from my web design packages and my template shop, and then added links to those from the currency converter. Seems like it all goes round in circles!

I noticed the code in the html files would not validate to web standards, so a standards compliance and accessibility overhaul will be the next areas of work lined up for this shop - it can’t be finished until it’s accessible at least, and there are definite problems with a lack of alternative text replacements for images and scripts.

In the meantime, I needed to get my web design packages online, and there were gaps that needed filling, so the template store went online at an early stage and has been experiencing gradual improvements. Amazingly, it had a visitor from my hosting site in its first day, but in the few days since then it’s remained fairly quiet. Overall, though, I’ve been pleased with how easy it was to get a turnkey store online - it still needs some work, and it hasn’t made any money yet, but it adds another service to my website, it didn’t take much work (so far!), and we’ll see how it does in time.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

Introducing your all in one payment solution…

Monday, April 2nd, 2007

Just got this email from PayPal, Introducing my all in one payment solution… Huh? What do PayPal think, that I want to keep paying and paying, in every way I can? Thanks so much, PayPal, for making this possible. *

* I may be taking this the wrong way

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]