undefined | Better HN

0 pointsjosefresco1y ago0 comments

> I would perhaps have expected that email to include some kind of "message from seller: / company: " type subject to at least identify it as such.

This is the real/root issue. I've seen a few of these and the email itself contains no identifying information which increases the phishing risk/suspicion substantially. Both PayPal, and some banks still send emails with buttons like "confirm your account" - it's wild.

0 comments

1 comments · 1 top-level

throwaway773851y ago

And in fact, it should come from some kind of subdomain like "user-service@random-users-can-send-whatever-they-want-from-this-address.paypal.com" and then the header should be "THIS ISN'T AN OFFICIAL PAYPAL EMAIL" etc. etc.

I wouldn't fall for this scam, because I'm technically minded, but a less technical relative wouldn't stand a chance here.

j / k navigate · click thread line to collapse