At PayPal, fending off phishers--and Google 3/26/2007   Phishing attacks are commonplace. PayPal advises people not to click on suspicious-looking links, but given the scope of the problem, more needs to be done to protect people. PayPal Chief Technology Officer Scott Thompson talked to CNET News.com about new security measures in browsers and at Internet service providers' e-mail gateways that should help people differentiate legitimate PayPal e-mail from spam. He also discussed how eBay's PayPal business unit is going mainstream and global and how executives are not worried about competition from Google and its Checkout online payment service. Q: PayPal and eBay continue to be popular targets for phishers. What are you doing to protect customers, and how can this problem be solved? Thompson: Most other online relationships are with your bank or with a brokerage firm or very rarely do you start with your e-mail address as your account identifier. We start with an e-mail address because that is the quickest way online to identify somebody, and that is also the quickest way to allow people to send money to each other. But it's very easy if you are a phisher or fraudster to guess your e-mail address and to send you something that might look like it's from PayPal or eBay. By the way, if (spammers) were to send you something, they are likely to be successful because we have over a 133 million account holders today. PayPal sends out about 6 billion e-mails a year. Earlier this year, we took the effort to put a digital signature that authenticates PayPal as the sender of all these e-mails, so when it goes out to ISPs, we have digitally authenticated that e-mail as being us. With Internet Explorer 7 one of the really neat things that is going to happen is the digital signature that we provide to Microsoft in that browser will actually turn the top line of the URL green. If it is not signed by us, if somebody is trying to imitate us, it will turn red. We also are working with ISPs around the world today, starting with all the big ones. If a PayPal e-mail doesn't have our digital signature on it, (the system) prevents it from ever arriving in your in-box. This will change the game rather dramatically in the whole spoof-phishing area. When will we start seeing the benefits from that? Thompson: If you have IE 7 today, you will see the URL line turn green. The same thing is true with Firefox. The other thing that is coming is we are working with ISPs and browser providers to determine all the bad sites around the world where this activity is coming from. Can you tell me about the password-generating key fob? How is that rollout going? Thompson: The uptake on that has been surprising. You never know when you launch something like that what the average customer might do. We have exceeded our estimates of what the uptake was going to be. Almost immediately after receiving the fobs, more than 50 percent of all the people who received the security device activated it immediately. How many does that represent? Thompson: Well, I don't know that I can give you the number, but we are (offering) them today in Australia, Germany and the United States. But we are not aggressively advertising it yet to all of the people who visit our payment site. And my sense is, when we do aggressively advertise it and market it to that same customer base, we are going to have an even further uptake. So, would you say security is PayPal's biggest challenge, and if not, what is? Thompson: I think this company even long before I arrived was grounded in security and was absolutely grounded in privacy. The standard that we have for ourselves far exceeds anything I have ever seen in any organization I have been in. Here's a good example. Every piece of customer information that we store on your behalf for any of the 133 million customers is completely and fully encrypted inside of our network and in all the computers we have here at PayPal. That is an investment that I would argue I have never heard of a bank making, never heard of a payment system company making it. People don't do that because it is extremely expensive. So, I think in the DNA of PayPal there has always been this extremely high consciousness for security and for privacy, and that continues even today, seven years after the company was founded. That is one of those great strategic advantages that we have over all the other competition that plays in the payment space. Back | Top