PayPaI

This article is about a phishing scam. For the legitimate payment system, see PayPal.

Paypai (capitalised as PayPaI) is a phishing scam, which targets account holders of the widely used Internet payment service PayPal using the fact that a capital "i" may be difficult to distinguish from a lower-case "L" in some computer fonts, a so-called homograph attack. It sends PayPal account holders a notification email saying "PayPal temporarily suspended your account".

It was active before in mid 2000. PayPal then sent account holders a notification email when they received payments. Spam was sent out mimicking these payment notifications and indicating that the account holder had received a large payment and directed recipients to paypai.com through a link in the message.

The site, paypai.com was an exact replica of the HTML source code and images that PayPal uses on its home page. While devious, this was not particularly difficult, since the HTML and images are downloaded for display when one visits a website. The site was registered with Network Solutions to a Birykov in South Ural, Russia. The site was quickly shut down.

At the time, MS Sans Serif, a font similar to Arial that rendered capital I and lowercase l almost identically, was the default font in the address bar on most Windows applications. When Windows XP was released in 2001, Tahoma became the default; Tahoma places serifs on the capital I to easily distinguish it from lowercase l.

PayPal's Response

PayPal has guaranteed that no PayPal user will lose money as a result of this incident.^{[citation needed]} Paypal has not reported that any customers had become victims of the scam.^{[citation needed]}

See also

• IDN homograph attack
• ZDNet UK - PayPal alert! Beware the 'PaypaI' scam