Paypal F&F

[ActingLikeAKid]

Can sellers please stop requesting or expecting buyers to use Paypal "friends and family" for Yard Sale purchases?

The main reason that many people use PayPal is that there's some buyer protection: If I buy something and the seller doesn't send it or it isn't as described, I have a safety net. Obviously, my first recourse would be to contact the seller. But if I weren't able to resolve it with the seller, I can contact PayPal and have them help sort things out. I'm sure most of the people on TRF are fine people, but that doesn't stop me from wanting a little protection when I send money to a stranger on the Internet. If you use Friends and Family, that protection is gone. You can't dispute a "friends and family" purchase. If you say "I bought this thing using F&F and it wasn't as described", Paypal will say "okay, well, now not only do you not have that thing you bought, you also don't have a PayPal account."

If you don't want Paypal to take their cut, sell it in-person at a launch or move the cost to the buyer. As a buyer, I'm OK with eating the cost of that protection - so if you say "Brand New Widget in box - $50" and then in the description, say "$50 delivered to the _____ launch or $50 plus buyer pays PayPal fees & actual shipping costs" (or just "$65 shipped") ... sure, that's fine too. But please, let's stop encouraging people to abuse Paypal Friends and Family.

 

[MikeyDSlagle]

I leave it up to the buyer. The price will be more, not only because of the fee but in my experience if you don't ship with a tracking number, your money gets held up for a few weeks before you can claim it. With a tracking number, once delivery is confirmed your money is available.

But what happens when an unworthy buyer disputes the product only to get their money back minus a small fee? Don't know how that works or if that is even possible, just thinking out loud.

 

[patelldp]

I also leave it up to the buyer in most cases. No fees all-around is the best circumstance and I know that I am a reputable seller, as do many other people. If the buyer is uncomfortable with that and it's worth 3% for the peace of mind, no problem there.

 

[ActingLikeAKid]

I leave it up to the buyer. The price will be more, not only because of the fee but in my experience if you don't ship with a tracking number, your money gets held up for a few weeks before you can claim it. With a tracking number, once delivery is confirmed your money is available.

But what happens when an unworthy buyer disputes the product only to get their money back minus a small fee? Don't know how that works or if that is even possible, just thinking out loud.

A reasonable question ... and I don't know. But still, using F&F for a purchase is a violation of PP's TOS -- I'd rather not lose my PayPal account over a couple of bucks in fees.

 

[Bat-mite]

If it is a sale between friends and not a registered vendor, I don't think it violates policy.

 

[blackjack2564]

Using F-F to pay is NOT a violation of PP policy....it's listed under Q& A.
When I first began using PP I looked it up. From PP site...............

" Remember, you always have the choice to select any payment method in your account by clicking the “Change” link on the Send Money page. We will always show you IF there is a fee and how much the fee is before you send money."

And I did an online chat to verify....there is NO problem and you will NOT lose your account!
So if you want buyer protection "Change" your payment method and add the fee to the price, everyone gets what they want!

You can also look up many sellers rating at the top "sticky" in yard sale for veteran sellers. I sell either way, leave the option to buyer to choose pay method.

Most yard sale users have proven track record for honesty, my guess around 90%. When a new seller appears, forum users usually put them through the mill to prove who they are. There have been a few incidents that went south, but problem there was, folks kept accepting excuses till the time limit expired. Nothing can help you there.

My standard procedure is always send a PM with trk# and day of ship. Trk#'s are a must for finding problems quickly and solving them.
Just last week I had a package showing out for delivery 3 days in a row. I did not wait, notified shipper immediately & problem solved.
I am always willing to wait a reasonable amount of time, but all shippers need to be appraised of wonky situations. I have hundreds of transaction under my belt.

Edit: I would like to see some verification of the "you will lose your account statement". You should not post things like that unless you can. As I mentioned, I was told personally by an agent otherwise, and pasted their policy above.
Things can & do change...I just want to see it.

You are correct about using F-F for paying a "commercial" account. But mine and I would think most here, use "personal accounts" which are exempt from that.

 

[Bat-mite]

Thanks, CJ.

 

[ActingLikeAKid]

OK then, I was wrong. Now if you'll excuse me, I need to find some ketchup for this crow.

 

[dhbarr]

How dare you help us all learn something! SHAME ON THE CURIOUS ONE!

 

[mpitfield]

I would caution anyone who uses PayPal.

I have been a validated buyer (not a merchant selling account) since 2003, with the following current validated payment methods. 1 personal bank account, 1 business bank account and 1 business Visa, as well as having roughly a dozen previous validated payment methods over the years. I also have a validated cell phone as well as several validated personal and business emails. I have used the service almost exclusively to send money and in < a dozen transactions over the 14 years receive monies < $100.00US per transaction. My average buy transactions have been < $150.00USD, with an average of a few dozen transactions per year @ on average $2,500USD. I have also never had a year that exceeded $6,000USD in transactions. In my 14 years using PayPal I have never had a single complaint on a transaction, nor have I ever violated any past or present PayPal policies. I have also confirmed with all of my payment methods that they have never disputed, questioned, delayed, or refused any of my transactions.

And with all of that being what I would consider a perfect track record. This past May I logged into my PayPal account to send $3.5US to a TRF member and when I tried to process the transaction, PayPal "limited" my account. When I looked into what that meant, essentially means I cannot make any transactions, or even modify and or remove my banking and credit card information until I meet specific demands.

Their demands can vary but in my case they want me to send them "Photo ID" (Drivers License, Passport or Military ID) as well as proof of address (Drivers License or Utility Bill). I asked them why the additional "verification" process on top of what I had, as well as who was asking for it and their answer was the "compliance department".

When I called them to inquire as to why this was the case, extracting any information from them was like pulling teeth. To say that I was given the runaround would be putting it very mildly. I spoke with about a half dozen people, all of which, except one, were cryptic with their answers and none of them provided anything that I was able to confirm. Essentially I was told that it was "the law". My reaction was okay well I don't want to disobey the law so please let me know what law and what threshold I surpassed in that law that now necessitates this additional requirement. This was meet with just "it is the law!"

When I tried to escalate the conversation in an effort to speak with anyone who could provide me an informed answer, I was met with "there is no escalation process, you have to do this". The one exception, a representative who was in Ireland, agreed that in my case this appeared peculiar and promised to look into it. However this eventually resulted in a form email arriving with no additional information.

Why don't I just provide this, well being an IT consultant who deals a lot with cyber security and hardening systems, I simply don't trust their ability to safe-guard my information. Add to this that I follow a mitigated security philosophy, for practical and professional reasons, and really don't need to use their service. It is simply a risk vs. reward decision where I reasoned that it does not make sense for me to increase my online presence for personal identity theft if I don't need to. During my conversations with PayPal I asked them to run me through what they would do with my information and their answers varied from silence to it would be available on their systems whenever I called in. However, unanimously, when I commented that I don't trust PayPal to safe-guard my information, this was met with compete disbelief and "our systems are 100% secure and have never been compromised".

The fact that their employees have been indoctrinated into this belief does not surprise me and it simply reinforces my distrust. One thing the cyber security community agrees on is that there is no such thing as thing as 100% safe. Personally, anyone who claims this is either grossly incompetent or they are naive and swallowed the blue pill. The fact is maintaining a high degree of security is a mix of technology choices, how those technologies are configured, as well as policies and procedures, and at the end of the day your security is only as good as the weakest link.

To validate my point here are some links from third parties:
https://thehackernews.com/2017/12/paypal-tio-data-breach.html
https://bgr.com/2016/01/04/paypal-account-security-hackers/
https://www.reuters.com/article/us-usa-cyber-idUSKCN12L1ME

Here are some links from PayPal's own user forum:
https://www.paypal-community.com/t5...from-a-PayPal-account-through-mass/td-p/82681
https://www.paypal-community.com/t5...KED-ADDED-FUNDS-FROM-OTHER-USERS/td-p/1028263
https://www.paypal-community.com/t5...ccount-PayPal-is-refusing-to-help/td-p/707013
https://www.paypal-community.com/t5...Transfer-To-PayPal-Account-Hacked/td-p/243536

Of course local security, poor practices and other end user issues are likely the majority of the causes of the user forum issues, however not all of them. The point I am trying to make is that PayPal are not infallible and cyber activity on this front is increasing and they are a big player and therefore it is reasonable to assume that they are a big target.

At the end of the day my account is still locked and in an effort to mitigate my exposure I wanted to remove my personal credit card and banking information. To do this I was forced to reissue new cards, as well as close my bank account and open a new one. Needless to say this was an inconvenience to me, but this is light in comparison to what others have endured. For anyone using the service and who believes that this cannot happen to you, just google paypal+limited+account and read the many hits. My recommendation for anyone using their service, especially anyone who is holding a balance, is don't, or if you have to make it a minimal balance. There have been many individuals and small businesses who have had their funds held ransom with the most extreme cases resulting in bankruptcy. Sadly due to their EULA there is no legal recourse to PayPal who, although I find this generally unethical, they are within their legal rights to do so. Having said that it would be nice to see a successful judgement against them.

Finally, while I understand the need for some regulations and that their is very likely something in FinCEN that is equivalent of what we have in Canada in our "FINTRAC", it is more the lack of transparency, unaccountably and that this has a very intrusive, arbitrary feel, that upsets me. Add in what I would characterize as innocuous, mundane and insignificant transactions, regardless if there is a algorithm (bot) or human behind this request, it does not say much about their judgement.

 

[jderimig]

U

You are correct about using F-F for paying a "commercial" account. But mine and I would think most here, use "personal accounts" which are exempt from that.

But CJ, if you are selling a product in exchange for cash you are engaging in commerce, even if it the transaction is with a "friend".

PP provides a service that makes it easier to pay and "lubricates" the transaction for the betterment of both parties. They deserve 'some' compensation for the service they are providing. My opinion.

 

[T-Rex]

Personally I consider everyone here to be "friends" so regardless of the fact the a trade is being made, I don't see a problem with sending payments F&F.
If/When I run into a situation like mpitfield shares above, my use of their service will come to an abrupt end. I still remember how to use a money order....

 

[Dugway]

Wow, money orders??? Just Google "money order scams", they are like anonymous personal checks. Last time I tried to sell a used car, I had two different people try to scam me with money orders.

 

[Peartree]

Essentially I was told that it was "the law".

I wonder if any of those representatives were trying to tell you that it was not "a" law, but it was "the law" as in "the fuzz, po-po, the man, etc." That something that you did/bought/sold clicked in some algorithm and got some government suit interested in you?

 

[dixontj93060]

Money orders are a bitch and expensive. If someone doesn't want to purchase from me doubting my integrity, then stay out of my Yard Sale posts. Not utilizing PayPal F/F would further extend the losses I incur on most sales. If you have no trust leave TRF please. Leave right now!

From the Ether...

 

[blackjack2564]

But CJ, if you are selling a product in exchange for cash you are engaging in commerce, even if it the transaction is with a "friend".

PP provides a service that makes it easier to pay and "lubricates" the transaction for the betterment of both parties. They deserve 'some' compensation for the service they are providing. My opinion.

I agree 100%. That said, if ones uses a registered business account with them. it comes with services far & wide above a simple personal account. Breaching that agreement is where a problem may happen.

When I send a PP invoice the fee always gets paid. I have sent a couple hundred.
I have also lent & borrowed money via PP,that could also be construed as a commercial exchange Aka "loan."
So yes, upon occasion, I have availed myself, & used an otherwise fee bases transaction for free. BUT as per PP rules. You are allowed and encouraged to do such, in individual accounts.

The more money they have tied up in the pipeline, the more they can "use" free.
However when a payer decides to take it upon themselves, to not use an invoice sent, but send payment via F-F, I am not one to argue. Nor have I ever requested such.

I have also used PP, to pay friends for lost or borrowed/damaged items such as motor casing. These are not considered commercial exchanges in my book. So overall they get 95% compensation from me, every now & then, I take advantage and nick'em....LOL
But then ....I am a Capitalist.

 

[blackjack2564]

You believe this..... moment ago after posting above.

Just got E-mail alert my E-bay account had been used "fraudulently" & now frozen. Along with that my PP-account if it been used "linked"payment to E-bay that would also be locked.

Last time E-bay did this to me,[7-8 years] some Russians were selling 3-5000.00 guitars with my account. After several days of "getting where are the guitars, I've paid you xxx thousand." I alerted E-bay what was going on. They told me in no uncertain circumstance that would be impossible with their security in place.
2-weeks later I want to use E-bay and it locked. Now of course the notice comes telling me to sign in and change me pass word.

Yeah...right. I'm locked out, but must sign in to fix it.
So now what to do...a bit of skull-dugery. I went across the street to apartment blding. Find the 24 mail box pole....of course there are piles of junk mail laying on the ground, so I open a new E-bay account to fix my old one, with the address from junk mail.

When I get signed in and fix.... I do the chat thing. I explain how I had to open a fictitious account with phony name & address, blah bla blah. Now I am told "once & again" that's impossible to do with their security in place. So I traded "my how to" for "who did that to me"
So if ya want to believe them....Russians get the blame.

I REALLY hope I don't have to walk across the street again. Will appraise of results...when in.LOL

 

[mpitfield]

I wonder if any of those representatives were trying to tell you that it was not "a" law, but it was "the law" as in "the fuzz, po-po, the man, etc." That something that you did/bought/sold clicked in some algorithm and got some government suit interested in you?

That is something I thought of as well. As a matter of fact my first thought was what did I purchase that warranted a limited account and was this something that PayPal did on their own, or where they directed to by "the man". As much as that is a possibility I cannot think of anything in my purchasing history that would warrant the attention, but then again who knows. I will admit that the silent treatment I received from PayPal left me feeling that they were purposely tight lipped about the reasoning behind the motivation, so I was left a bit suspicious.

 

[mpitfield]

Now of course the notice comes telling me to sign in and change me pass word.

Jim, be very careful. This request has the feel of a common phishing attack where the attacker pretends to be bringing your attention to a security or critical issue that demands your immediate attention and have you log into your account. If you know how to, have a look at the email header and try to determine the source of the email, also if you convert the email to plain text then you can clearly see any embedded URLs that may be masquerading as the legitimate portal, which can look identical to the actual eBay login portal.

 

[Frederocket]

Jim, be very careful. This request has the feel of a common phishing attack where the attacker pretends to be bringing your attention to a security or critical issue that demands your immediate attention and have you log into your account. If you know how to, have a look at the email header and try to determine the source of the email, also if you convert the email to plain text then you can clearly see any embedded URLs that may be masquerading as the legitimate portal, which can look identical to the actual eBay login portal.

This... I have had several security email phishing attempts on my PayPal and other credit and bank accounts. I make it an absolute practice to never click on an account link/sign in from any email from a financial institution... I either go to my book marked page or type in the web page in a new browser page... Once burned, once learned...

 

[rstaff3]

This... I have had several security email phishing attempts on my PayPal and other credit and bank accounts. I make it an absolute practice to never click on an account link/sign in from any email from a financial institution... I either go to my book marked page or type in the web page in a new browser page... Once burned, once learned...

Kinda random comment, but once this came up. Also, don't talk to people on the phone who are claiming to be from a financial organization. Instead, call back on a trusted number.

 

[afadeev]

Personally I consider everyone here to be "friends" so regardless of the fact the a trade is being made, I don't see a problem with sending payments F&F.

... and we certainly argue over trivial things, as a "family", so I would say we are fully covered as F&F.


In my experience, PayPal is a company with remarkably crappy and poorly informed customer service department. But the same could be said for EVERY other financial institution I've ever dealt, worked with, or for. All operate on the "we don't need a reason, we have a policy" basis. Once legal, finreg, or money-laundering flags are raised (for any reason), logical conversations dead-end quickly, and permanently.

Yet all of the above are essential for facilitating transactions in the modern world, so you just have to learn to work around their idiocies.
Michael P - just open a new account!

a

 

[rcktnut]

Personally I consider everyone here to be "friends" so regardless of the fact the a trade is being made, I don't see a problem with sending payments F&F.
If/When I run into a situation like mpitfield shares above, my use of their service will come to an abrupt end. I still remember how to use a money order....

I thought the same way until https://www.rocketryforum.com/showt...acement-for-Estes-2086&p=1545338#post1545338:

Read the whole thread. Guy had nice friendly communications (email) until I sent money via PayPal F&F Still no canopies!! Guys gone.

What a buyer can do if ripped off this way is report it and the sellers account can be suspended. No refunds for the buyer though. I did not report it over $27.00 let the guy go. There are some great deals on here and if I think it is worth the extra 3% I'll buy it if not I won't buy it.

 

[blackbrandt]

My rule of thumb, if I know the person well (like those who I have met in person or have known for a while on here), I have no problem using F+F. However, if I have any sliver of doubt, or if I'm dealing with someone I don't know very well, I will always use a fee'd transaction.

 

[Bobfly]

Hi All,

I just had an issue with PayPal a couple of months ago. After having an account for over a year with no issues I ran into a problem. A Scuba Store in California sent me an invoice for approximately $350 for a handtruck. The handtruck is designed to move scuba tanks around. The store&#8217;s email invoice had a PayPay link for payment.

PayPal accepted the transaction and charged my credit card. Then PayPal froze the transaction and refused to send the funds to the vendor. When I called PayPal&#8217;s customer service number I was given the runaround. The customer service rep could not tell me what the problem was.

I tried to have PayPal cancel the transaction and return the funds to my credit card. They refused to do that. The Scuba store has had a business account for years with PayPal. When the vendor called PayPal they received the same runaround that I had received. About a week later PayPal paid the vendor.

It is is disrespectful and unethical for PayPal to take a person&#8217;s money and refuse to pass it along to the vendor or return it to the purchaser. It is even worse giving the client the runaround.

Sincerely,
Bob

 

[blackjack2564]

Jim, be very careful. This request has the feel of a common phishing attack where the attacker pretends to be bringing your attention to a security or critical issue that demands your immediate attention and have you log into your account. If you know how to, have a look at the email header and try to determine the source of the email, also if you convert the email to plain text then you can clearly see any embedded URLs that may be masquerading as the legitimate portal, which can look identical to the actual eBay login portal.

I resolved the issue quite painlessly. Far better than the last nightmare. I checked the address sent from, it was legit, so I did as instructed & all is good.
Of course I got the "confidential" BS when I asked how/who compromised my account. Had not effect PP at all.

 

[mpitfield]

I resolved the issue quite painlessly. Far better than the last nightmare. I checked the address sent from, it was legit, so I did as instructed & all is good.
Of course I got the "confidential" BS when I asked how/who compromised my account. Had not effect PP at all.

Hopefully that is the end of it.

Forgive me if this is stuff you already know, I don't know your technical level however the senders email address can be spoofed. It is actually quite easy to do. Literally I can spoof any email address to look like it came from a specific sender. As the recipient it is up to your email security to determine if the source is legit and apply whatever scrutiny and rules as it moves through your mail service.

One thing I do beyond upstream mail filtering and security is I view all email in pain text. It does not look sexy but if I trust the source I can always flip the view to HTML or in the case of Outlook HTML or RTF and see it how it was intended. Viewing email in plain text has the benefit that it breaks down the email into it's three basic constituents, the header, the body and attachments. This benefits your security by pulling out the embedded objects and converting them as attachments, URLs can be clearly viewed and any embedded code that can otherwise self execute becomes ineffective.

The rest of this is somewhat technical but for anyone interested below is a look under the hood of a typical email.

The header is what contains most of the diagnostic information beyond what is visible, the sender, recipients, subject, date etc. Below is a non-parsed example of an email header taken from a recent email I received using Outlook 2011 as the email client, and I use Exchange 2013 as the recipient server. I have made some minor changes to it for security reasons. As the email moves from the sender to the recipient, it moves from system to system and these systems append this header including time stamps. This allows administrators to diagnose many issues including security issues.

Received: from S05-MBX04-22.S05.local (10.30.33.126) by S05-MBX04-17.S05.local
(10.30.33.104) with Microsoft SMTP Server (TLS) id 15.0.1347.2 via Mailbox
Transport; Mon, 25 Dec 2017 03:59:06 -0500
Received: from S05-CAS014.S05.local (10.30.33.51) by S05-MBX04-22.S05.local
(10.30.33.126) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 25 Dec
2017 03:59:05 -0500
Received: from S05-MFBE11-15.S05.local (10.30.33.225) by S05-CAS014.S05.local
(10.30.33.51) with Microsoft SMTP Server id 15.0.1347.2 via Frontend
Transport; Mon, 25 Dec 2017 03:59:05 -0500
Received: from S05-MFFE11.S05.local (mailfilter5-1.sherwebcloud.com [199.244.76.190])
by S05-MFBE11-15.S05.local (Postfix) with ESMTP id E151820000DB
for <[email protected]>; Mon, 25 Dec 2017 03:59:03 -0500 (EST)
Received: from mail-qk0-f177.google.com (mail-qk0-f177.google.com [209.85.220.177])
by mx05-1.mycloudmailbox.com (Postfix) with ESMTPS id D0AC820000CF
for <[email protected]>; Mon, 25 Dec 2017 03:59:03 -0500 (EST)
Received: by mail-qk0-f177.google.com with SMTP id g123so9104741qka.3
for <[email protected]>; Mon, 25 Dec 2017 00:59:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:in-reply-to:references:from:date:message-id:subject:to
:cc;
bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=;
b=eXfXJLIlMt3iwq9AbZUuyVQlE0NJVXzW4H63pIhbZ6HYhcgJ13tE9yruDnDZz0/nXD
uytKOQ4fZeOwM6dZ2a1euJDvEb/oDD3dmW7Q9hxkeZXrskbU9P3fEG9yTQvSXZOEcTZn
FPtsfOOQ2oLBHniC7t0gUQj1F7vUkOgBUH5T6Vd1UlVw1TmMkUoX7BMVevL2e9meo0Hc
QChwEx/i9rBAkZ1ODMl1YHgedjbLnMJvswl0U4XrlO4xhJPFc0JKAy9ht10997SxBjeb
a8YKLDbNSa0iC2UwQh8QTm3+r0RKH/9PkkDo4Y/pDts3T+5BoiMTfrSOvAfESxnU9RFH
6J2w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:in-reply-to:references:from:date
:message-id:subject:to:cc;
bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=;
b=ZAhLI8iWHnpkx8GhKcL3vgPVZiqXIT5PcuZf+jEJcUFONJ8HdRSU8smaUxTcDys+ZD
6jDIthtkc+jmfPJ4dp4Y6y+URGynFWJDE0vjGEdy8cHTVZ/iuFs4cDl33TNTDbmTpm1j
vkzwRpPXMoZ7iJlJCux2D/P2tqMr2e1Jk7xw1TxwHGx91ERdu/mHoAs/iC1aDui8VsQZ
A+D/yIm5Qblmjjt3oPCuFhoKvTadoIwBpyfil0PdevslHrmwSoZI/h3tog3bdULdakoW
gQ6l4zfiVyKRtEMoQ2QnCj7cEZw/Ls6I2tpgM7fQA/zmch/MpwWwTl/dQi6Phe7aFpSL
bt/Q==
X-Gm-Message-State: AKGB3mLqWCCGiv66b3YUODhA+kU8uaBWCdXc9/3sZwX+bqu3EWfseGC5
YiKHMkDsIfdB/qPElTHg+/0jMNdX5B55EwdsQ4vz0w==
X-Google-Smtp-Source: ACJfBouFJ/7/o1WB7JlvIHGxjq8jTASosjoJ0strA3JOm+m8FFWax9spjEvsFkn57HQEmajmEYmibgmf91S7YqLOFUc=
X-Received: by 10.55.181.66 with SMTP id e63mr29155343qkf.130.1514192343065;
Mon, 25 Dec 2017 00:59:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.140.96.139 with HTTP; Mon, 25 Dec 2017 00:58:42 -0800 (PST)
In-Reply-To: <[email protected]>
References: <[email protected]>
From: Aqua Sense <[email protected]>
Date: Mon, 25 Dec 2017 03:58:42 -0500
Message-ID: <CAJrj7[email protected]>
Subject: Re: New message on AquaSenseW.com
To: [email protected]
Cc: David Green <[email protected]>
X-MF-Information: Contact support for more information
X-MF-ID: E151820000DB.A6970
X-MF-MailCheck: Not scanned
X-MF-IP-Protocol: IPv4
X-MF-SpamCheck: not spam, SpamAssassin (not cached, score=0.63, required 5,
autolearn=disabled, DCC_REPUT_13_19 -0.10, FREEMAIL_FROM 0.25,
HTML_MESSAGE 0.50, RCVD_IN_DNSWL_NONE -0.00, RCVD_IN_MSPIKE_H3 -0.01,
RCVD_IN_MSPIKE_WL -0.01)
X-MF-From: [email protected]
X-Spam-Status: No
Return-Path: [email protected]
X-MS-Exchange-Organization-Network-Message-Id: 34390ab6-e469-4cd3-554c-08d54b75c0b5
X-RoutingAgent: Treated
X-MS-Exchange-Organization-AuthSource: S05-CAS014.S05.local
X-MS-Exchange-Organization-AuthAs: Anonymous
Content-type: multipart/alternative;
boundary="B_3597425005_1475338"

> This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

--B_3597425005_1475338
Content-type: text/plain;
charset="UTF-8"
Content-transfer-encoding: quoted-printable

Hello Michael

=E2=80=8BCan you give us a approximate size for your project? And what can we help
you with? We are freshwater only aquarium store but my colleagues have good
experience with saltwater aquariums

--B_3597425005_1475338
Content-type: text/html;
charset="UTF-8"
Content-transfer-encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
</head>
<body>
<div dir=3D"ltr">
<div class=3D"gmail_default" style=3D"color:rgb(68,68,68)">Hello Michael</div>
<div class=3D"gmail_default" style=3D"color:rgb(68,68,68)"><br>
</div>
<div class=3D"gmail_default" style=3D"color:rgb(68,68,68);display:inline">=E2=80=8BCa=
n you give us a approximate size for your project? And what can we help you =
with? We are freshwater only aquarium store but my colleagues have good expe=
rience with saltwater aquariums</div>
</div>
</body>
</html>

--B_3597425005_1475338--


Using an email header analyzer, in this case from mxtoolbox.com, you can parse and brake it down into a more readable format:

Header Name	Header Value
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=; b=eXfXJLIlMt3iwq9AbZUuyVQlE0NJVXzW4H63pIhbZ6HYhcgJ13tE9yruDnDZz0/nXD uytKOQ4fZeOwM6dZ2a1euJDvEb/oDD3dmW7Q9hxkeZXrskbU9P3fEG9yTQvSXZOEcTZn FPtsfOOQ2oLBHniC7t0gUQj1F7vUkOgBUH5T6Vd1UlVw1TmMkUoX7BMVevL2e9meo0Hc QChwEx/i9rBAkZ1ODMl1YHgedjbLnMJvswl0U4XrlO4xhJPFc0JKAy9ht10997SxBjeb a8YKLDbNSa0iC2UwQh8QTm3+r0RKH/9PkkDo4Y/pDts3T+5BoiMTfrSOvAfESxnU9RFH 6J2w==
X-Google-DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=; b=ZAhLI8iWHnpkx8GhKcL3vgPVZiqXIT5PcuZf+jEJcUFONJ8HdRSU8smaUxTcDys+ZD 6jDIthtkc+jmfPJ4dp4Y6y+URGynFWJDE0vjGEdy8cHTVZ/iuFs4cDl33TNTDbmTpm1j vkzwRpPXMoZ7iJlJCux2D/P2tqMr2e1Jk7xw1TxwHGx91ERdu/mHoAs/iC1aDui8VsQZ A+D/yIm5Qblmjjt3oPCuFhoKvTadoIwBpyfil0PdevslHrmwSoZI/h3tog3bdULdakoW gQ6l4zfiVyKRtEMoQ2QnCj7cEZw/Ls6I2tpgM7fQA/zmch/MpwWwTl/dQi6Phe7aFpSL bt/Q==
X-Gm-Message-State	AKGB3mLqWCCGiv66b3YUODhA+kU8uaBWCdXc9/3sZwX+bqu3EWfseGC5 YiKHMkDsIfdB/qPElTHg+/0jMNdX5B55EwdsQ4vz0w==
X-Google-Smtp-Source	ACJfBouFJ/7/o1WB7JlvIHGxjq8jTASosjoJ0strA3JOm+m8FFWax9spjEvsFkn57HQEmajmEYmibgmf91S7YqLOFUc=
X-Received	by 10.55.181.66 with SMTP id e63mr29155343qkf.130.1514192343065; Mon, 25 Dec 2017 00:59:03 -0800 (PST)
MIME-Version	1.0
In-Reply-To	<[email protected]>
References	<[email protected]>
From	Aqua Sense <[email protected]>
Date	Mon, 25 Dec 2017 03:58:42 -0500
Message-ID	<CAJrj7[email protected]>
Subject	Re: New message on AquaSenseW.com
To	[email protected]
Cc	David Green <[email protected]>
X-MF-Information	Contact support for more information
X-MF-ID	E151820000DB.A6970
X-MF-MailCheck	Not scanned
X-MF-IP-Protocol	IPv4
X-MF-SpamCheck	not spam, SpamAssassin (not cached, score=0.63, required 5, autolearn=disabled, DCC_REPUT_13_19 -0.10, FREEMAIL_FROM 0.25, HTML_MESSAGE 0.50, RCVD_IN_DNSWL_NONE -0.00, RCVD_IN_MSPIKE_H3 -0.01, RCVD_IN_MSPIKE_WL -0.01)
X-MF-From	[email protected]
X-Spam-Status	No
Return-Path	[email protected]
X-MS-Exchange-Organization-Network-Message-Id	34390ab6-e469-4cd3-554c-08d54b75c0b5
X-RoutingAgent	Treated
X-MS-Exchange-Organization-AuthSource	S05-CAS014.S05.local
X-MS-Exchange-Organization-AuthAs	Anonymous
(1) Content 1 type text/plain	Hello Michael=E2=80=8BCan you give us a approximate size for your project? And what can we help you with? We are freshwater only aquarium store but my colleagues have good experience with saltwater aquariums

 

[RocketFeller]

Hopefully that is the end of it.

Forgive me if this is stuff you already know, I don't know your technical level however the senders email address can be spoofed. It is actually quite easy to do. Literally I can spoof any email address to look like it came from a specific sender. As the recipient it is up to your email security to determine if the source is legit and apply whatever scrutiny and rules as it moves through your mail service.

One thing I do beyond upstream mail filtering and security is I view all email in pain text. It does not look sexy but if I trust the source I can always flip the view to HTML or in the case of Outlook HTML or RTF and see it how it was intended. Viewing email in plain text has the benefit that it breaks down the email into it's three basic constituents, the header, the body and attachments. This benefits your security by pulling out the embedded objects and converting them as attachments, URLs can be clearly viewed and any embedded code that can otherwise self execute becomes ineffective.

The rest of this is somewhat technical but for anyone interested below is a look under the hood of a typical email.

The header is what contains most of the diagnostic information beyond what is visible, the sender, recipients, subject, date etc. Below is a non-parsed example of an email header taken from a recent email I received using Outlook 2011 as the email client, and I use Exchange 2013 as the recipient server. I have made some minor changes to it for security reasons. As the email moves from the sender to the recipient, it moves from system to system and these systems append this header including time stamps. This allows administrators to diagnose many issues including security issues.

Received: from S05-MBX04-22.S05.local (10.30.33.126) by S05-MBX04-17.S05.local
(10.30.33.104) with Microsoft SMTP Server (TLS) id 15.0.1347.2 via Mailbox
Transport; Mon, 25 Dec 2017 03:59:06 -0500
Received: from S05-CAS014.S05.local (10.30.33.51) by S05-MBX04-22.S05.local
(10.30.33.126) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Mon, 25 Dec
2017 03:59:05 -0500
Received: from S05-MFBE11-15.S05.local (10.30.33.225) by S05-CAS014.S05.local
(10.30.33.51) with Microsoft SMTP Server id 15.0.1347.2 via Frontend
Transport; Mon, 25 Dec 2017 03:59:05 -0500
Received: from S05-MFFE11.S05.local (mailfilter5-1.sherwebcloud.com [199.244.76.190])
by S05-MFBE11-15.S05.local (Postfix) with ESMTP id E151820000DB
for <[email protected]>; Mon, 25 Dec 2017 03:59:03 -0500 (EST)
Received: from mail-qk0-f177.google.com (mail-qk0-f177.google.com [209.85.220.177])
by mx05-1.mycloudmailbox.com (Postfix) with ESMTPS id D0AC820000CF
for <[email protected]>; Mon, 25 Dec 2017 03:59:03 -0500 (EST)
Received: by mail-qk0-f177.google.com with SMTP id g123so9104741qka.3
for <[email protected]>; Mon, 25 Dec 2017 00:59:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:in-reply-to:references:from:date:message-id:subject:to
:cc;
bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=;
b=eXfXJLIlMt3iwq9AbZUuyVQlE0NJVXzW4H63pIhbZ6HYhcgJ13tE9yruDnDZz0/nXD
uytKOQ4fZeOwM6dZ2a1euJDvEb/oDD3dmW7Q9hxkeZXrskbU9P3fEG9yTQvSXZOEcTZn
FPtsfOOQ2oLBHniC7t0gUQj1F7vUkOgBUH5T6Vd1UlVw1TmMkUoX7BMVevL2e9meo0Hc
QChwEx/i9rBAkZ1ODMl1YHgedjbLnMJvswl0U4XrlO4xhJPFc0JKAy9ht10997SxBjeb
a8YKLDbNSa0iC2UwQh8QTm3+r0RKH/9PkkDo4Y/pDts3T+5BoiMTfrSOvAfESxnU9RFH
6J2w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:in-reply-to:references:from:date
:message-id:subject:to:cc;
bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=;
b=ZAhLI8iWHnpkx8GhKcL3vgPVZiqXIT5PcuZf+jEJcUFONJ8HdRSU8smaUxTcDys+ZD
6jDIthtkc+jmfPJ4dp4Y6y+URGynFWJDE0vjGEdy8cHTVZ/iuFs4cDl33TNTDbmTpm1j
vkzwRpPXMoZ7iJlJCux2D/P2tqMr2e1Jk7xw1TxwHGx91ERdu/mHoAs/iC1aDui8VsQZ
A+D/yIm5Qblmjjt3oPCuFhoKvTadoIwBpyfil0PdevslHrmwSoZI/h3tog3bdULdakoW
gQ6l4zfiVyKRtEMoQ2QnCj7cEZw/Ls6I2tpgM7fQA/zmch/MpwWwTl/dQi6Phe7aFpSL
bt/Q==
X-Gm-Message-State: AKGB3mLqWCCGiv66b3YUODhA+kU8uaBWCdXc9/3sZwX+bqu3EWfseGC5
YiKHMkDsIfdB/qPElTHg+/0jMNdX5B55EwdsQ4vz0w==
X-Google-Smtp-Source: ACJfBouFJ/7/o1WB7JlvIHGxjq8jTASosjoJ0strA3JOm+m8FFWax9spjEvsFkn57HQEmajmEYmibgmf91S7YqLOFUc=
X-Received: by 10.55.181.66 with SMTP id e63mr29155343qkf.130.1514192343065;
Mon, 25 Dec 2017 00:59:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.140.96.139 with HTTP; Mon, 25 Dec 2017 00:58:42 -0800 (PST)
In-Reply-To: <[email protected]>
References: <[email protected]>
From: Aqua Sense <[email protected]>
Date: Mon, 25 Dec 2017 03:58:42 -0500
Message-ID: <CAJrj7[email protected]>
Subject: Re: New message on AquaSenseW.com
To: [email protected]
Cc: David Green <[email protected]>
X-MF-Information: Contact support for more information
X-MF-ID: E151820000DB.A6970
X-MF-MailCheck: Not scanned
X-MF-IP-Protocol: IPv4
X-MF-SpamCheck: not spam, SpamAssassin (not cached, score=0.63, required 5,
autolearn=disabled, DCC_REPUT_13_19 -0.10, FREEMAIL_FROM 0.25,
HTML_MESSAGE 0.50, RCVD_IN_DNSWL_NONE -0.00, RCVD_IN_MSPIKE_H3 -0.01,
RCVD_IN_MSPIKE_WL -0.01)
X-MF-From: [email protected]
X-Spam-Status: No
Return-Path: [email protected]
X-MS-Exchange-Organization-Network-Message-Id: 34390ab6-e469-4cd3-554c-08d54b75c0b5
X-RoutingAgent: Treated
X-MS-Exchange-Organization-AuthSource: S05-CAS014.S05.local
X-MS-Exchange-Organization-AuthAs: Anonymous
Content-type: multipart/alternative;
boundary="B_3597425005_1475338"

> This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

--B_3597425005_1475338
Content-type: text/plain;
charset="UTF-8"
Content-transfer-encoding: quoted-printable

Hello Michael

=E2=80=8BCan you give us a approximate size for your project? And what can we help
you with? We are freshwater only aquarium store but my colleagues have good
experience with saltwater aquariums

--B_3597425005_1475338
Content-type: text/html;
charset="UTF-8"
Content-transfer-encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
</head>
<body>
<div dir=3D"ltr">
<div class=3D"gmail_default" style=3D"color:rgb(68,68,68)">Hello Michael</div>
<div class=3D"gmail_default" style=3D"color:rgb(68,68,68)"><br>
</div>
<div class=3D"gmail_default" style=3D"color:rgb(68,68,68);display:inline">=E2=80=8BCa=
n you give us a approximate size for your project? And what can we help you =
with? We are freshwater only aquarium store but my colleagues have good expe=
rience with saltwater aquariums</div>
</div>
</body>
</html>

--B_3597425005_1475338--


Using an email header analyzer, in this case from mxtoolbox.com, you can parse and brake it down into a more readable format:

Header Name	Header Value
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=; b=eXfXJLIlMt3iwq9AbZUuyVQlE0NJVXzW4H63pIhbZ6HYhcgJ13tE9yruDnDZz0/nXD uytKOQ4fZeOwM6dZ2a1euJDvEb/oDD3dmW7Q9hxkeZXrskbU9P3fEG9yTQvSXZOEcTZn FPtsfOOQ2oLBHniC7t0gUQj1F7vUkOgBUH5T6Vd1UlVw1TmMkUoX7BMVevL2e9meo0Hc QChwEx/i9rBAkZ1ODMl1YHgedjbLnMJvswl0U4XrlO4xhJPFc0JKAy9ht10997SxBjeb a8YKLDbNSa0iC2UwQh8QTm3+r0RKH/9PkkDo4Y/pDts3T+5BoiMTfrSOvAfESxnU9RFH 6J2w==
X-Google-DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=bqE+kJpYB7PtarT8Y3IZvobgNa9qVGv8lFbEgKhSbxY=; b=ZAhLI8iWHnpkx8GhKcL3vgPVZiqXIT5PcuZf+jEJcUFONJ8HdRSU8smaUxTcDys+ZD 6jDIthtkc+jmfPJ4dp4Y6y+URGynFWJDE0vjGEdy8cHTVZ/iuFs4cDl33TNTDbmTpm1j vkzwRpPXMoZ7iJlJCux2D/P2tqMr2e1Jk7xw1TxwHGx91ERdu/mHoAs/iC1aDui8VsQZ A+D/yIm5Qblmjjt3oPCuFhoKvTadoIwBpyfil0PdevslHrmwSoZI/h3tog3bdULdakoW gQ6l4zfiVyKRtEMoQ2QnCj7cEZw/Ls6I2tpgM7fQA/zmch/MpwWwTl/dQi6Phe7aFpSL bt/Q==
X-Gm-Message-State	AKGB3mLqWCCGiv66b3YUODhA+kU8uaBWCdXc9/3sZwX+bqu3EWfseGC5 YiKHMkDsIfdB/qPElTHg+/0jMNdX5B55EwdsQ4vz0w==
X-Google-Smtp-Source	ACJfBouFJ/7/o1WB7JlvIHGxjq8jTASosjoJ0strA3JOm+m8FFWax9spjEvsFkn57HQEmajmEYmibgmf91S7YqLOFUc=
X-Received	by 10.55.181.66 with SMTP id e63mr29155343qkf.130.1514192343065; Mon, 25 Dec 2017 00:59:03 -0800 (PST)
MIME-Version	1.0
In-Reply-To	<[email protected]>
References	<[email protected]>
From	Aqua Sense <[email protected]>
Date	Mon, 25 Dec 2017 03:58:42 -0500
Message-ID	<CAJrj7[email protected]>
Subject	Re: New message on AquaSenseW.com
To	[email protected]
Cc	David Green <[email protected]>
X-MF-Information	Contact support for more information
X-MF-ID	E151820000DB.A6970
X-MF-MailCheck	Not scanned
X-MF-IP-Protocol	IPv4
X-MF-SpamCheck	not spam, SpamAssassin (not cached, score=0.63, required 5, autolearn=disabled, DCC_REPUT_13_19 -0.10, FREEMAIL_FROM 0.25, HTML_MESSAGE 0.50, RCVD_IN_DNSWL_NONE -0.00, RCVD_IN_MSPIKE_H3 -0.01, RCVD_IN_MSPIKE_WL -0.01)
X-MF-From	[email protected]
X-Spam-Status	No
Return-Path	[email protected]
X-MS-Exchange-Organization-Network-Message-Id	34390ab6-e469-4cd3-554c-08d54b75c0b5
X-RoutingAgent	Treated
X-MS-Exchange-Organization-AuthSource	S05-CAS014.S05.local
X-MS-Exchange-Organization-AuthAs	Anonymous
(1) Content 1 type text/plain	Hello Michael=E2=80=8BCan you give us a approximate size for your project? And what can we help you with? We are freshwater only aquarium store but my colleagues have good experience with saltwater aquariums

This is a complete derail of this thread, but...

What kind of aquaria are you into? I used to be really into fish (I am a moderator on MonsterFishKeepers.com) but have been more focused on rocketry these days. I currently have 670 gallons running (300+220+135+15), in the past I was up to about 1200.


Sent from my iPhone using Rocketry Forum

 

[Rob702Martinez]

I believe no one feels this way about my yard sales...
I accept moneyorders-lately 3, usually quick shipping, either form of paypal doesnt bother me or make a difference. Don't mind paying fees for a service I've used since 2002.

All my items are priced with all costs considered. Postage, packaging materials, pp fees, etc... if a buyer sends it FF I consider it a bonus to the sale.