Get ready for the spam

After installing this plugin, within days I was hit by PayPal phishing emails, fake invoices, spam, junk email, etc… despite using an email spam filter on the server. I dutifully forwarded all phishing emails to PayPal’s spoof@paypal.com email address.

I couldn’t understand why there was such an uptick in fake invoices, scams, and assorted junk.

Then I clicked on the Donate Now button. Right there for the world to see was my email address, shown in a pop-up window—no visit to PayPal’s website necessary. It didn’t dawn on me when I first installed it that if I could see my email, then so could the world.

So I went into the “Donate via PayPal” settings and changed it to Merchant ID. I’m not a merchant or business; I run a free website that accepts donations. I grabbed the Merchant ID anyway from my PayPal account settings and swapped out my email address for this ID to see if it hid my email.

Instead, when you click the Donate button my full name shows up! What is wrong with this plugin and privacy? It literally is sharing your email address to the entire world with no encryption or even bothering trying to hide it.

I then looked at my site’s source code. Right there for the world to see was my email address, unencoded, waiting to be scraped by scammers, schemers, fraudsters, and Nigerian princes. My friggin’ contact form hides my email address. So great job on exposing my addy to the world and greatly increasing my spam, phishing emails, and frustration.

PS: I don’t care if they see my email once they get to the Paypal website as most scammers are automated, but to show it in a pop-up window without ever leaving the site and having it embedded in the source code is beyond irresponsible. The author needs to fix this.