Unsolicited email from PayPal

[Beardski]

Has anyone received an email from PayPal (Saturday the 21st) saying that you need to reset your password? In the email they say that you cannot log in and that they have provided a temporary password in order for you to do so. I tried logging in today - just normally - and it worked just fine. I did not need to do anything different. Anyone else receive something like this? The email that PayPal sent reads as follows:

At PayPal, your security is a top priority. As part of our routine monitoring, we discovered a list of email addresses and passwords on the web. While the list is not related to PayPal, we know that it is common practice to use the same email and password across various websites. It is possible that your email and password may have been on the list. We’ve taken extra precaution to confirm that your PayPal account is secure and have assigned a temporary password to your account.

You will need to reset your password to access your PayPal account. To reset a new password:

1. Go to PayPal.com and click “Log In.”
2. Click the “Having trouble logging in?” link.
3. Follow the steps to set a new password to one that is unique to your PayPal account, has not been used previously, and is hard to guess.

Once you’ve done this, your new password will be effective immediately. If you have any questions about your account, please contact us

[SourCreamPrngls]

I got the exact same message, and I checked that link in the email using http://google.com/safebrowsing/diagnostic?site=

and it says it's legit. But if you search for the phrases in the email like "As part of our routine monitoring, we discovered a list of email addresses and passwords on the web" you find the exact same email has been sent to Amazon customers a few years ago, and people were concerned about phishing then too. But you also get results of old news like http://www.hackingnews.com/cyber-crime/amazon-accounts-hacked-amazon-com-password-changed/

which shows that in 2014 Amazon did send this email out and preemptively changed account passwords. But the verbiage was exactly the same!

I think the solution is don't click that link in the email, but change your password on the real paypal site anyway.

here is the url from the link I got in my email, almost the exact same except the "cust" (customer probably) and "unptid" values

https://www.paypal.com/?ppid=PPC001479&cnac=US&rsta=en_US(en_US)&cust=NPNH9R8RXE9VJ&unptid=9578392a-...