This Corean-hosted phish is not one of the most savvy ones, but being mass-mailed widely, gets a statistically good chance of causing damage.

The HTML email is quite fancy, but some random text can be spotted at the bottom, which is a widely recognized spam technique:

The site that opens after the link is clicked resembles the original Paypal page very closely. Two things are, however, inconsistent:

• The URL in the address bar is NOT on paypal.com;
• There is no secure session indication by the browser (the padlock icon in the status bar in IE, for example) :

Here, the credit card will be checked against a mathematical formula, generally used for a first stage CC number verification (before connecting to a CC server). This way, a random bogus number will be rejected, thus increasing the impression of credibility of the site.

The site will open a series of such pages, asking for a lot of information. This is one of its weak points, too - the potential victim will have a lot of time to eventually expose the hoax: