Edgar had been taken in by a scam in which the crooks had registered a Web site with the name "paypal-secure.com"—which sounds as if it should have been a secure page on the legitimate PayPal site, but it isn't. When he entered information on that site, the attackers got just what they wanted.