Swordsmyth
Member
- Joined
- Apr 14, 2016
- Messages
- 74,737
There’s a new PayPal phishing scam making the rounds, and it’s so convincing that even security-conscious users are getting caught in it. Unlike typical scams riddled with typos and fake domains, this one uses PayPal’s own email system to send you an alert that looks 100% real.
You might get a message like, "You added a new address. This is just a quick confirmation that you added in your PayPal account."
Except … you didn’t. And what if you don’t even have a PayPal account? Here’s what this scam entails, why it works and how to protect yourself.
Most phishing scams try (and fail) to impersonate big companies. You’ve probably seen the classics: weird grammar, suspicious email addresses, Microsoft spelled with a "k". They’re laughably bad. But this scam flips the script because it uses PayPal against you. Here's how the scam operates:
Exploiting real features: Scammers abuse PayPal’s "add address" or "money request" tools. By entering your email, they can trigger real emails from PayPal’s real domain. And this works even if you don’t have a PayPal account.
Bypassing filters: Because these emails come directly from PayPal’s servers ([email protected]), they pass all security checks and appear legitimate in your inbox.
Lack of suspicion: Some versions contain no phishing links at all, just a scammer’s phone number, making them even harder to detect.
Panic bait: The message often claims a new address was added, or a large payment is being processed, getting your attention and provoking a quick reaction.
Follow-up attacks: After the initial email, scammers may later contact you pretending to be PayPal support. Some urge you to click a link to "secure your account", which leads to a fake login page designed to steal your credentials.
This scam has been reported by dozens of users on Reddit and cybersecurity forums. One Reddit user posted a detailed thread in r/Scams showing screenshots of phishing emails that look like they came straight from PayPal’s official address.
In a newer and more sophisticated twist, scammers are removing links altogether. Instead, they include a phone number and ask you to call. Once you do, you’re connected with a fake PayPal representative who says they need to verify your identity. They then instruct you to download what appears to be a PayPal-branded support tool, but really it’s a customized remote access app hosted on a different server. And once it’s installed, it gives the scammer full access to your device.
More at:
You might get a message like, "You added a new address. This is just a quick confirmation that you added in your PayPal account."
Except … you didn’t. And what if you don’t even have a PayPal account? Here’s what this scam entails, why it works and how to protect yourself.
Most phishing scams try (and fail) to impersonate big companies. You’ve probably seen the classics: weird grammar, suspicious email addresses, Microsoft spelled with a "k". They’re laughably bad. But this scam flips the script because it uses PayPal against you. Here's how the scam operates:
Exploiting real features: Scammers abuse PayPal’s "add address" or "money request" tools. By entering your email, they can trigger real emails from PayPal’s real domain. And this works even if you don’t have a PayPal account.
Bypassing filters: Because these emails come directly from PayPal’s servers ([email protected]), they pass all security checks and appear legitimate in your inbox.
Lack of suspicion: Some versions contain no phishing links at all, just a scammer’s phone number, making them even harder to detect.
Panic bait: The message often claims a new address was added, or a large payment is being processed, getting your attention and provoking a quick reaction.
Follow-up attacks: After the initial email, scammers may later contact you pretending to be PayPal support. Some urge you to click a link to "secure your account", which leads to a fake login page designed to steal your credentials.
This scam has been reported by dozens of users on Reddit and cybersecurity forums. One Reddit user posted a detailed thread in r/Scams showing screenshots of phishing emails that look like they came straight from PayPal’s official address.
In a newer and more sophisticated twist, scammers are removing links altogether. Instead, they include a phone number and ask you to call. Once you do, you’re connected with a fake PayPal representative who says they need to verify your identity. They then instruct you to download what appears to be a PayPal-branded support tool, but really it’s a customized remote access app hosted on a different server. And once it’s installed, it gives the scammer full access to your device.
More at:
Code:
https://www.msn.com/en-us/money/technology/new-paypal-scam-uses-real-emails-to-trick-you/ar-AA1HAZzS
