Paypal Scams

A new type of PayPal scam is making the rounds, and it's so sophisticated that even security experts are raising concerns. This isn't your typical phishing attack; it uses legitimate PayPal features, making it harder to detect.
​
​​The scam works by exploiting PayPal's money request feature. Attackers obtain a list of email addresses, sometimes using temporary or free email accounts to create distribution lists. They then use PayPal's legitimate system to send money requests to these addresses.

​The emails appear to come from PayPal, with valid sender addresses and URLs. When a victim clicks the link in the email, they are taken to a real PayPal login page displaying a payment request. 
​
The "To:" Field Deception: When the email arrives in the victim's inbox, the "To:" field will appear to be addressed to them. This is because email servers automatically expand distribution lists. So, even though the original request was sent to the scammer, each recipient sees their own email address in the "To:" field. This creates the illusion that the email was sent directly to them by PayPal.

This subtle difference can easily be overlooked, especially if the victim isn't paying close attention. The requested amount, in some reported cases over $2,000, is large enough to be profitable for the scammers but not so large as to immediately trigger suspicion.

Security experts warn that this "phish-free" phishing attack is particularly dangerous because it bypasses many traditional phishing detection methods. Since the emails and links are legitimate, they often slip past spam filters and security software.

To protect yourself from this type of scam:

• Check the invoice. If you’ve already paid for a specific item using Paypal, don’t pay for it again.
• Always carefully check the "To:" field of any PayPal email: Ensure it's addressed directly to your primary email address.
• Be wary of unexpected money requests: If you receive a request for money that you weren't expecting, even if it appears to come from PayPal, be suspicious.
• Never click links in suspicious emails: Instead, log in to your PayPal account directly through the official website to review any pending requests.
• Enable two-factor authentication (2FA): This adds an extra layer of security to your PayPal account.

This new scam highlights the evolving nature of cyberattacks and the importance of staying vigilant, even when dealing with seemingly legitimate communications.

Ep286

Image created by AI