Skip to content
Register

Is anyone else getting weird PayPal verification emails?

General Discussion by MeritBudi 13 replies 2.2K views
haroldgsm

Member

Grumpy Old Sysadmin

#11
GeorgeNmp said:
The phishing campaign is using lookalike subdomains on expired legitimate domains

Same playbook since 2003. Buy a dead nonprofit, resurrect its MX, blast until reputation tanks, burn it down. The only thing that changed is the TTL on those SPF records got shorter while everyone else got slower at noticing.

I still say PayPal's actual security push this week is what created the opportunity. You don't run a major account verification campaign without predictable templates for scammers to clone. Marketing announces, security cleans up, users get caught in the middle.

IPv4, IRC, and irssi — fight me
Fritz48

Member

Datenschutz First

#12

PayPal processes verification through their Irish entity for EU residents. The email should reference PayPal Europe S.a r.l. Et Cie, S.C.A. With registered office in Luxembourg. If your email mentions only PayPal Inc. and you are in the EU, that is a strong signal regardless of headers.

I requested my verification data package under GDPR Article 15 last year. Took 47 days. The verification flow they described does not match this email pattern at all.

Neuland. Aber schnell.
marcus_qc

Member

1 #13
Fritz48 said:
The verification flow they described does not match this email pattern at all.

Same here for our Quebec customers. PayPal Canada sends French-first bilingual emails, not English-only. The fake ones we saw were English only with a tiny French footer that looked Google-translated. Dead giveaway for our market.

Also: real PayPal does not threaten account suspension in the subject line. They use neutral subjects like "Action required on your account." The fakes all had URGENT in caps.

42U and still growing
MeritBudi

Member OP

1 #14
marcus_qc said:
Real PayPal does not threaten account suspension

Aiya why never say earlier lah. My email got "ACCOUNT LIMITED" all caps scared me click almost. Now I check again the from address is [email protected] not paypal.com. Lucky ask here first.

How to report this properly? Just forward to [email protected] can?

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft