I got an email from Paypal that looked almost legitimate, it said that there was an invoice for 3x$200 Walmart gift cards on the way. It was from 'service@paypal.com'.

I knew nothing of this so it's a scam of some sort.

So I looked at the email headers in Gmail and they were all from Paypal. I looked at the IP number that was also Paypal's. Now pretty confident the message came from Paypal.

But the grammar in the message was a bit strange:

'Billing Department of PayPal sent you an invoice for $600.00 USD'

There's a seller message at the end of the email

//--------------
There is evidence that your PayPal account has been accessed unlawfully.
$600. 00 has been debited to your account for the Walmart eGift Card
purchase. This transaction will appear in the automatically deducted amount
on PayPal activity after 24 hours. If you suspect you did not make this
transaction, immediately contact us at the toll-free number +1 (888) 331
9234 or visit the PayPal Support Center area for assistance. Our Service
Hours: (06:00 a. m. to 06:00 p. m. Pacific Time, Monday through Friday)
//--------------

So, after I've deleted all means of payment from my Paypal account,
changed the password and switched on 2-factor authentication,
And tried+failed to speak to someone on 'chat' (after all I'm not calling
a US number from the UK that's going to be charged...) I then googled
for Paypal scams and found it...

It's very simple and really quite nasty; A user has sent me an invoice
so it's all very legitimate through Paypal's system. The message is
just to get me to panic and call the number and once I do that... they
masquerade as Paypal security and (try to) get my account details
from me.

Must admit that it would have been quite easy to at least make the
call if the number had been free from the UK but would hope that I'd
have been a bit suspicious once the call started.

A bit shit that Paypal don't have a simple means to report this or
speak to a customer care agent.

More details here:
https://www.elliott.org/problem-solved/this-new-paypal-scam-almost-got-me-heres-how-to-spot-it/

Oh, and fuck you scammers.

On 8/26/2022 8:54 AM, Stephen Packer wrote:
> I got an email from Paypal that looked almost legitimate, it said that there was an invoice for 3x$200 Walmart gift cards on the way. It was from 'service@paypal.com'.
>
> I knew nothing of this so it's a scam of some sort.
>
> So I looked at the email headers in Gmail and they were all from Paypal. I looked at the IP number that was also Paypal's. Now pretty confident the message came from Paypal.
> ...
>
> More details here:
> https://www.elliott.org/problem-solved/this-new-paypal-scam-almost-got-me-heres-how-to-spot-it/
>
> Oh, and fuck you scammers.

I've had the same scam from Amazon. It all looks real, but when I go to
my Amazon account, there's nothing about that charge, so I ignore the
scam posts.

--
The erstwhile Thomas
FJR1300, R1200GS & ST1100 (in memoriam)

Turby <xsurf@xmail.com> wrote:
> On 8/26/2022 8:54 AM, Stephen Packer wrote:
>> I got an email from Paypal that looked almost legitimate, it said that there was an invoice for 3x$200 Walmart gift cards on the way. It was from 'service@paypal.com'.
>>
>> I knew nothing of this so it's a scam of some sort.
>>
>> So I looked at the email headers in Gmail and they were all from Paypal. I looked at the IP number that was also Paypal's. Now pretty confident the message came from Paypal.
>> ...
>>
>> More details here:
>> https://www.elliott.org/problem-solved/this-new-paypal-scam-almost-got-me-heres-how-to-spot-it/
>>
>> Oh, and fuck you scammers.
>
> I've had the same scam from Amazon. It all looks real, but when I go to
> my Amazon account, there's nothing about that charge, so I ignore the
> scam posts.

I get a lot of similar scam emails about Paypal on my yahoo! email
account. I don't even bother opening them, much less log into Paypal.
Straight into the bit bucket.

--
FJR1300A, GL1000, KLR650A6F, EX250J9A, DR200SE, Vespa Ciao

On Friday, 26 August 2022 at 21:05:05 UTC+1, Mark Olson wrote:
> Turby <xs...@xmail.com> wrote:
> > On 8/26/2022 8:54 AM, Stephen Packer wrote:
> >> I got an email from Paypal that looked almost legitimate, it said that there was an invoice for 3x$200 Walmart gift cards on the way. It was from 'ser...@paypal.com'.
> >>
> >> I knew nothing of this so it's a scam of some sort.
> >>
> >> So I looked at the email headers in Gmail and they were all from Paypal. I looked at the IP number that was also Paypal's. Now pretty confident the message came from Paypal.
> >> ...
> >>
> >> More details here:
> >> https://www.elliott.org/problem-solved/this-new-paypal-scam-almost-got-me-heres-how-to-spot-it/
> >>
> >> Oh, and fuck you scammers.
> >
> > I've had the same scam from Amazon. It all looks real, but when I go to
> > my Amazon account, there's nothing about that charge, so I ignore the
> > scam posts.
> I get a lot of similar scam emails about Paypal on my yahoo! email
> account. I don't even bother opening them, much less log into Paypal.
> Straight into the bit bucket.

I'm just surprised that Paypal pass these through their system. The scammer opens a paypal account, then raises an invoice through Paypal.

Paypal deliver the invoice to the 'mark'. The scammer hopes the note about illegal activity makes people pick up the phone and then they talk the money out of you when you call them.

It's so bloody simple but enabled by Paypal. All they have to do is have 'some intelligent filtering' <fx: waving hands> to look at the note section on invoices for potential scamming phrases.

It's now over five hours since I sent the details to their fraud email team... no response. Not impressed.

On 27/08/2022 04:16 Stephen Packer penned these words:
> It's now over five hours since I sent the details to their fraud email team... no response. Not impressed

I binned my PayPal account several years ago, can't recall all the reason but
sure as heck this gives me another one to not open one again.
--
Ian

"Man will never be free until the last king is strangled with the entrails of
the last priest"

On Saturday, 27 August 2022 at 00:18:06 UTC+1, Boots wrote:
> On 27/08/2022 04:16 Stephen Packer penned these words:
> > It's now over five hours since I sent the details to their fraud email team... no response. Not impressed
> I binned my PayPal account several years ago, can't recall all the reason but
> sure as heck this gives me another one to not open one again.

I only use it to pay with American Express with vendors that don't accept Amex.

And I only use Amex since the card's got the best cashback rate I could find.

Still waiting for a response from their fraud team. I'm comfortable I'm under no threat but
I'd like them to at least tell me the scammer's account has been closed.

On 8/26/2022 6:12 PM, Stephen Packer wrote:
> On Saturday, 27 August 2022 at 00:18:06 UTC+1, Boots wrote:
>> On 27/08/2022 04:16 Stephen Packer penned these words:
>>> It's now over five hours since I sent the details to their fraud email team... no response. Not impressed
>> I binned my PayPal account several years ago, can't recall all the reason but
>> sure as heck this gives me another one to not open one again.
>
> I only use it to pay with American Express with vendors that don't accept Amex.
>
> And I only use Amex since the card's got the best cashback rate I could find.
>
> Still waiting for a response from their fraud team. I'm comfortable I'm under no threat but
> I'd like them to at least tell me the scammer's account has been closed.

Are you certain the scammer didn't just fake an account?

--
The erstwhile Thomas
FJR1300, R1200GS & ST1100 (in memoriam)

On 27/08/2022 03:46, Turby wrote:
> On 8/26/2022 6:12 PM, Stephen Packer wrote:
>> On Saturday, 27 August 2022 at 00:18:06 UTC+1, Boots wrote:
>>> On 27/08/2022 04:16 Stephen Packer penned these words:
>>>> It's now over five hours since I sent the details to their fraud
>>>> email team... no response. Not impressed
>>> I binned my PayPal account several years ago, can't recall all the
>>> reason but
>>> sure as heck this gives me another one to not open one again.
>>
>> I only use it to pay with American Express with vendors that don't
>> accept Amex.
>>
>> And I only use Amex since the card's got the best cashback rate I
>> could find.
>>
>> Still waiting for a response from their fraud team.  I'm comfortable
>> I'm under no threat but
>> I'd like them to at least tell me the scammer's account has been closed.
>
> Are you certain the scammer didn't just fake an account?

It used the Paypal invoicing system so presumably would have had to be a
legitimate Paypal user.

On 27/08/2022 11:08, Mike Fleming wrote:
> On 27/08/2022 03:46, Turby wrote:
>> On 8/26/2022 6:12 PM, Stephen Packer wrote:
>>> On Saturday, 27 August 2022 at 00:18:06 UTC+1, Boots wrote:
>>>> On 27/08/2022 04:16 Stephen Packer penned these words:
>>>>> It's now over five hours since I sent the details to their fraud
>>>>> email team... no response. Not impressed
>>>> I binned my PayPal account several years ago, can't recall all the
>>>> reason but
>>>> sure as heck this gives me another one to not open one again.
>>>
>>> I only use it to pay with American Express with vendors that don't
>>> accept Amex.
>>>
>>> And I only use Amex since the card's got the best cashback rate I
>>> could find.
>>>
>>> Still waiting for a response from their fraud team.  I'm comfortable
>>> I'm under no threat but
>>> I'd like them to at least tell me the scammer's account has been closed.
>>
>> Are you certain the scammer didn't just fake an account?
>
> It used the Paypal invoicing system so presumably would have had to be a
> legitimate Paypal user.

....who has been conned into disclosing their password, or re-used a
password that was compromised from another site or any number of other
alternatives.

The least likely alternative is that the scammer is using an account
that is somehow connected to their real identity.

--
Bruce Horrocks
FJR1300AS

Steve Packer wrote:
> It's very simple and really quite nasty; A user has sent me an invoice
> so it's all very legitimate through Paypal's system. The message is
> just to get me to panic and call the number and once I do that... they
> masquerade as Paypal security and (try to) get my account details
> from me.

It's particularly cruel the way they prey on older folk.

On Sun, 28 Aug 2022 03:04:09 -0700 (PDT), ogden <eldaifo@gmail.com>
wrote:

>Steve Packer wrote:
>> It's very simple and really quite nasty; A user has sent me an invoice
>> so it's all very legitimate through Paypal's system. The message is
>> just to get me to panic and call the number and once I do that... they
>> masquerade as Paypal security and (try to) get my account details
>> from me.
>
>It's particularly cruel the way they prey on older folk.

Heh. Well played, young sir.

--
Ace
http://www.chaletbeauroc.com/

On Sun, 28 Aug 2022 03:04:09 -0700 (PDT), ogden <eldaifo@gmail.com>
wrote:

>Steve Packer wrote:
>> It's very simple and really quite nasty; A user has sent me an invoice
>> so it's all very legitimate through Paypal's system. The message is
>> just to get me to panic and call the number and once I do that... they
>> masquerade as Paypal security and (try to) get my account details
>> from me.
>
>It's particularly cruel the way they prey on older folk.

Well batted.

--

-Pip

On Sunday, 28 August 2022 at 11:04:11 UTC+1, ogden wrote:
> Steve Packer wrote:
> > It's very simple and really quite nasty; A user has sent me an invoice
> > so it's all very legitimate through Paypal's system. The message is
> > just to get me to panic and call the number and once I do that... they
> > masquerade as Paypal security and (try to) get my account details
> > from me.
> It's particularly cruel the way they prey on older folk.

Ouch.

Smile now, in a brief instant it'll be you.

(I'd also point out that they didn't catch me... at least not *this* time)