A particularly insidious form of email fraud is underway, with scammers exploiting a normal PayPal to send genuine emails from the address service@paypal.com, but containing deceptive content. The practice has raised concerns, as the messages successfully pass security filters and appear completely trustworthy to the end recipient.
What do misleading messages contain?
Over the past two months, several users have reported receiving emails with the subject line "Your automatic payment is no longer active." So far, the message seems harmless. The problem is in the Customer service URL field, which has been altered to display a purported confirmation of the purchase of expensive devices, such as an iPhone, MacBook, or Sony products.
In the same field, text appears stating that a payment of $1,300 to $1,600 has been completed, along with a phone number to “cancel” or “dispute” the charge. The scammers use Unicode characters and unusual fontsto help the message evade spam and keyword detection mechanisms.
See also: New AiTM attack campaign targets Microsoft 365 and Okta users
Why the emails look perfectly legitimate
The most worrying thing is that the messages are actually sent from PayPal servers and pass all authentication checks (SPF, DKIM). This means that this is not sender spoofing, but an internal functionality of the platform's. As a result, even experienced users have difficulty understanding that this is a scam and fear that their account has been compromised.
The real goal of the fraud
The purpose of the emails is purely psychological: to shock the recipient with a supposedly expensive purchase and push them to call the “PayPal support” number listed. On the other end of the line are scammers, who attempt to either extract banking information or convince the victim to install malware on their computer.
How to use PayPal's "Subscriptions" feature
The investigation revealed that the perpetrators are using the PayPal Subscriptions, which allows merchants to charge recurring payments. When a subscription is paused, PayPal automatically sends a notification email to the subscriber that the automatic payment is no longer active.
See also: BlackForce: New phishing kit steals credentials through MitB attacks
The scammers appear to be exploiting either a metadata handling or older APIsthat allow invalid text to be stored in the Customer service URL field, allowing them to embed the fake purchase message there without the system rejecting it.
How emails reach victims
According to the technical details, PayPal first sends the email to an address controlled by the fraudster, which acts as a mailing list (e.g. via Google Workspace). The message is then automatically forwarded to dozens or hundreds of target recipients. The forwarding distorts the DMARC checks, but the original validity of the email remains.
What users should do
If you receive an email from PayPal stating that automatic payment has been disabled and includes a purchase confirmation that you don't recognize, don't call any number. Log in directly to your account through the official app or website and check your transactions .
See also: CyberVolk's new VolkLocker ransomware targets Linux and Windows
PayPal has said it is actively working to curb this type of fraud and reminds users to remain wary of unexpected messages. In a digital world where even legitimate emails can be weaponized, vigilance remains the best defense.
Source: www.bleepingcomputer.com
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
