Examples of Suspected Fraud or Fake Emails

[PayPal_Andy]

Hey Everybody!

In an effort to make things easier to find and research, I'm going to consolidate as many threads as possible where we have examples of people trying to defraud hard working sellers (Craigslist emails, 'PayPal' emails asking you to send money outside of PayPal, etc).  This will also be used as a master thread for future posts regarding this same situation.

When you post your examples here, please remember to not include last names or contact information of whoever is sending these emails.  There's no way to confirm if that person has been defrauded as well and the name is being used fraudulently.

Thanks for your cooperation and remember, keep the conversation productive, on task, and above all, keep it clean. I know these things can be difficult and frustrating, but bleep filled posts or posts that look like government redacted files will never benefit anyone. 😄

Andy

[kernowlass]

@jamesventura

If its a spoof, DO NOT USE ANY LINK.

Firstly if the email addressed you as ''Dear Member'' / ''Customer'' / ''Client'' OR your ''email address'' then that confirms its a spoof as paypal would address you by your full name eg Dear John Smith.

Secondly if there was a link OR attachment in that email to ''cancel'' the transaction or ''confirm'' any details then again it would be a spoof.

If there was a problem with your account paypal would not ask you to click on an unsafe link in an email or by downloading an attachment, they would direct you to log in normally and go to the resolution or the message centre for more information.

More info here >>
https://www.paypal.com/us/selfhelp/article/how-to-spot-fake-emails-faq2340/2

[Snow-Cat]

* Forward the entire email to:    spoof@paypal.com.
* Do not alter the subject line or forward the message as an attachment.
* Delete the suspicious email from your inbox.
* Never click on any links within the email or open any attachments.

Look at the email address domain and wording in the email, grammar, salutation, spelling, etc.  If any of these are questionable, it's most likely a spoof.

[Ifitfitz]

I received an email from what looks like it’s legit. It’s from paypal UK  for a payment to Uber BV In the amount of £19.00. I’m in Florida, never been to any other country. It’s not taken out of my account, so I’m  hoping this is a scam.  

[kernowlass]

@Ifitfitz

If its a spoof, DO NOT USE ANY LINK.

Firstly if the email addressed you as ''Dear Member'' / ''Customer'' / ''Client'' OR your ''email address'' then that confirms its a spoof as paypal would address you by your full name eg Dear John Smith.

Secondly if there was a link OR attachment in that email to ''cancel'' the transaction or ''confirm'' any details then again it would be a spoof.

If there was a problem with your account paypal would not ask you to click on an unsafe link in an email or by downloading an attachment, they would direct you to log in normally and go to the resolution or the message centre for more information.

More info here >>
https://www.paypal.com/us/selfhelp/article/how-to-spot-fake-emails-faq2340/2

[Ifitfitz]

Thank you so much!!!

[Joeyspot]

Transaction ID: O-3YV15593N2595560W

Hello  Email adress

You submitted an order in the amount of $400.78 USD to HOTELS.COM USA.

Thanks for using PayPal. Please note that this is not a charge. Your account will be charged when the merchant processes your payment. You may receive multiple emails as the merchant processes your order. Your funds will be transferred when the merchant processes your payment. Any money in your PayPal account at that time will be used before any other payment source. If the payment was not authorized by you login here and cancel the payment in order to get full refund.  To see the full transaction details, log in to your PayPal account.

Merchant HOTELS.COM USA **removed**	Instructions to merchant You haven't entered any instructions.

Description	Unit price	Qty	Amount
Checkout Total	$400.78 USD	1	$400.78 USD

Subtotal	$400.78 USD
Payment sent to

nvoice ID: 0C36732D-DC21-417A-9022-832413CA3346

[kernowlass]

@Joeyspot

Its a spoof, DO NOT USE ANY LINK.

Firstly if the email addressed you as ''Dear Member'' / ''Customer'' / ''Client'' OR your ''email address'' then that confirms its a spoof as paypal would address you by your full name eg Dear John Smith.

Secondly if there was a link OR attachment in that email to ''cancel'' the transaction or ''confirm'' any details then again it would be a spoof.

If there was a problem with your account paypal would not ask you to click on an unsafe link in an email or by downloading an attachment, they would direct you to log in normally and go to the resolution or the message centre for more information.

More info here >>
https://www.paypal.com/us/selfhelp/article/how-to-spot-fake-emails-faq2340/2

[Rammis]

I received an e-mail today Subject:  "Account Notification"

Stating I needed to fill out the attached form to update my "Out-dated" security information.   

From: paypal support  @ a special address

Some unsuspecting customer will Open the attachment & be "Toast".

Beware!!

Rammis

[Snow-Cat]

* Forward the entire email to:    spoof@paypal.com.
* Do not alter the subject line or forward the message as an attachment.
* Delete the suspicious email from your inbox.
* Never click on any links within the email or open any attachments.

Look at the email address domain and wording in the email, grammar, salutation, spelling, etc.  If any of these are questionable, it's most likely a spoof.

[TBVOE]

This appeared in my company email with plausible-looking PayPal formatting to the message. Thing is I've never heard of or done business with anyone like this:

The return email was  <removed> - a totally unfamiliar doctor's office.

Text was "EOS CCA Debt collection services sent you this bill for $2,329.00 USD". 

Checked my account (by logging in independently) and thank God see nothing in transactions about this, but it's still somewhat nerve-racking! Thought I'd pass this on so if others see it they won't be as surprised. Thanks!