Billing Department of PayPal updated your invoice

[LE2022]

Since I've posed this question twice to PayPal and haven't gotten a response that makes any sense, I thought I'd ask here—has anyone else received an email with the subject line "Billing Department of PayPal updated your invoice" in recent weeks? I knew it was a scam when I saw it—I don't issue any invoices through PayPal—but I was a bit alarmed that the address the email was sent from appears to be legit. 

I asked PayPal customer service representatives how the message could have come from an address comprised of the [removed] (the system isn't letting me post the actual email address), and if they were at all concerned about that, but the person I spoke with on the phone just kept repeating a broad definition of what phishing scams are (which was not helpful). I also received a message from PayPal that did not explain how someone was able to send a phishing email from a seemingly legitimate PayPal email address. I was wondering if anyone else got a similar email from that address—or if anyone has any idea how that would be possible without having access to PayPal's system? (Because if that's how the message was sent, PayPal should probably be looking into how it happened ...?)

[kernowlass]

@LE2022 

Email spoofing.

[LE2022]

Sure, it clearly is a phishing attempt--my concern is how did someone send out an email message from a legitimate PayPal email address? It came from the same email address all my other notification emails from PayPal have been sent from (PayPal unfortunately won't allow email addresses to be included in posts, so I can't type it here, but it was service at PayPal dot com.) I just got another phishing email from the same address today! 

[kernowlass]

@LE2022 

Because they spoofed the email address to make it look like that !!!

[LE2022]

What I found particularly odd about this phishing attempt is the same legit PayPal email address I mentioned in my last post is also listed when my cursor hovers over the address that appears on the message in my inbox-- you don't see a completely different email address, as in a number of phishing scams -- and I can't find any code that would covertly direct the reply to another email address in the page source info. I appreciate you taking the time to respond—and I get what you're saying—maybe there's a way scammers can send out a phishing email that passes the hover test with code I'm not aware of, but I would think PayPal would be notifying its users someone is sending out messages from service at PayPal dot com that look that legit? I didn't hear anything about it until I contacted them, which I thought was odd.

[RMayB]

I received email with similar type of information.  Actually, called the number in the email and they texted me a confirmation code which appeared to be from a PayPal text number (at least it went into same text messaging list as other PayPal responses).  Can provide the weblink it was sent to PayPak security if they ever call me back.  Apparently, there is a 2 hour wait list for call back right now!  Anyway, the person I spoke when I called the number in email, proceeded to try to convince me that someone(s) had opened a loan account with my PayPal and charged over $10,000 at 4 different locations to the account.  They then proceeded to tell me that they could suspend the account for an hour, but I would have to go to a location and follow a procedure to get the 4 charges cancelled from my account.   I went along with this and, when I got to the local CVS they sent me to, they said I needed to purchase Google Play Cards, at $100 each, and give them the encryption codes to try to cancel out the 4 fraudulent charges!  They made a point of saying not to tell anyone why I was buying them or that it was related to a PayPal account problem!  

[bodhimind]

Email spoofing really sucks but is just part of the technology.

I get these invoices every few days... PayPal should have a "Is Phising?" link and process to report these things to them and complete disable the original accounts (whether they are sandbox or production). Large companies tend to not be the leaders in innovation and improvement.

Anyway, they are fairly easy to recognize because after you open the invoice their fake email is revealed.

Which, again, PayPal should be collecting reports to permanently block.

[LE2022]

I so agree, bodhimind! PayPal doesn't seem at all concerned about the fact these emails have clearly been sent to numerous users for weeks, if not months. We shouldn't have to click on potentially compromising elements in a message to determine something is fake, and this issue seems widespread enough that PayPal really should have issued some sort of warning about it by now. The fairly generic reply at the bottom of this message chain from a PayPal moderator doesn't seem to indicate the company is taking any action to prevent these messages from going out, which is disappointing. 

[Chingizyaka]

I have the same issue, received an email from the official Service PayPal email address

here is a screenshot of the message,

 it contains official scripts and links from PayPal, the phone number has been compromised, I called when I heard some dude with Indian accent, I immediately realized it`s a scam.  Tried to contact PayPal security department and waited on the phone for an hour nobody responded. Terrible experience. They must do something about it because it looks legit, and people can get hurt. 

[removed]

[PayPal_Bindu]

Hey @ Chingizyaka,

Welcome to our community page and thank you for your post!

I can see how receiving that email would be concerning to you. If you receive any email about activity on a PayPal account, the safest way to confirm the email’s validity is to log in to a PayPal account via the PayPal website (not using the links in the email received). Any of the activity reported in the email will be available to view. Please forward any suspicious emails to phishing@paypal.com. We continuously work to disable fake or “spoof” communication including emails, websites, and text messages.

If you happen to click any links in the email, please make sure to update the password and security questions, report any unauthorized activity to us in the resolution center of your PayPal account. You can view the detailed information on reporting unauthorized activity here.

Also, please view this web page for more information on phishing emails: How do I spot and report a fake, fraudulent, or phishing PayPal email or website

I hope this information helps!

Bindu