<removed> is a scam.

[TheGreen]

So whether emails with links to epl.paypal-communication.com are a scam or official emails has been asked several times but no good answer has been forth coming other than a "Maybe??" from Paypal itself.

I received an email from 'Paypal' recently about their 'Return Shipping on Us'. The subject of the email said that "Return Shipping on Us is active."

It looks to have come from a real Paypal email (see <removed>  for more detail than I can muster.

It used my full name.

It generally followed the standard Paypal email structure.

The English grammar was good.

But:

I never activated return shipping. Though I did look at it a while back.

The picture portion of the email looked just slightly fuzzy, like it was a lower resolution copy of an original.

All the links went through variations of: epl.paypal-communication.com/

When I went to Paypal directly, without clicking on any links, it told me there had been 'suspicious' activity and I needed to change my password.

And most damming of all the email included: "With PayPal, some of your recent purchases below may be covered with Return Shipping on Us*." and then listed 3 purchases, from more than a year ago. Problem. I NEVER MADE THOSE PURCHASES! The transactions are NOT listed on my account, I NEVER purchased anything from the listed sellers, ever (Toys-R-Us, Sephora USA Inc, and Macy's) and the purchase amounts are suspiciously in whole dollars ($15.00, $25.00, $20.00).

So with the above information we can say either Paypal is glitching out something fierce or this IS a scam.

[Attweller]

Received this legit looking email addressed to my full name.
It is a scam, but a really well made phishing attempt. Be very, very careful what you click on...

Edit: Paypal blocked my explanatory image. Let's see if this one passes their censor.

[PayPal_Martin]

Hi Attweller, 

Welcome to our Community!

Well spotted! This is a phishing email, but a very good attempt. You will find more information on such emails here.  Please be mindful you email address and full name would seem to be known by the sender, so what out for other phishing attempts from other companies you might use. 

Thanks

Martin

[ArtekAU]

This is actually worse than that. The emails are correctly signed by PayPal - DKIM, DMARC and SPF are correct. Which points to one of few possibilities.

1, Paypal mail servers were hacked and used to send this out

2, Paypal DNS management has been hacked and the records were updated to cover the IP the mail is sent out of

3, Paypals Mail security suite has been hacked

Either way, this is pretty bad as the email headers look like they have come from Paypal directly.

M.

[secruza]

I got exactly the same email today with my name and last name! 

Due to safety and security requirements, and for the benefit of all users on the network, we need you to verify your identity. This will help to avoid any interruption or limitation on your PayPal account.

Simply click here to log into your PayPal account and click on the notification icon. You’ll be asked to confirm some basic details and it should only take a few minutes.

Once you’re done, you can continue using your PayPal account.

Thank you for shopping with PayPal.

[joespagg]

Today I got an email from telling me my paypal monthly statement was ready to view. It had embedded links to epl.paypal-communication.com.

I opened a new tab and went to paypal.com using a bookmark. I did find that my June account statement was ready. I know there have been debates about the legitimacy of epl.paypal-communication.com. I still cannot say if this is legitimate or not; I have never gotten emails from paypal notifying me that a monthly statement was ready and I've been on PayPal for years. When I'm logged into paypal, there are no notifications or messages regarding statement availability. And I thought it odd that ALL the links in the email started with epl.paypal-communication.com including social media links and app store links.

[ikniet]

If you go to security ->permissions in your paypal account "topup" is called a third party and you can turn it off

[Temp20210929g]

After I bought something on PayPal that came from India my email account was comprised, now I ignore all emails there's so many phishing attempts. Use messages on PayPal/eBay site