Email with Fake, Fraudulent Invoice - Where do I report this?

[JimDavies1]

I have received an invoice for $399 from "If this Charge is not for your Subs-cription Quickly inform us a[Removed. Phone #s not permitted](0577)" with the email customer10 at care1.natashamui.shop . Nothing about it looks in any way ok, and I knew immediately that it was fraudulent. Obviously, I have not paid it.

I cannot find anywhere to report this. If I paid it, I could dispute it, but otherwise I can't, and it doesn't come up under activity as I have not paid it. It's not Phishing, because the email that I received is actually coming through PayPal, so if I report it as phishing, I'm basically reporting PayPal to PayPal.

I am going to guess that I am not the only person to have received an invoice from whoever is sending these, so reporting it must be a good thing to do. I know less savvy people who might get caught out by this.

Also, I don't think that the argument that people have to wise up as there nothing PayPal can do about scams such as these really holds much water in a case like this, where everything about it screams fraud. But don't take my word for it, as PayPal have slapped a banner at the top of the invoice saying, "This invoice has been reported as a possible scam".

Anyhow, where do I report it?

[Buffalo3Bob]

I got a few over the last day also - from (listed under to:)  supportteam1 at zarascott.shop and Billingdepartments1 at 

cfpminmaculadasantanderne.onmicrosoft.com [I have to spell out at and separate the two parts for this to go through.]

Per the PayPal page:  How do I spot a fake, fraudulent, or phishing PayPal email or website? | PayPal US  aka:  https://www.paypal.com/us/cshelp/article/how-do-i-spot-a-fake-fraudulent-or-phishing-paypal-email-or...

I forwarded the emails to phishing at paypay.com

But, only two went through.  Then the forwarded emails began to 'bounce' as undeliverable by Outlook.

After further searching, I found:

How do I cancel or report a suspicious money request or invoice? | PayPal US

aka:  https://www.paypal.com/us/cshelp/article/how-do-i-cancel-or-report-a-suspicious-money-request-or-inv...

But this only applies to a fake invoice that shows up on your PayPal page.

Another place to report fake emails seems to be:  

spoof at paypal.com

I tried forwarding fake emails to this, but that also came back as undeliverable.

Best I have for now,

Good luck,

Paul

[PayPal_Shradha]

Hello @JimDavies1,

Thank you for your post and welcome to the community!  Thank you @Buffalo3Bob for providing the details in this thread.

We are sorry to hear that you have received a fake invoice in your email. What you describe receiving is a common ploy that fraudsters use to trick people using email. Kindly avoid clicking any link and do not open or download attached documents in email. Kindly do not call or message on the contact number mentioned in an email. If you have received an email mentioning contact PayPal support team, always reach out to us by logging in to your PayPal account and contact our customer support.

Also, If you receive a suspicious email that is related to PayPal, then always check your resolution centre by log in to your PayPal account. If you didn't find any related details in the resolution centre means it's a fraud. Here's a great Help Center article on How to spot fake, fraudulent, or phishing PayPal emails or websites and What are common scams and how do I spot them?

We request you to refer the article How do I report potential fraud, spoof or unauthorized transactions to PayPal? to know the type or fraud and how to report for the fraud.

Hope this helps you!

Warm Regards,
Shradha

[Peje]

I too had 3 such emails within about 3 hours yesterday, with mine having the same email, but with 'Customer5', rather than 10 ?

I contacted Paypal, but sadly, the instructions by the AI Advisor, did not work, and I was told to forward the emails to 'phishing@paypal.com', and that I would be contacted in about an hour ?
Today ? I am still awaiting any contact about the 3 emails I forwarded, and Nothing from my request today to actually speak to a Human !!

[hoverin]

I'm also receiving these bogus Money Request emails from PayPal.  The email messages pass spam filtering it seems because they do seem to be coming from PayPal based on Domain Key validation.  So I can't just block the sender, as I'd likely end up marking marking legitimate "service at PayPal dot com" (not permitted to include the actual address in this post) email messages as spam.

One thing I've also noticed is that the recipient of the email is always an unrelated onmicrosoft.com email address: e.g. "some-unrelated-name at ykbzXXX.onmicrosoft.com"

So it appears to me that we have a problem where scammers are signing up for PayPal accounts, or taking over existing accounts, and are then using PayPal to send out bogus requests for payment to an onmicrosoft.com email address that they've somehow pre-configured to route to my personal email address.  

I've not figured out why they'd go to this trouble instead of directing it to my personal email,  but perhaps it means PayPal are unable to detect/see that the request is being sent to an existing PayPal user/account, and so treat it differently (just use email, don't try to record/route the request to my actual PayPal account?)

It is super annoying, and I wonder how many less savvy/scam aware people are falling for it.  This is something my in-laws/parents would definitely think was real because the email is actually being sent FROM paypal.com (it passes the DK checks, etc.).

I think PayPal need to check to see which account holders have been directing Payment Requests to onmicrosoft.com domain recipients, and flag them as potential account take over, or malicious, accounts for investigation.

My only course of action right now is to set up a mail rule that marks any email where onmicrosoft.com is in the To line as spam.  This seems to be working for me, but most people who are receiving these cold requests for payment from PayPal.com won't realize they are not bogus.

Actually, overall, I think PayPal should take a closer look at how to better police/govern an account users ability to send out requests for payment via email (or SMS if that's an option).  It seems to me it has a lot of potential for misuse.

[hoverin]

One other observation is that they seem to want you to call their scam numbers as a reaction to receiving these requests.  They include a note with the payment request:

e.g.

"..If you do not reach out, we will proceed with the transaction" (oh no!!!)

e.g.

"Note from Partyka & Sons Farms, LLC:

Don’t recognize the seller? Please contact us immediately at [Removed. Phone #s not permitted in a post] If you do not reach out, we will proceed with the transaction."

Typical scammer approach of making a recipient think it's urgent/high stakes.

So that is likely the ultimate goal... to get you on the line with a scammer who'll then try to get your PayPal login username/password, or some other form of off platform payment / banking details