Beware - that PayPal email could be a wallet-draining scam

A laptop showing lots of email notifications
(Image credit: Shutterstock)

For cybercriminals engaged in phishing, the key question is - how do they get the malicious email past the email security measures? After all, most email service providers are good at spotting, and blocking, spam and phishing emails. 

Cybersecurity researchers from Avanan have now uncovered that some hackers have gotten quite creative, using payment service providers such as PayPal to distribute phishing emails via fake invoices.

What they’ll do is create a phony PayPal account, and impersonate a major brand. Creating a PayPal account is quick, easy, and most importantly - free. Then, they’d send malicious invoices and requests for payment directly from the service. 

Calling the scammers

Given the (legitimate) nature of PayPal, email service providers can do nothing else but let the email through.

The invoice will look legit. It will have the brand logo, proper wording, but also - a phone number for the victim to call. 

Unless they ignore the invoice altogether, there are two things the victims can do: either pay the invoice, or call the listed phone number. Avanan calls this attack a “double spear”, as in some cases, not only will the hackers have the victim’s email, but also their phone number, which can later be used for new attacks. 

Less than two weeks ago, the researchers notified PayPal of the campaign. The payment service provider is yet silent on the matter, so how they decide to tackle the problem, remains to be seen. 

The researchers suggest everyone that, before calling an unfamiliar service, run a Google search on the number listed with the invoice and check the accounts to see if there were any charges. They should also implement advanced security on their endpoints, that looks at more than one indicator, to determine whether the email is malicious or not, and encourage users to ask their IT support, if they’re not sure about an email’s good intentions.

  • Keep your internet traffic to yourself with the best firewalls right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
PayPal
This PayPal scam exploits new address feature to send out phishing scam emails
Paper craft illustration of a suspicious email that contains a snake
How to spot a phishing email
Fraude en ligne phishing
Google forced to step up phishing defenses following ‘most sophisticated attack’ it has ever seen
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
Everything you need to know about phishing
An iPhone sitting on a wooden table
Millions at risk as malicious PDF files designed to steal your data are flooding SMS inboxes - how to stay safe
Hacker Typing
This devious two-step phishing campaign uses Microsoft tools to bypass email security
Latest in Security
NordProtect logo
Standalone identity theft protection from Nord Security is now available
A man holds a smartphone iPhone screen showing various social media apps including YouTube, TikTok, Facebook, Threads, Instagram and X
Ofcom cracks down on UK tech firms, will issue sanctions for illegal content
3d rendering of a submarine power cable on the seabed
Subsea internet cables can now ‘listen’ for sabotage using irregular pulses of light
A graphic showing someone on a tablet working through a supply chain.
Security issue in open source software leaves businesses concerned for systems
ransomware avast
One of the most powerful ransomware hacks around has been cracked using some serious GPU power
person at a computer
Infamous ransomware hackers reveal new tool to brute-force VPNs
Latest in News
A woman sitting in a chair looking at a Windows 11 laptop
Microsoft is supercharging Windows 11’s voice commands on Copilot+ PCs with Snapdragon CPUs, and fine-tuning a few Recall features
The Future Games Show Spring Showcase
The Future Games Show returns this week for its Spring Showcase, here's how to watch and what games to expect
NordProtect logo
Standalone identity theft protection from Nord Security is now available
A man holds a smartphone iPhone screen showing various social media apps including YouTube, TikTok, Facebook, Threads, Instagram and X
Ofcom cracks down on UK tech firms, will issue sanctions for illegal content
Apple iPhone 16 Plus Review
Apple expert just tipped a load of iPhone 17 upgrades: here are 7 things we’ve learned
Google Chromecast 2
Google rolls out another Chromecast bug fix for users who factory-reset their devices