Latest Pay Pal phone scam

I haven't seen this posted here yet (apologies if it has been but another alert couldn't hurt).

Here's the scam: You get an email bill from someone via Pay Pal (and yes, it's genuinely from Pay Pal — the scammers open a legit Pay Pal account to be able to send these money requests). If you click the link in the email it goes to a Pay Pal login page — which is a genuine Pay Pal login, thus making the scam seem more legit. For those who are suspicious there is a note on the page: "Fraud Alert: Didn't make this order? Call at [phone number]" Here's the trick: This is a comment that Pay Pal allows the sender to add... but it looks to most users like part of the official Pay Pal login! So if you're suspicious and call the number you get connected to the scammer, who will pretend to be Pay Pal and attempt to get your login information. (Anyone who falls for the email and logs in and pays via Pay Pal just gives the scammer money directly.)
So don't log in OR call the number. Just forward the email to phishing@paypal.com.

Thank you for that excellent information.

BTW: The giveaway for me was the fact that Pay Pal NEVER asks you to phone them and in fact goes to great lengths to hide all their official phone numbers from the public.

Wow!  That's freaking brilliant!

I must admit...as careful as I am with such, they probably still would have got me...unless "Charles" answered with a heavy Indian accent.

If they employ an American-accented soundboard, this will probably get a *lot* of people.

Thanks much for the warning.  I'll share it with everyone I know.

They might have been able to trick you into calling — hell, they almost tricked me into calling until it dawned on me that Pay Pal tries to hide all their phone numbers — but I'm sure someone like you or me would have worked out what was happening as soon as they asked for a username and password ;-) But, yeah, they could still get a lot of people.

I've gotten a few dozen of these emails in the last couple of months. This is an interesting, and important nuance that you describe - that the emails are really from Paypal,  but the "fraud alert with phone number" part is a comment from the scammer. I had been trying to figure out if the emails were really from Paypal or not.  I knew the phone numbers were all bogus, but hadn't thought of the detail that the scammers put that message there. Great info. Thanks!

We've had repeated emails from this scam in less than a month. They show as being from PayPal.com, but Microsoft and Avanan have blocked them. These are what has been received:

11/29/24 7:58am - Reminder: You've still got a money request
11/29/24 1:05pm - Reminder: You've still got a money request
    [THESE TWO were sent to a general "info" email address (#3) of ours - NOT the one used for our PayPal account]

12/02/2024 10:43 AM x 3 - Accept your $795.95 USD from Robin Oggins
12/02/2024 3:00 PM x 3 - Accept your $983.62 USD from Steve Mitchell
12/03/2024 7:56 AM x 3 - This money request has been updated
12/03/2024 8:55 AM x 3 - Reminder: You've still got a money request
12/03/2024 11:41 AM x 3 - This money request has been updated
12/03/2024 3:28 PM x 3 - Reminder: You've still got a money request
12/11/2024 12:39 PM x 1 - Reminder: You've still got a money request - but again sent to the "info" mailbox

12/11/2024 8:57 AM, 8:21 AM & 8:57 AM - Three legitimate messages from PayPal re: auto payments being made.

12/11/2024 9:44 PM x 1 - Invoice from Mac Store (TRX-#ae207) (sent to "info")
12/13/2024 7:57 AM x 1 - You've got a money request (sent to "info")
12/13/2024 8:19 AM x 1 - Invoice from Florida Public Benefit Corporation (TRX-#ec3270) (sent to "info")

> 12/11/24 6:49 AM - Two legitimate messages from PayPal re: auto payments being made.

12/18/2024 7:33 AM - Invoice from Angela Rettmann (0001) (sent to "info")
12/18/2024 7:33 AM - You've got a money request (sent to "info")

> 12/18/2024 11:49 AM & 12:16 PM - Legitimate message: "You authorized a payment to xxx" - sent to main (#1) email address

12/19/2024 7:08 AM - You've got a money request (to email #3)
12/19/2024 8:30 AM - Reminder: You've still got a money request (to email #3)
12/19/2024 10:02 AM - Reminder: You've still got a money request (to email #3)
12/19/2024 10:59 AM - You've got a money request (to email #3)

12/21/2024 1:36 AM - Invoice from Don't recognize the seller? Quickly let us know at  +1(888) 632-2903 (Toll Free). If you don't contact us, this will be  approved. Billing Department (TRX-#7aa3884) (to email #3)

12/21/2024 2:34 AM - Invoice from Don't recognize the seller? Quickly let us know at  +1(888) 632-2903 (Toll Free). If you don't contact us, this will be  approved. Billing Department (TRX-#7aa3886)  (to email #3)

12/23/2024 3:01 PM - Invoice from Don't recognize the seller? Please contact us  immediately at +1 (888) 741-3135 . If you do not reach out, we will  proceed with the transaction. Billing Department (TRX-#7aa4016)  (to email #3)

Per Google search:
    (888) 741-3135 is Anchor Law Firm, Bentonville, AR
    (888) 632-2903 - No results

Thank you Sir Bedevere for the great information you've provided.

Yep. I first identified mine because they came to my general email address rather than the one I use exclusively for PayPal. Your email subject lines are exactly the ones I've been getting.

I've reported all of them to phishing@paypal.com but, shockingly (or not, if you're familiar with PayPal), most of the accounts have NOT been terminated, even though several weeks have passed. Yep, PayPal is letting these scammers continue even after they've been reported.

The old saying "Bros before Hos" comes to mind.

What are the emails that they are being sent to? My users have been receiving these emails, but they are seemingly being sent to generic emails like 'order_status3@fbc.lk'. I've checked in the headers as well as if they are being CC'ed, but I can't seem to find anything regarding emails that our users use.

Are you able to send me the phone number?

Here is the number I received a few minutes ago...  Note from Just World Books LLC:
Fraud Alert: Didn't make this order? Call at 1-855-452-7357

https://800notes.com/Phone.aspx/1-855-452-7357

I got the same request from Just World Books LLC (for $399.99).

I got the same fraud alert message you did as well...but the phone number was different.  Mine was 1-888-341-5602 (https://800notes.com/Phone.aspx/1-888-341-5602)

People who attempt scams like this should spend 20 years in a supermax.  They are total scum and of zero value to society.

CAUTION: I received about three of those scam emails yesterday. I forwarded one to the phishing email above, but when I tried to forward the other 2, they got returned TO ME as SPAM! LOL

Additionally, I went into my account and narrowed down the list of people who could see me to just my contacts, not "everyone."