PayPal or not PayPal? That is the question...

A scam pretending to be a PayPal alert is making the rounds. The email claims "you just bought a new MacBook that's being sent to a new address on your account". If you're aware of what you spend on PayPal, you will know you didn't splurge on a MacBook, and a quick login will show you that no strange addresses have been added.

The trick isn’t really in the email itself. It’s in the part that tells you to call a number if you didn’t make the change. When you call, you get stuck in a “PayPal support” queue, and eventually someone guides you through downloading some software to supposedly help protect your account. In reality, this software lets the scammer take remote control of your computer and sneak a peek at your personal and bank details.

If it wasn’t clear already, this alert is a fake. Don’t call the number, and definitely don’t download anything from an unknown source.

For those curious about how this scam works: the email headers show that it actually does come from PayPal’s servers  In the text of the email, the scammers use phrases that are exactly the same as those Paypal would use.  eg. "If you want to link your credit card to this address, or make it your primary address, log in to your PayPal account and go to your Profile," and "Since this address is a gift address, you can send packages to it with just a click.". This makes the scam email look very real indeed.

The scammers actually do this:  They log into their own "throwaway" PayPal account, and add a new address, stuffing the address lines of the new address with details about the MacBook purchase and then the remaining address lines with the fake address they are claiming to be adding.

So, how do they reach so many potential victims? Their trick is simple: the email linked to their PayPal account forwards messages to a huge Microsoft 365 mailing list, spreading the scam far and wide.  You receive the email as if it came from Paypal, and end up calling the support line, downloading the software and ... the scam works!

In the end, if something in your email raises even a slight eyebrow, it’s worth taking a moment to verify it directly by logging into your account. Remember, if it sounds too good — or too alarming — to be true, it probably is.  Stay alert, don’t click on suspicious links or download unknown software, and keep your digital guard up.  After all, it’s always better to be safe than to let these scammers pull the wool over your eyes.