The ad actually points to a spoofed domain that is yet another attempt to trick a user. Knowing this is common behavior, the attackers have cleverly placed google ads that appear to point to the PayPal website. The attackers in this particular PayPal payment request scam are wise to the fact that users, when facing a suspicious request, perform a quick google search to validate or verify whether or not such a request is a known scam. Contrary to the note, no transaction has actually occurred. For the non-technically minded, users may not actually fully understand that it’s just a payment request as opposed to an actual debit or deduction.
In the note you can see that the attacker is attempting to make it look like an official notice from PayPal complete with a phone number to call (no phishing link).Īccording to the note, all the user needs to do is cancel the request and obviously not send the attacker funds. Below is a screen capture of an actual request sent as part of this PayPal scam. Users that fall for the tactic and call the support number may quickly find themselves a victim of this payment request scam. Importantly, because the note is a feature of PayPal and actually comes from the PayPal notification system with an email address of, it’s technically a legitimate email message but it contains a malicious note.Īttackers are using social engineering to exploit this note feature to trick users into believing their PayPal accounts have been used unlawfully for a purchase, advising them to call a support number to cancel the payment request. When the request is made, the requesting party can add a note in the request which is intended to describe the reason for the payment. PayPal has a feature where anybody can request money from PayPal accounts on the PayPal website. What Does the PayPal Payment Request Scam Look Like? Especially in cases where there is no phishing link included like the payment request scam example detailed in this blog. It’s increasingly concerning both individuals and organizations as it can be difficult to detect. The goal is typically to gain access to confidential information or systems that can be used for fraudulent or malicious purposes. Social engineering is a type of phishing attack that uses psychological manipulation to trick individuals into divulging sensitive information or performing actions that may be against their own interests. While there’s no shortage of PayPal scams going around at any given time, this PayPal payment request scam leverages social engineering tactics without having to rely on a link that could be detected by phishing protection solutions. Phishing Threat Alert: Active PayPal Payment Request Scam
0 kommentar(er)
