At first glance, the email looks legitimate — and that’s exactly why cybersecurity experts say this scheme is so dangerous.
Criminals are now exploiting PayPal’s real email system to target unsuspecting users. The scheme works by sending tiny payments — sometimes as little as one cent — to random PayPal accounts. That action automatically triggers an official email from PayPal, making the message appear authentic.
Recommended Videos
But inside the payment note, fraudsters often include alarming claims, such as a large unauthorized purchase or a warning that the account has been compromised. The message then urges recipients to call a customer service number for help.
The catch: the phone number does not belong to PayPal.
Instead, victims are connected directly to criminals who attempt to steal passwords, banking information, or even gain remote access to computers.
Experts say the scheme is effective because it creates panic and pressures people to act quickly before verifying the information.
“If you receive something unexpected, never respond directly to the incoming message,” said Professor Ryan Marquez with the University of Houston Law Center. “Always initiate contact yourself by going directly to the company’s website or using the number on the back of your card. And never allow someone on the phone to guide you through logins or take remote control of your computer.”
Security experts recommend taking several steps to protect yourself:
- Never click links or call phone numbers included in suspicious emails
- Open your browser and log in to PayPal directly to verify account activity
- Enable two-factor authentication
- Use strong, unique passwords
- Regularly monitor financial accounts for unusual activity
If you believe you may have interacted with criminals, experts advise immediately changing your passwords, contacting PayPal and your bank directly, and monitoring for signs of identity theft.
They also recommend considering a credit freeze if sensitive personal information may have been exposed.
Experts say the best defense is simple: don’t click, don’t call, and always verify first.