Quick Summary
In December 2025, a PayPal email scam emerged that utilized genuine PayPal infrastructure to send fraudulent notifications. Scammers abused the ‘Subscriptions’ feature to trigger real emails, which included fake purchase details and a deceptive phone number for a callback scam. This incident highlights the risks of email spoofing and the importance of strong email authentication measures like SPF, DKIM, and DMARC to protect against such attacks.
The Securityish Brief
In December 2025, a sophisticated PayPal email scam was discovered, which involved attackers exploiting PayPal’s legitimate email infrastructure to send fraudulent notifications. The scammers manipulated PayPal’s ‘Subscriptions’ feature to create a subscription and then paused it, triggering a real notification email stating, ‘Your automatic payment is no longer active.’ This email contained a fake purchase confirmation and a phone number designed to lure recipients into a callback scam.
The attackers used a fake subscriber account, likely a Google Workspace mailing list, to automatically forward incoming messages to group members. The fraudulent emails included Unicode characters to make parts of the text visually unusual, helping them evade spam filters. The ultimate goal was not to steal PayPal passwords but to induce panic, leading victims to call the provided number and follow instructions that could result in financial fraud or malware installation.
PayPal responded to the situation by closing the loophole that allowed these scams to occur, emphasizing the need for vigilance against unexpected messages. This incident serves as a reminder that attackers will continue to exploit trusted channels and human urgency. Organizations must not only rely on brand recognition but also ensure their domains cannot be impersonated.
Why Strong Email Authentication Matters
Implementing strong email authentication protocols like SPF, DKIM, and DMARC is crucial for organizations to mitigate the risk of email spoofing. DMARC, in particular, allows mailbox providers to take action when an email fails authentication checks, significantly reducing the likelihood of spoofed emails reaching users. Properly enforced DMARC policies can help protect brand reputation and prevent impersonation attempts.
As this incident illustrates, organizations should regularly monitor their email authentication settings and ensure they are correctly configured. By validating sending sources and enforcing DMARC policies, businesses can better protect themselves and their customers from falling victim to similar scams in the future.
Key Takeaways
- Do not call phone numbers or click links in unexpected PayPal emails.
- Log in to your PayPal account directly to verify any transactions.
- Forward suspicious emails to PayPal’s official support and delete them.
- If you manage an organization, inform your team about this scam to prevent follow-up actions.
- Implement SPF, DKIM, and DMARC to protect your domain from spoofing.
Key Terms & Concepts
- SPF: Sender Policy Framework (SPF) is an email authentication method that helps prevent spoofing by verifying sender IP addresses.
- DKIM: DomainKeys Identified Mail (DKIM) is an email authentication technique that allows the receiver to check that an email was indeed sent and authorized by the owner of that domain.
- DMARC: Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol that helps protect domains from being used in email spoofing.
Read the original article here: https://securityboulevard.com/2026/01/paypal-email-scam-how-it-worked-before-the-fix/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
