A recent phishing email, disguised as a legitimate PayPal money request, claimed that a payment of $299 had been approved and deducted from the recipient’s account. Although the message came from an authentic PayPal address, it was a scam designed to trick recipients into calling a fake support number and sharing personal or financial information. Here are some key points to look out for and become aware of what makes this glaringly a phishing attempt.

1. This message does come from a legitimate PayPal address, which is what makes it so convincing. However, look closely at the “To:” line: the email is addressed to “new_batch70@estate-billing.info,” not the intended recipient’s personal email. This suggests the scammer sent the same money request to hundreds of people at once, likely by adding a large batch of addresses as BCC recipients.

2. Scammers are abusing PayPal’s “money request” feature, a real service that allows users to send payment requests to any email address, to send out fraudulent messages that can slip past spam filters.

3. There are several obvious grammatical errors that showcase someone either deliberate by trying to bypass spam filters or someone copy pasting things without looking over exactly what they’re pasting. Some of the errors are random capitalization (“ꜰᴏʀ ᴀɴʏ ɪɴQᴜɪʀɪᴇꜱ”), Unusual character substitutions (zeros replaced with O’s in “+1 (4O2)-937-OOO2”), and Awkward phrasing like “Payment Deducted”.

The main objective isn’t exactly to make you click “Pay Now”, it’s more to get you to call the fake support number. Once on the phone, the attacker may try to trick you into sending more money, attempt to make you install malicious “security” software, and/or just exploit the target in anyway they can for personal gain.