PayPal invoices abused in a scam campaign with a genuine sender address

An ongoing fraud campaign abuses PayPal's legitimate invoice and money request feature. Because the messages are sent through PayPal's own infrastructure, they pass standard email authentication checks and bypass many security filters. Hackread.com confirmed the activity after receiving an invoice email from service@paypal.com containing clearly fraudulent content. The deception sits in the note-to-customer field, which claims a large charge has been made and lists a support phone number that actually reaches a scam call centre.

What this means for your organisation

This is callback phishing, and it sidesteps the technical controls organisations normally rely on. The sender address, signing and verification badge are genuine, so training that teaches staff to spot a forged sender does not help. Finance functions are particularly exposed, as they routinely handle invoices and payment notices. The FBI has previously warned that trusted platforms are abused in this way.

Berigo recommends

• Make it a standing rule that nobody calls a phone number supplied in an invoice or alert message.
• Establish one known channel for verifying payment demands, regardless of how the demand arrived.
• Include callback phishing in training for finance and procurement staff.
• Make it easy and blame-free to report suspicious invoices internally.

Source

• hackread.com