Recognize fraudulent emails and websites

There are some hints about identifying scam email below, but it’s often difficult to be sure if something is real or fake since scammers adjust their tactics. So, if you have the slightest doubt, send it to our experts for investigation.

“Phishing” is an attempt to steal your information. Criminals pretend to be a legitimate business to get you to disclose sensitive personal information, such as credit card numbers, bank account information, or account passwords.

One of the most common phishing scams involves sending an email that pretends to be from a well-known company. However, it can also be carried out in person, over the phone, via malicious pop-up windows, and "phishing" (fake) websites.

How phishing works

1. A criminal sends emails to people that appear to be from a well-known company. A common tactic involves a made-up story designed to lure you into clicking on a link or calling a phone number.
2. The phishing email may ask you to fill out a form, or click on a link or button that takes you to a fraudulent website.
3. The fraudulent website mimics the company referenced in the email, and aims to trick you into volunteering sensitive, personal data.

In essence, you think you're giving your information to a trusted company when, in fact, you're giving it to a criminal.

Note that phishing emails can also lure you to open suspicious attachments or visit websites that can infect your computer with malicious software or malware.

There are many telltale signs of a fraudulent email:

A false sense of urgency. Many scam emails tell you that your account will be in jeopardy if something critical is not updated right away.

Fake links. These may look real, but they can lead you into trouble. Check where a link is going before you click by hovering over the URL. If it looks suspicious, don't click – learn more about suspicious URL’s reading “How to Spot a Phishing Website”.

Attachments. A real email from PayPal will never include an attachment or software. Attachments can contain malware, so you should never open one unless you are 100% sure it's legitimate.

If you're not sure whether a PayPal email is legitimate or not, here is what you must do: don’t click on any link in the email. Instead, go to PayPal.com and log in. If there is any urgent message for you, you will see it on your profile Notifications.

Here are some examples of fake emails:

You receive an email stating: “Your order #ZK04769 is confirmed for shipment tomorrow. Please click here to review the shipping details.” But you never placed an order, so you click on the link and login to see what it is. Only later do you realize that the link took you to a bogus website.

You receive an email stating: “We have noticed suspicious activity on your account. Please click here to review your recent transactions.” Once again, the link takes you to a page that looks correct but is really a bogus link.

“We would like to offer you a special $50 coupon for being such a good customer. This offer is limited to the first 100 people so click here immediately to claim your reward.” Instead of a reward, you are directed to a fake website where you might give up your account ID and password which the scammers can then use to spend from your account.

Phishing can come through your phone via voice or SMS. Smishing is when a scammer sends an SMS message to your phone number with a bogus phone number or URL. The message is usually urgent like:

“Your PayPal account has been suspended due to suspicious activity. Please contact us immediately at 0123-4567. It is imperative that we speak to you immediately.”

“PayPal: You spent $1,293.17 USD with PayPal . If you did not make this transaction please call us immediately at 0123-4567. Thank You.”

If you call the number, you’re confirming that you have a PayPal account. You'll be talking to a fraudster who will ask for your account information so he can steal from your account.

Similarly, a URL link in a text message on a smartphone could be bogus.

“PayPal: You spent $1,293.17 USD with PayPal. If you did not make this transaction please login at paypal.mobileservice2013.com/txn?id=178948 to revert this transaction. Thank You.”

Fraudsters sometimes use an automated system to make voice calls, reporting urgent account problems and asking for account information. This is called Vishing. Here’s an example of what a vishing call might sound like:

"This is PayPal calling about a possible fraudulent transaction on your account. Please enter your password now to hear the transaction details. We need your immediate response to block this transaction."

When users enter their password, scammers get vital information to access the account. So never provide any account information unless you initiated the phone call.

Caller ID can’t be trusted. Even if the Caller ID says “PayPal,” it’s not enough for you to trust the call. Scammers can easily fake a Caller ID, and it’s impossible to be sure the call is coming from where it says it is.

Sometimes automated calls will ask you to call back. They leave a number or make it simple to click-call from your smartphone. Don’t call these numbers. If you need to contact us, visit the Contact Us link on any PayPal page for the real phone number.

You can’t always tell a website is authentic just by looking at the pages, since it’s very easy for scammers to simply copy the real website’s content. You need to look at the URL to be sure that you are on the real website.

With our site, there are a few indicators that tell you it’s really PayPal. The URL should start with https:// (not http://) and you should see the web security icon – a lock – in the browser address bar.

Some scammers will place a fake browser address bar over the real one to make it look like you're on a legitimate website. But even if a URL contains the word "PayPal," it may not be a PayPal site. If the URL address looks overly complex, it is quite possibly a phishing website.

Here’s a few examples of fake PayPal addresses:

• secure-paypal.com
• fraud.hmmmm.com/reroute?dst=www.paypal.com+dxz=hj7880

There are plenty of clever scam attempts, and new ones are being created all the time. So despite your best intentions, it could still happen. If you think you may have fallen for a scam, here are some steps to protect yourself:

1. Change your account password and security questions immediately. Do this for your PayPal account, email account, and other online accounts.
2. Run an anti-virus scan on your system to make sure that you didn’t pick up a virus. Make sure that your system and anti-virus software are up to date.
3. Check your online account statement vigilantly over the next few weeks (and months) for unexpected actions.

Be cautious when communicating with others through direct messaging as scammers may attempt to trick you into providing personal information. PayPal users should never share sensitive personal or financial information, for example:

1. Bank Account Numbers or IBAN, including last four digits
2. Passwords/PINs
3. Social Security Number or Tax ID Number
4. Government Issued ID information, for example: Passport, Driver’s License, Military ID, or National ID Numbers
5. Credit Card Number and CVV/CVV2/PINs
6. Credit Data or Credit Score
7. Account Balance, Credit Balance of any PayPal account or service
8. Home address, date of birth, or personal family information