“August forecast: 90% chanceof sunshine, 100% chance of spam.”
Happy August,
July was hard on me. There were several crisis involving domain names and email flow and email scams. So August is going to be a review of what to watch for and how to handle it when it shows up in your inbox. And yes, Virginia, there is a Santa Clause, and the spammers will spam you.
Without reading ahead, figure out what is wrong with this email. How many red flags can you find? Report back with how you did.
Answers:
Mismatched sender— It claims to be “PayPal Support” but was actuallysent fromig1264@susd12.org (looks like a school district email address), not any paypal.com domain.
Mass BCC blast— It was sent to hundreds of unrelated recipients at once (visible in the To:field), which real PayPal fraud alerts never do — those are personalized, individual account notices.
Fake subject— The file is named/subjected “Meeting confirmation,” but the body is entirely about a supposed PayPal fraud alert. That mismatch is a classic tactic to get a suspicious-looking email past spam filters or a distracted recipient.
Urgency + fear tactic— “Fraud prevention system,” a specific dollar amount, and a call to action (“Call PayPal Support as soon as possible”) are designed to pressure you into acting quickly without thinking.
Phone number instead of a link— Legitimate PayPal security notices direct you to log in via the official app or website, not call an unfamiliar phone number. That number is very likely a scam call center designed to extract your account credentials or payment info over the phone (a “vishing” — voice phishing — scam).
Generic greeting— “Dear Valued Customer” instead of your actual name, which real PayPal correspondence uses.
What to do:
Don’t call the number or click anything in the email.
Delete it, or report it as phishing (Outlook/Gmail have a “Report phishing”option).
If you’re worried about your actual PayPal account, go directly to paypal.com yourself (not through this email) or open the official app to check your activity.
Please, Please be careful! Cleaning up and recovering from these attacks is not fast, it is not easy, and definitely is not fun. And I want work to be fun again. Let’s finish the summer safe! And report back, how many flags did you see?
Janet