Why is paypal sending out fake emails about requesting a visa card.

[chad187]

Got this email this morning. Freaked out because I have 2 factor and I didn't order a credit card. Called the paypal and they said they didn't have any record of sending the email. It appears to be a valid paypal domain(although weird looking) and it is signed by a valid cert. Email from <removed> (delete the extra spaces stupid board keeps telling me their own email isnt allowed). WTF paypal?

Your Prepaid Card is on the Way!
Hello CHAD, the new PayPal Prepaid Mastercard that you ordered is on its way! It should be arriving in your mailbox any day now in a plain white envelope from PayPal. When your new card arrives, be sure to:   Activate it and verify your identity* Add money to it Start using it

[PayPal_Olivia]

Hi @chad187,

I'm sorry to hear that you received an email that you aren't expecting. If you did not apply for a PayPal Prepaid card and believe that this email is a fake, please send it to spoof@paypal.com to be reviewed. Fraudsters can make it look like an email is coming from a legitimate address. 

Please note that no email addresses are permitted to be posted in the community, except for spoof@paypal.com. This is to ensure that a fraudster cannot slip a fake email address in among real ones and trick people into using it to seek assistance.

I hope this helps!

Olivia

[chad187]

As this is a paypal domain this must be from paypal. Unless Paypal lost its domain key and also had its SPF records hacked this email was sent by paypal(SPF/DKIM/DMARC all pass).

SPF:DKIM:DMARC:

PASS with IP 74.112.64.76 Learn more

'PASS' with domain email.paypal-prepaid.com Learn more

'PASS' Learn more

[PayPal_Olivia]

Hi @chad187,

That definitely is strange. While I do not have the level of knowledge about determining whether something is spoof that the review team at spoof@paypal.com has, I can see that you have some degree of understanding of things. I would still recommend sending the email to that address for review.

Another thought - does the To: address on the email match the email address associated with your PayPal account, or was it sent to a non-matching address? If it was sent to a different address than the one associated with your PayPal account, you will want to contact customer support again to have them search for any accounts associated with that email address.

Olivia

[chad187]

I sent it over to spoof@paypal.com (submission ID KMM82913090V20279L0KM). I also called the paypal credit card support number and they said they have no record of sending out a card to me. The email address does match my paypal account.

[chad187]

Still no response from spoof@. Got another one today saying my prepaid card is ready to be activated. Also sent to spoof@. Kind of scary that Paypal doesn't know what emails are being sent out by itself or its partner mkt5806(possibly part of IBM) using its keymat no less. 

Spoof report KMM83592587V76138L0KM

subject:	Your PayPal Prepaid Card is Waiting for You to Activate
mailed-by:	bounce.netspend.mkt5806.com
signed-by:	email.paypal-prepaid.com