I'm trying to figure this out because after this incident, my identity was stolen and it's been hell trying to get everything straightened out. I've had time at this point to research the typical differences between a valid PayPal email and a fraudulent one and can now point out that this first email was fraudulent, but as far as the correspondence afterward, I'm at a loss. Basically, I received an email from PayPal with the subject line "You sent a payment" which freaked me out since I hadn't used PayPal in almost a year and because I'd just paid my bills, overpaying on one to pay it off, and I couldn't spare an unexpected deduction until I got paid next. I quickly opened the email, which said PayPal had received my Bill Me Later payment for $942.45. I immediately logged into my PayPal account to find no recent transactions and nothing that looked out of place, except for my out-of-date information. I opted to speak with a PayPal rep via the online chat anyway, since I hadn't been a frequent customer of PayPal in years and probably hadn't logged in since the last time I used it, some 10 months prior, making this even more confusing.
The PayPal chat rep asked me to copy and paste the email into the chat and if I felt that the email was fraudulent, forward it to spoof@paypal.com and delete it. I immediately did both and was surprised to receive an email response 3 minutes later. I was a little confused about the wording of "You were right...it was a phishing attempt..." No one had mentioned phishing yet, least of all me, but I didn't read too much into it, figuring I was just paranoid getting the fake email and everything. The chat response came a little while later, thanking me for sharing the details, but also stating he could see I was reporting a payment I hadn't received. I chalked it up to a language barrier based on the rep's name, even when he repeated exactly what the previous rep had said...to send a copy to spoof@paypal.com and delete the original email...assuming they probably had online scripts the same as they obviously read from scripts over the phone. I didn't think anything else about it until the next day when I received an email stating they were waiting for a response from me and if no action was taken, they'd close out the conversation. And this is where I'm still confused. When I went back to the message center and explained that I had pasted the email into the conversation, the rep told me he could tell I hadn't been talking to true PayPal reps and to send it again. At that point, I was totally freaked out and closed out the window, not sure who was the real slim shady, just knowing I was going to close my PayPal account, which unfortunately requires a phone call, apparently, and that wasn't possible right then.
After researching a bit online, I'm able to recognize that the first email was definitely fake, as well as the second spoof@paypal.com response, and possibly the first one. What I don't understand, though, is how are there fraudulent messages interspersed between actual PayPal correspondence? I mean, it even says on PayPal's site to send fraudulent emails to spoof@paypal.com, so how would a fraudulent reply come back from that? As well, how would a fraudulent online chat occur, when it's their own website?
Anyone who can shed any light on this would be my hero. Thanks so much in advance!
