I received and invoice from Direct Relief for $35 to help those affected by California wildfires.

[SF_RodT]

Hello Community,
I received an invoice from Direct Relief for $35 to "help those affected by wildfires". I did not order anything from anyone in the US. I live outside the US. It is marked as pending, and I have no intention of paying it willingly. Is this fraud? A scam? I tried to open a dispute and was not able to. What is this? Am I obligated to pay it? Thank you all for you help. Has anyone else received this invoice? I changed my password immediately.

[androrphin]

@kernowlass

I appreciate that email addresses can be harvested and bought but I would not expect respectable organisations like DirectRelief or PayPal to be involved in such unscrupulous activities. An explanation is definitely required here as to how our email addresses were obtained and further, reassurances that it won't/can't happen again.

[Tony_M_]

Hi, androrphin - My name is Tony and I work at Direct Relief. I just wanted to let you know that this email didn't come from Direct Relief but from an account that has stolen our logo and is impersonating our organization. We would never invoice someone at random or ask for donations in such a dishonest way. We should also note that we're in close contact with PayPal about this issue. We know their team is taking it very seriously and they're working hard to resolve it and prevent it from happening again. In case it's helpful, we've posted some information to our website here: https://support.directrelief.org/hc/en-us/articles/360052863594-Did-you-receive-a-PayPal-invoice-

[androrphin]

@Tony_M_thank you for your clarification. It seems like your organisation is as much a victim as we are.

We just need to hear from PayPal now how our addresses were harvested and what they are doing to prevent future scams like this.

[gRegorLove]

It's important to note that email addresses are easily obtainable from a variety of sources. There have been leaks from so many different online services over the years. See https://haveibeenpwned.com/. As a result, it is very unlikely to determine how this specific fraud attempt got our email addresses. There is no evidence that emails were harvested from PayPal, though.

PayPal definitely needs to work on addressing how easy it is to impersonate an organization like this. It sounds like they are working on that.

[PennyBC]

HI Tony <removed>, thanks for posting. Although I was hesitant at first, but since I didn't have to click anything in the email sent to me, I responded to another representative of Direct Relief to give the "original message" information to them for the cybersecurity expert. Unfortunately I wasn't able to do it at this time because I am only on a mobile phone, and it didn't work. I am still working on getting it done later through a computer. If anyone else IN THIS FORUM, saved their email and has that information, I'm sure you can send it to them. There's a specific way to do it.

[gireton]

I agree with others, this seems criminal. I know it shows "cancelled" but what is to stop it from happening again? I shouldn't have to cancel anything that I did not purchase. 

[mo2insureu]

Need to make canceling invoices an option through our phone apps, as well. What if I wouldn’t have had a computer?

[PennyBC]

When this started, I did not have any email from Direct Relief. I only had an email from PayPal saying I had an invoice. To me it seems like the invoice came 1st and naturally PayPal's automated system let me know I had an invoice. So I don't think I have a spoofed email, as far as it looks, unless they were able to get into PayPal and send out those notifications. The email address has the same security details as all <removed> emails I have received in the past. Even if it was a spoofed email the invoice was definitely hacked in PayPal. Did pay pal check their customers emails? I haven't received a request from THEM on it.

[Angelatida]

My $35 invoice came from a guy named William <removed>....upon a google search, I found that he is a BANK ROBBER from NJ....  

He robs banks to support his heroin habit? I think PayPal has a responsibility to sit down his accounts and not let these "invoices" to go through to people.

This forum won't let me link to the article.

Look him up on Google though.

On the directrelief.org website, they say that the $35 invoice is a scam if you click on the "support" section.

[doctoroh]

I received 2 invoices from William <removed> at DirectRelief.org. I did not authorize the payments, and it seems like a weird way to fundraise. Anyone else get similar invoices