Is it a scam

[Myrtle1]

I received an email from Ella claiming I had made a payment for 649.99 USD using my PayPal Pro Credit  Service.  It all looks so professional.  I assume that as I haven't bought anything like this and have never heard of PayPal Pro Credit that it is a scam ?  Should I just delete it ??

[kernowlass · Accepted solution]

@Myrtle1 

If its a spoof then NEVER USE ANY LINK.

Firstly if the email/text addressed you as ''Dear Member'' / ''Customer'' / ''Client'' OR your ''email address'' then that confirms its a spoof as paypal would address you by your full name eg Dear John Smith.

Secondly if there was a link OR attachment in that email/text to ''cancel'' any transaction or ''confirm'' any details then again it would be a spoof.

If there was a problem with your account Paypal would not ask you to click on an unsafe link in an email or by downloading an attachment, they would direct you to log in normally and go to the resolution or the message centre for more information.

More info here >>
https://www.paypal.com/us/selfhelp/article/how-to-spot-fake-emails-faq2340/2
https://www.paypal.com/us/webapps/mpp/security/suspicious-activity

[ScamMailSnitch]

Below is the "header"of a similar scam email.
The "body"of the scam emails is similar. 
Several of these have arrived in my "Inbox," bypassing the spam filters! 
Return-Path, email addresses, and IP addresses vary on "spoofed" scam emails. 
-> Do not click on the links provided in the scam email! 
Type the website's URL yourself, using New Browser Window. 
Only Log In to your account in the New Browser Window.
-> Don't trust those links provided in the scam email!

Return-Path : <mmcdermott24-->cvcs.****>
Received : from <removed> unverified <removed>) by <removed>.*** with Mail2World SMTP Server; Tue, 10 Aug 2021 08
Received : from <removed> (<removed>) by <removed>with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94) (envelope-from <removed>) id 1mDTHp-000Aks-Cl for scam_mail_snitch_off-->mail2world.***; Tue, 10 Aug 2021 15
ARC-Seal : i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.***; cv=none; b=e5pvLAjcP0CXwgMsmhrki90HKwG5A6v32OfoQhxhDeApyNwa3m4w7GYtoRTUo43VI+h2dviICpvAssZLncLUxjxzYiuMWW+nLaDBq+M0Y6hLT4zzh5kXc+MMN3sKUcVcBtrbm98oJuzxG4Bpa1dy0oQj7k1+lCjDHo/pyDmcZGEr4jbIivD3EmuUmAT04QDlWwE3japkShEOqz[Removed. Phone #s not permitted]5rvTm4dqQIIV4cIQCdi/Yu2YOqqfqRa+aXxOZ7iKdi7MSTT8leZ/w==
ARC-Message-Signature : i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.***; s=arcselector9901; h=From
ARC-Authentication-Results : i=1; mx.microsoft.*** 1; spf=pass smtp.mailfrom=cvcs.****; dmarc=pass action=none header.from=cvcs.****; dkim=pass header.d=cvcs.****; arc=none
DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed; d=cvcsorg.onmicrosoft.***; s=selector1-cvcsorg-onmicrosoft-com; h=From
Received : from <removed>
Received : from <removed>
From : Max <removed><removed>
Subject : $649.99 charged
Thread-Topic : $649.99 charged
Thread-Index : AQHXjfdkxvqc+SlaZ0+iei02t1B3JA==
Date : Tue, 10 Aug 2021 15
Message-ID[Removed. Phone #s not permitted].NAMP220.PROD.OUTLŎŎK.***>
Accept-Language : en-US
X-MS-Has-Attach :
X-MS-TNEF-Correlator :
authentication-results : twcny.rr.***; dkim=none (message not signed) header.d=none;twcny.rr.***; dmarc=none action=none header.from=cvcs.****;
x-ms-publictraffictype : Email
x-ms-office365-filtering-correlation-id : a72d7b4e-9bc2-42f9-1de7-08d95c0fff0e
x-ms-traffictypediagnostic : SJ0P220MB0398
x-microsoft-antispam-prvs : <[Removed. Phone #s not permitted]J0P220MB0398.NAMP220.PROD.OUTLŎŎK.***>