Hi folks,
Received a 'PayPal Invoice' for $46 that had the GoDaddy logo in the upper left corner. It referred to a inactive domain that I registered but haven't used as the 'invoice number'. Among the oddities is the fact that it states it is an invoice from Shestakov <removed> (albeit written in Cyrillic characters which are not permitted here) and the associated email address is <removed>
Given that I have not (to my memory) ever had a 'PayPal' invoice from GoDaddy before - I was naturally curious. Seems clear that this is a case of deceptive billing fraud. I'm being invoiced by a 3rd party superficially pretending to be GoDaddy (showing the GoDaddy logo on the invoice, albeit the other identifying markers point elsewhere).
I'm posting this for two reasons:
#1. Members of the community should watch out for 'odd invoices' that superficially look like they come from someone like GoDaddy but the 'Invoice from' name doesn't compute.
#2. Risk management should be proactively investigating this relatively new (to me) scam and provide a link to dispute/call attention to presumably fake invoices users may receive. I suspect eastern European criminal activity here - I have had experience in these matters, have done battle with the various hackers etc. doing work in the data security field and managing payment processing over the years.
The math looks like this (hypothetical instance) -
If they send out 1000 well executed fake $46 invoices per day and score on 3% of them, that's $1,331.10 net (after paypal fees) revenue per day, $9,317.70 a week. close to a half million a year. The criminal gangs/teams in eastern Europe/Russia/Ukraine would cheerfully kill for that kind of money! Creating 'fake PayPal accounts' or spoofing after successfully phishing and finding some relatively inactive by verified accounts they could hijack would seem to be a brilliant move in those circles. They probably have several dozen accounts already 'in place' - risk management needs to focus on the first report of a 'fake invoice' and look at the traffic being generated by that account and for similar invoices showing up with an abrupt increase of activity from relatively inactive hereinbefore accounts.
Just my 2¢ worth.
Regards,
gll2020
