Phone call to verify goods were received

[jacobmstein]

Hello. I just sent a payment to a seller as goods and services, shortly after I received a call with caller ID "PAYPAL" an 888 phone number at 9 pm EST. They acted as PayPal and read the name of the sender and the exact amount I sent. They simply asked if I received the goods already so the funds can be released. The only thing suspicious is I was asked for my full name, email, and last 4 of my social to confirm my identity after I said the goods were received.

Can passwords be reset with the last 4 of social over the phone or something? Is this legitimate? I removed all my cards and added 2fa, should I close my PayPal account? I have an account on another email, so if the scammers ever learned of my email then they could potentially reset that password too?

I should've confirmed more details or even just called PayPal back, but I didn't think about it much since they gave me the transaction details. I can't remember if I was greeted by name, but since I was asked for my full name I doubt it.

Thanks,

Jacob

[PayPal_Meghan · Accepted solution]

Hello @jacobmstein, 

Welcome to the Community! 

I completely understand the concern the call you received has caused. PayPal would never call you to confirm receipt of an item or a service. If we call out, we may ask for some verification information, but it sounds like the person who called you might have been trying to collect your information so they can contact us to pose as you. If you provided any information, I recommend logging into your PayPal account immediately. I would change your password, security questions, and the email you use on your PayPal account. If you remove the email you provided them and replace it with another, this will prevent them from ever gaining access to your account. I also suggest setting up 2-Step Verification. After securing your account, I recommend reviewing our list of common scams and how to report phishing attempts. 

I hope this helps! 

- Meghan

[jacobmstein]

The only reason I didn't doubt the scam is the details of the transaction amount and recipient, which must mean the recipient's email or something is compromised. I seriously got the call minutes after. I enabled 2fa, changed my email, and setup security questions. Is the last 4 of my social all that's needed to reset my password over the phone? Can they actually do anything?

Thank you.