So here's what happened to me: I get an email notification that looked like it legitimately came from paypal, that I have an invoice. First time for me, I have never received an invoice from paypal before, only notification of payments that I've authorized. So obviously, I did not authorize this. Nonetheless, I did NOT click the link in the email. So I logged into my paypal account, and there it was, for $297.88, with a business name, another email address, a name that the invoice is intended for (not mine) and my email address. I looked at the paypal website about what to do, so I sent the original email to phish@paypal...(in hindsight, this doesn't really address the problem. The notification came from Paypal, but they didn't phish the email, the fraudulent source used a legitimate business name to invoice me.) Then they advise to delete that original email. I did (wish I would have done a screen capture of it). I also changed my password, security questions, etc. in paypal.
By the way, this reminds me of the phony email scam I've received in recent months, usually for anti virus software/services. I was directly contacting Norton, etc. for the first few. The rest of them I forwarded to amazon and my email spam services, and they eventually stopped. But what concerns me about this happening within Paypal, is that I'm not seeing reassurances that Paypal is addressing the fraud.
So then, what to do about the invoice? Of course I'm not going to pay it (makes me wonder how many people inadvertently click that pay button? And if this is a scam, it must not be that effective at getting that immediate payment. THAT IS, if their ultimate goal isn't actually getting INFORMATION) But I didn't like that invoice in my queue. I clicked around on the help community and a paypal support person advised to simply cancel the invoice, that perhaps the business simply typed in the wrong email address.
But HOW do we know that?
I also looked up the company online. It's a legitimate company. But I still wasn't comfortable directly emailing them, just in case. So I found their facebook page, and there, the company owner had posted a video 8 hours earlier — thank goodness she did that! — in which she said, "My name is such and such from this company. I've been getting complaints. We DO NOT send invoices to folks who are not on our list! And the ONLY invoices we would send would come from these email addresses, etc." So I facebook messaged her, thanking her for the confirmation. Can you imagine how frustrated she is receiving all these messages from people who think she's behind this? (plus, it was a cool business, an entrepreneurial collective of black owned businesses)
So I go back to Paypal figuring there is at least something official I can do. But no help topics directly addressed this. I ended up cancelling the invoice in Paypal last night. But almost immediately I was concerned about any of my info going back to that suspicious source.
So the only conclusion I've come to is that there should be at least one, maybe more security steps Paypal should build in when sent an invoice you did not authorize. First, I wouldn't mind getting a "pre-notification" email from paypal that says, "did you authorize this invoice?". I'm certain that business owner would have liked a notification when an invoice was sent using her actual business name, but NONE of her approved email addresses. (I'm not even sure she uses Paypal) OR, when setting up the process by which you actually use paypal to invoice people, there should be an confirmation process, where Paypal checks for the very email addresses this particular business owner uses.
That brings us to the return email address on this fraudulent invoice. Who is that email connected to? Another person with a paypal account, or a bot? Anyway, Paypal needs to send an email to that email account (maybe they do, but I'd like to know the process). The transaction should be flagged if it hasn't been confirmed along the way. Also, and this one was big for me: when I cancel it, I need to be assured that the communication happens in a portal where I'm protected, or perhaps Paypal takes it from there. And maybe I am in fact protected, I just need assurance that I was.
Whoever read this, thanks for making it through the whole long slog. But I do hope it either clarifies things for me, or even better, improves security processes and customer service for Paypal and its users, thanks!
