<removed> is a scam.

[TheGreen]

So whether emails with links to epl.paypal-communication.com are a scam or official emails has been asked several times but no good answer has been forth coming other than a "Maybe??" from Paypal itself.

I received an email from 'Paypal' recently about their 'Return Shipping on Us'. The subject of the email said that "Return Shipping on Us is active."

It looks to have come from a real Paypal email (see <removed>  for more detail than I can muster.

It used my full name.

It generally followed the standard Paypal email structure.

The English grammar was good.

But:

I never activated return shipping. Though I did look at it a while back.

The picture portion of the email looked just slightly fuzzy, like it was a lower resolution copy of an original.

All the links went through variations of: epl.paypal-communication.com/

When I went to Paypal directly, without clicking on any links, it told me there had been 'suspicious' activity and I needed to change my password.

And most damming of all the email included: "With PayPal, some of your recent purchases below may be covered with Return Shipping on Us*." and then listed 3 purchases, from more than a year ago. Problem. I NEVER MADE THOSE PURCHASES! The transactions are NOT listed on my account, I NEVER purchased anything from the listed sellers, ever (Toys-R-Us, Sephora USA Inc, and Macy's) and the purchase amounts are suspiciously in whole dollars ($15.00, $25.00, $20.00).

So with the above information we can say either Paypal is glitching out something fierce or this IS a scam.

[kprivigyi]

I can't believe there's no answer to this- paypal sends emails ending with anything other than .paypal.com and I'm not clicking anything!

The email I got suggested that I have money sitting in my account... but it's a mystery if it really came from them or not.  Somewhere they should have a list of IP's or domains that they send emails from so we know!

[OldRambler]

Scam status confirmed 09-Oct-2018 by PayPal. Received a message purportedly from "<removed> " with subject "Confirm your info to keep a PayPal balance." containing an embedded 'confirm' link to domain <removed> . Didn't pass the smell test. Forwarded suspicious email to spoof@paypal.com, received a reply almost immediately confirming that it is a phishing attempt.

[cdi971]

I fell for this one as it had my new address prefilled.

Sent the link to the abuse email of Paypal after changed my password. Is that the right place to advise Paypal?

What about the credit card details I just entered. Should I stop the card and get a new one?

Thanks in advance.

[cdi971]

I just blocked the card as it occurs to me my credit card details are going to be on the dark web auctions pretty fast.

A new card solves it. But how is it possible the scammers had my new address and email and full name in the form?

Thats a pretty sophisticated spoof.

[sfora]

So I received the same email as OldRambler, claiming I needed to "Confirm your info to keep a PayPal balance." I copied the URL and used a redirect checker (just chose the first result on Google). The URL redirected to the paypal.com domain. I copied the first redirect link and it took me to a page that said, "Thanks for providing your information. You should hear back from us within 1-2 business days" (I was already logged in. If you weren't, the link would've redirected to the login page). I don't see any way this could be a scam, considering it immediately redirected to the paypal.com domain, with no in-between redirects to potential phishing sites.

[4tt3nt4t]

I got a regular email asking me to 'View your recent transactions now'. I was going to use link to view msg in browser but was blocked and informed:

AdNauseam has prevented the following page from loading:

<removed> 

Because of the following filter

||<removed> ^

Found in: <removed> 

I can log in to Paypal direct no problem and use links from other senders. This definitely appears to be a scam, so why is no one warning users?

I'm going to check my past payments thoroughly and do have one I intend disputing but don't know if t's linked.

[SkiRX]

Got the "Subject: Action required: Confirm your info to keep a PayPal Balance" email with a link to https://epl.paypal-communication.com. Looked like phish so I did not click. Forwarded to spoof@paypal.com. We'll see what they say. Suspicious because I do not have a PayPal balance at the moment and no such message appears when I log directly into the "real" PayPal site.

[kernowlass]

@SkiRX 

If its a spoof, DO NOT USE ANY LINK.

Firstly if the email/ text addressed you as ''Dear Member'' / ''Customer'' / ''Client'' OR your ''email address'' then that confirms its a spoof as paypal would address you by your full name eg Dear John Smith.

Secondly if there was a link OR attachment in that email link to ''cancel'' any transaction or ''confirm'' any details then again it would be a spoof.

If there was a problem with your account Paypal would not ask you to click on an unsafe link in an email or by downloading an attachment, they would direct you to log in normally and go to the resolution or the message centre for more information.

More info here >>
https://www.paypal.com/us/selfhelp/article/how-to-spot-fake-emails-faq2340/2

https://www.paypal.com/us/webapps/mpp/security/suspicious-activity

[AbigailSalier]

I just have received a mail asking to reset my password and I did it <_< I hope nothing occurs while i'm off