Found an error?
Report now
Fraudsters are using a new scam to deceive PayPal users.
Sebastian Kahnert/dpa
Anyone who receives an email with the subject "Problem with your PayPal account" is falling into a particularly clever trap. This scam uses PayPal's genuine infrastructure against its victims.
The scam takes place in several phases. First, a deceptively genuine-looking PayPal email with a reference to "regular security checks" and an alleged login outside of the usual activity patterns is frightening. A button is supposed to lead to identity confirmation. In fact, you end up on a fake website in the full PayPal design. The victim enters their access data there.
What happens next is the really clever part. The fraudsters immediately use the stolen data in the background to trigger a genuine PayPal security code. They immediately ask the victim for this code. It looks like a regular verification step. This is how the criminals get past the two-factor protection without hacking it.
Once the code has been entered, access to the account opens and the attack escalates. Further queries follow: Credit card number, expiration date, CVV check digit, address, telephone number. In the end, the perpetrators not only have access to the PayPal account, but practically the entire financial identity of the victim. This opens up opportunities for attacks far beyond PayPal.
The most reliable protection lies in the details. A password manager only enters the access data on a page whose URL it knows. On a phishing page, the form remains empty. This is not a coincidence, but a warning signal. Similarly, no reputable provider will ask you to confirm an SMS code by e-mail. And certainly not on an external website.
Anyone who receives such an email should delete it without interaction and check directly via the official PayPal app to see whether there is actually an account notification. Suspicious emails can also be reported directly to the company via this email.
The actual explosive nature of this wave of attacks lies in the system design. Two-factor authentication has been the security standard for years, but if the victim voluntarily passes on the code, even this protection is no longer effective. The weak point is not the technology, but the moment of confusion that criminals deliberately create.
