There is a bogus email going around purporting to be from PayPal notifying you of charges that you did not authorize. Of course it has a “helpful” link for you to click and cancel the charges. But can you guess what happens if you click the link? You can try it but I’m not going to! I looked up some information and discovered this is not from PayPal and is, in fact, a scam. A copy of the email is included below. Also, please see the comment from John Erickson where he explains how you can check out suspicious looking emails. Thanks John!
Beware of this PayPal Spear Phishing Scam – I Just Got One!
Published by Shawn E. Tuma
Shawn Tuma is an attorney who is internationally recognized in cybersecurity, computer fraud and data privacy law, areas in which he has practiced for nearly two decades. He is a Partner at Spencer Fane, LLP where he regularly serves as outside cybersecurity and privacy counsel to a wide range of companies from small to midsized businesses to Fortune 100 enterprises. You can reach Shawn by telephone at 972.324.0317 or email him at stuma@spencerfane.com. View more posts


If you get a suspicious Email, you can go to the “File” dropdown on your Email program, then click on “Properties”. It should show you a tab with “details” – click on that, then read through the text. Most will be incomprehensible tech jargon, but you will see a line that contains the “from” address. If this doesn’t look like any website you know – and most phish attempts will have an address ending in a non-US country code (like .za for South Africa, the only one that generates a lot of these I can think of). If it doesn’t look legit, or if it’s a Yahoo or Google or other easy-to-get Email service, DELETE IT! Trust me, Paypal or Citicorp can afford their OWN domain names – they do NOT use GMail to communicate with their customers.
I’ll try to remember your post when I get the next one, and I’ll post the example. I don’t have one laying around right now – I delete them with EXTREME prejudice! 🙂
Thank you John, that is great advice!
John, I updated the blog to let readers know to check out you great comment on verifying emails – thank you!
The nice part is, if you have NO clue how Email (or PCs) work, this is a great way of checking out strange Emails. If you DO know a little, you can find the address and report it – the BBB or FBI for domestic sites, probably the FBI for foreign sites. (I think they have a site on their web page that tells you how to report these things.) Not only can you avoid being a victim, but you can also make sure others don’t get in trouble, as well.