Cybercriminals are sending out fake PayPal email receipts, which claim the recipients have ordered an item from eBay, Amazon or other popular e-commerce websites. The fake email provides a link or button to cancel the so-called order. The link or button in the fake email receipts goes to a phishing website, looking similar to PayPal's websites, where visitors will be asked to sign into with their PayPal account. But, any attempts to sign into the fake PayPal website, will send the visitors' PayPal credentials to the cybercriminals behind the phishing scam.
Sample of a Fake PayPal Email Receipt
Ebay
Hi - Your order has shipped to 861 Sandhill Ave.
Sony XPERIA Z2 D6503 LTE (FACTORY UNLOCKED) 20.7MP, 5.2" , 2.3GHz Quad Core
Estimated delivery : Tue. Apr. 26
Tracking Number : 1Z107V7V2993998174
Shipping service : FedEx Standard Overnight
Item # : 221447349158
Transaction id : 1427440696012
Cancel This Order
The "Cancel This Order" link in the fake PayPal email receipt goes to the following phishing website created by cyber criminals:
- hxxp://sellerebayjohsoncomplaint.com/
Online users are advised not to visit and attempt to sign into phishing PayPal website with their PayPal credentials.
The cybercriminals behind the scam will use another website as soon as the current one has been discovered and taken down.
This is why it is important that PayPal users remember never to click on a link to sign into their accounts. They should always go directly to www.paypal.com and sign-in from there instead. This will prevent them from becoming victims of phishing scams, where cyber criminals steal their credentials, hijack their accounts, steal their money, and use their accounts fraudulently.
PayPal users who have already been tricked by a phishing scam, are asked to change their passwords and contact PayPal immediately for help.