A new email scam is abusing PayPal’s Subscriptions billing feature to send legitimate PayPal emails that contain fake purchase notifications embedded in the Customer Service URL field.
Victims report receiving emails stating:
“Your automatic payment is no longer active”
Inside the email, scammers inject alarming text claiming a $1,300–$1,600 purchase (MacBook, iPhone, Sony device) and urge recipients to call a fake PayPal support number to cancel the charge.
Why this scam is effective
- Emails are sent directly from PayPal’s mail servers
- Messages pass SPF, DKIM, and DMARC checks
- They bypass spam and security filters
- Text uses Unicode tricks to evade detection
- The sender address is service@paypal.com
This makes the emails appear highly credible — even to experienced users.
How the scam works
Researchers confirmed the emails are generated by:
- Creating a PayPal Subscription
- Pausing the subscription (which triggers an automatic PayPal email)
- Injecting malicious text into the Customer Service URL field
The emails are sent to a fake subscriber email, likely a Google Workspace mailing list, which then forwards the email to victims, masking the original delivery path.
Attacker objective
The goal is to scare recipients into calling the provided phone number, where scammers attempt:
- Bank fraud
- Account takeover
- Malware installation
- Remote access scams
What to do if you receive this email
✔ Do not call the phone number
✔ Ignore the email if it includes a fake purchase message
✔ Log in to PayPal directly to confirm no charges exist
✔ Contact PayPal only via the official app or website
PayPal has confirmed it is actively mitigating the method used to send these scam emails.
This incident highlights how trusted platforms can be exploited to deliver highly effective phishing attacks, even without a traditional email breach.
