PayPal Subscription Feature Exploited to Send Real Emails With Fake High-Value Purchase Alerts

A new email scam is misusing PayPal’s Subscriptions billing system to send genuine PayPal emails that contain fraudulent purchase claims hidden inside the Customer Service URL field.

Over the last few months, multiple users have reported receiving PayPal emails stating, “Your automatic payment is no longer active.” While the message appears routine, the Customer Service URL field has been manipulated to display alarming text claiming the recipient bought an expensive product such as a Sony device, MacBook, or iPhone.

The embedded message typically mentions a payment ranging between $1,300 and $1,600, includes a suspicious domain name, and provides a phone number that victims are urged to call to cancel or dispute the charge. Scammers use Unicode characters to alter fonts and emphasize certain words, a technique designed to bypass spam filters and keyword detection systems.

“http://[domain] [domain] A payment of $1346.99 has been successfully processed. For cancel and inquiries, Contact PayPal support at +1-805-500-6377,” reads the customer service URL in the scam email.

Although the content is fraudulent, the emails are sent directly from service@paypal.com

, which causes confusion and concern among recipients who fear their PayPal accounts may have been compromised. Because the messages originate from

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.