PayPal settlement - scam?

[Dave_L]

I just got an email, purportedly from PayPal concerning a class action settlement.

The link included in the message is on the domain "epl DOT paypal-communication DOT com".

Is this a scam, or is it legit?

I could post a Tracking URL for the Spamcop parse, but it may have personal info, so I'd prefer not to do that.

[Lking]

Dave, I would bet on a scam.  I receive the email for three PayPal accounts (personal + two accounts for non-profits) and have not receive any "class action" emails.

I do receive 1 or 2 PayPal "account suspended" or "verify password" phishing attempt a month.  Guess that is what I get for having the same email mailbox for more than 20 yrs. ;-)

[Dave_L]

Thanks.

It was sent to one of my actual PayPal email addresses, but that's not helpful, since anyone whom I've made payments to using that address would have that info, and they could have been careless about safeguarding it.

The whois info for the domain I posted above is the same as for paypal DOT com, but that's not necessarily reliable either.

[Lking]

Did you send a copy/question to spoof[at]PayPay[dot]com?  In the past I have gotten 'thanks for reporting' responses.  Never any end results.

[Dave_L]

Not yet. I wanted to research it first.

[lisati]

I occasionally receive emails claiming to be from Paypal, and usually send a copy to spoof[at]paypal.com at the same time as reporting to spamcop if I think it's a bit suspicious.

[Dave_L]

I have an existing relationship with PayPal (I have a PayPal account). If the email I received is a legitimate notice from PayPal, and I report it using Spamcop, wouldn't that be a violation of Spamcop's Terms of Service? That's why I'm hesitant to report it. I may settle for simply contacting PayPal through their "spoof" or other customer service address.

[Lking]

Have you considered sending the email to SpamCop using the webpage or Submit and then looking at the results.  If the parser finds that the sender is in fact PayPal, just CANX the reports?

[Dave_L]

I've previously parsed the email using Spamcop (see my initial post), but I couldn't determine conclusively from that whether it was from PayPal.

I just forwarded the email to spoof AT paypal DOT com, to ask about it. I'll see what they say.

A web search revealed that there was another class action settlement against PayPal in 2004. PayPal seemed to be deliberately trying to confuse people, e.g. by using a separate domain, to discourage people from participating in the settlement.

[Lking]

My bad.  A quick review of the history I have, I do not see anything from paypal-communication. Not sure that means anything (lack of evidence is not evidence of...).

So back to the beginning, send it to Spoof and ask if it is real.  Are there any links in the body? Do they look lagit? Is there a "call for action" in the body? If not just file it.

For the record, all the emails from PayPal I have saved are 'some mailbox' [AT]paypal.com

[Dave_L]

Are there any links in the body?

Once again, you have made a mistake. I mentioned a link in my initial post. We normal users cannot accept these imperfections from administrators. (I edited my most recent post, to add some info.)

[Lking]

Mere mortals, in purple robes.

[lisati]

8 hours ago, Dave_L said:

I have an existing relationship with PayPal (I have a PayPal account). If the email I received is a legitimate notice from PayPal, and I report it using Spamcop, wouldn't that be a violation of Spamcop's Terms of Service? That's why I'm hesitant to report it. I may settle for simply contacting PayPal through their "spoof" or other customer service address.

I, too, have an existing relationship with PayPal.

Some of the suspicious emails I have received over the years are clever fakes. Cleverly done, but still fakes. I usually take a close look at the "from:" address. One of the tricks they use is to use a "from" email address that is sufficiently similar to a real PayPal email address that you wouldn't notice if you're not paying attention.

The response I typically get from PayPal, once they've had a chance to take a look, includes something like this:

Quote

Hello  , Thanks for forwarding that suspicious-looking email. You're 
right - it was a phishing attempt, and we're working on stopping the 
fraud. By reporting the problem, you've made a difference! Identity 
thieves try to trick you into revealing your password or other personal 
information through phishing emails and fake websites. To learn more 
about online safety, click "Security Center" on any PayPal webpage. 
Every email counts. When you forward suspicious-looking emails to 
spoof@paypal.com, you help keep yourself and others safe from identity 
theft. Your account security is very important to us, so we appreciate 
your extra effort. Thanks,