PayPal Scam Alert: New Invoice Scheme Bypasses Email Security

PayPal Scam Warning—Dangerous Invoice Bypasses Email Security

Beware of a new PayPal invoice scam that uses old tricks to bypass email security. As Google rolls out AI-powered protections to aid Android users, scammers are reverting to methods that exploit email vulnerabilities. “PayPal scammers are using an old Docusign trick to enhance the trustworthiness of their phishing emails,” said Pieter Arntz, a malware intelligence researcher at Malwarebytes. Scammers set up Docusign accounts and use its templates to create seemingly legitimate invoices from PayPal. These documents come from Docusign, allowing them to slip past email security filters, making them particularly dangerous. Docusign investigates and closes suspicious accounts within 24 hours of detection. PayPal emphasizes its commitment to security, urging customers to remain vigilant and visit PayPal.com for safety tips.

PayPal Attack Red Flags To Watch For

A recent Malwarebytes report highlights several red flags in this scam campaign. Emails may appear to be from Docusign but could originate from fake Gmail addresses. “If it seems weird that Docusign has been used to send a document that doesn’t require a signature, it’s a red flag,” Arntz noted. Jamie Beckland, chief product officer at APIContext, warns that this Docusign scam uses APIs to bypass email security and steal login credentials. “All API owners should monitor APIs for suspicious behavior,” Beckland advises.

Mitigating The PayPal Docusign Attack

To mitigate the risk, if you receive a suspicious email claiming to be from Docusign, verify its authenticity directly on Docusign.com by clicking the Access Documents link. Enter the document security code provided in the email. If you receive an error, the document may be fraudulent. Always check your PayPal account directly, not via links in emails, for any unauthorized transactions. Since many users rely on PayPal to both receive and access their funds, knowing the correct steps inside the platform is just as important as spotting scams, which is why understanding how to withdraw money from PayPal safely can help you avoid mistakes triggered by phishing or fake invoices. Report any suspicious activity to both PayPal and Docusign.

How PayPal Protects Users From Scams As Attacks Evolve

PayPal employs a combination of manual investigations and advanced technologies to protect users. They limit scam accounts and decline risky transactions. PayPal's evolving fraud detection tools include reminders for customers about suspicious invoices and payment requests. Customers should:

• Avoid calling phone numbers or clicking links in suspicious messages.

• Change their account password and contact PayPal if they suspect phishing.

• Enable two-factor authentication or use a Passkey.

• Report suspicious messages directly to email providers.

• Contact law enforcement to report scams.

For more information about invoice and money request scams, visit the PayPal US security page.

Image courtesy of PayPal

Image courtesy of PayPal

Related Threat Coverage

Invoice scams like this one increasingly overlap with AI-driven social engineering. See our coverage of how cybercriminals are exploiting YouTube with AI-generated deepfakes and phishing, our roundup of 25+ emerging cybersecurity trends shaping how these campaigns evolve, and our guide to building a strong cybersecurity plan for organizations that want to get ahead of this kind of attack.

Cybersecurity Marketing Solutions

In response to the constantly evolving threats in the digital landscape, GrackerAI offers AI-powered cybersecurity marketing solutions. Our platform helps organizations transform security news into strategic content opportunities. By automating insight generation from industry developments, GrackerAI positions itself as a powerful tool for creating timely, relevant marketing materials that resonate with cybersecurity professionals and decision-makers. To explore our services or contact us, visit GrackerAI.