PayPal closes loophole that let scammers send real emails with fake purchase notices

PayPal closed a loophole that allowed scammers to send real emails from the legitimate service@paypal[.]com address with fake purchase notices, following an investigation by BleepingComputer. The scam involved criminals pausing a PayPal subscription to trigger the genuine “Your automatic payment is no longer active” notification, and they allegedly set up a fake subscriber account—likely a Google Workspace mailing list—that forwarded the message to all group members.

This enabled the criminals to impersonate PayPal and bypass basic email filters and initial manual checks by recipients. According to BleepingComputer, the group used the legitimate sender address to foster trust and make the scam harder to detect. PayPal has stated they are actively mitigating the matter and encourage customers to contact support directly through the PayPal app or the official Contact page if they suspect a scam.

Malwarebytes’ coverage emphasises using verified official channels and reporting suspicious messages to help prevent such tech-support and phishing scams.