You might trust an email from service@paypal.com. After all, it looks official, it uses real PayPal branding, and the links even go to PayPal’s own website. But scammers are now using a sophisticated trick that makes their phishing messages appear genuine and many people are falling for it.
Recently, clients have reported emails with the subject “You’ve got a money request”. The message looks identical to a real PayPal notification. It says someone has sent you a payment request and includes a Pay Now button that takes you to the real PayPal site. It even passes SPF and DMARC checks, which are normally used to detect fake senders.
Despite all this, it is a scam.
How this scam works
This is known as authenticated phishing. The scammers are not hacking PayPal or sending fake websites. Instead, they are abusing PayPal’s legitimate features by sending real payment requests from fraudulent accounts.
Everything looks technically correct – the email genuinely comes from PayPal, and the links are safe but the goal is to panic you into sending money to the criminal’s account.
What are SPF and DMARC?
SPF (Sender Policy Framework) helps verify that an email really comes from an authorised server for a domain.
DMARC (Domain-based Message Authentication, Reporting and Conformance) adds policies for what to do if a message fails checks and ensures the “From” address matches the domain that passed verification.
Both are vital for protecting against spoofed emails. However, they cannot detect fraud when the system itself is being used properly, as in this case, where PayPal’s own infrastructure is exploited.
Red flags to look for
Unexpected payment requests
If you did not expect a request for money, be suspicious, even if it looks genuine.Partial or missing personalisation
This email addresses the recipient only by their email address. Real PayPal messages always include your full name.False urgency
The note inside the message claims a payment has already been approved or deducted, which is designed to create panic.Unverified contact number
The email lists a phone number to call for “enquiries”. Never ring numbers in suspicious messages.Contradictory wording
The email even includes a genuine PayPal line: “PayPal won’t contact you through a money request.” That statement is true, but in this context, it’s being misused to make you trust the message.Borrowed branding
Everything from the footer text to the copyright notice is copied directly from real PayPal communications. Scammers do this to make the email appear legitimate.
What to do if you receive one
Pause and think
Scammers rely on quick reactions. Stop for a moment and check whether the request makes sense.Do not click or call
Never click “Pay Now” or use phone numbers in the email.Log in directly
Go to www.paypal.com manually or through the app to check your activity. If the payment request is real, you’ll see it there.Report it to PayPal
Forward the email to phishing@paypal.com. This helps PayPal block the sender and protect other users.Mark it as phishing
Use your email provider’s reporting option and then delete the message.Secure your account
If you clicked any links or entered details, change your password and enable two-factor authentication.Warn others
Share the warning with colleagues, family, or clients. Phishing prevention starts with awareness.
Why reporting matters
By forwarding suspicious emails to phishing@paypal.com, you help PayPal identify accounts being misused to send fraudulent requests. Those reports allow PayPal to suspend the offenders and prevent future scams. Each report genuinely makes a difference.
The bottom line
Even real emails can be part of a scam. Passing SPF and DMARC does not mean the message is safe and legitimate links do not always mean the sender is trustworthy.
Always question unexpected payment requests. When in doubt, go straight to your account, verify for yourself and report anything suspicious to phishing@paypal.com.
