Very good PayPal scam. Please read so you don't get caught out. I almost gave away £750...

[Hungrycaterpillarsmummy]

Was almost scammed to the tune of £750. This is a good one and I was sooooo close to falling for it. Was on the phone to the scammers! Woke up to an email from PayPal saying there's been what looked like fraudulent activity on my account. I checked the email address by clicking on it and it did look legit. I then decided I'd go to PayPal from Google rather than clicking any links in the email. Logged in and saw a pending transaction for £750. Not one I recognised and definitely wasn't me. So I clicked on the transaction and there is a note saying "this is fraudulent activity" and call this number. So I call the number, go through security, get sent a security code, I am then transferred to someone senior, they tell me my bank card number, confirm all my name and address etc. Then they ask for the 3 digits on the back of my card. I pause, with alarm bells ringing. This is the absolute crème de la crème of information you can give someone because once they have that they can make purchases. I said no, this sounds like a scam. Then all of a sudden the guy is like "well you called us with the number from PayPal. You've called us because you got an email saying fraudulent activity detected and you can see on your account there has been". Whilst I was on the phone I decided to check my PayPal account and I had been logged out and couldn't get back in. He told me that was an added security measure. Anyway, I said no it's a scam and he ended with "ok then you will lose all your money". I said ok and hung up. Changed my password immediately, found the £750 transaction and this is where I had gone wrong. The phone number to call "PayPal" was on a NOTE on the transaction but this note is from the scammers! So they put their number in there and then act as PayPal. Honestly I was sooo close to saying those three digits but that's the only thing that hasn't allowed this scam to be successful. All I had to do was click "cancel" against the money request!

Damn. Thank you for sharing that. I’m sorry you went through that OP. That sounds very scary!

Yes that's it. I wish I'd clicked cancel rather than call but still...I realised in the end!

Everyone should set up 2fa on Paypal if you haven't already. That means that they text you a code when you try to log in and you can't log in without that code. It's a faff but it's worth it when it's linked to your bank account.

I also use unique passwords for everything now. If you use google chrome it will automatically suggest passwords and save them for you so you don't need to remember them. It also alerts me if any of my passwords have been found in stolen password banks/password leaks.

It doesn't hurt to change your passwords elsewhere and will potentially help security.

Also one going around recently - if you've ever bought anything on FB or donated to someone's appeal, FB might have your payment details saved and they are notoriously insecure, so it's worth going into settings on FB and removing any payment methods.

I called PayPal and they told me they are already investigating it

You've done the right thing, OP

I guess the lesson here is to always, always only go by what's on your actual, password protected Paypal account, and not even then if it looks even vaguely suspicious. Admittedly I'm a cynical old cow, but I've had too many emails like this and tend to go on the principle that they're fraudulent unless proved otherwise

Dreadful. Seems to be so much of this about recently.

Yes PayPal sent me the instructions for the 2-factor authetication but actually I am sure I used to have that as every time I logged on I received a code to use but weirdly this morning I didn't!

You should never, ever give someone a security code that's been texted to you by your bank/PayPal etc. There were some very similar scams on Rip Off Britain recently, where scammers have got into bank accounts that way, even though the text messages always say 'don't share this code with anyone'.

That means that they text you a code when you try to log in and you can't log in without that code.

I have that.

That said I don't use Paypal often.

Mainly for Ebay & I tend to just transfer across as necessary rather than keep much in there.

Use a passport manager so you can have unique ones for every site

Slight problem there ... what happens when the password manager sites also get hacked?
I suppose we could try to tell financial providers we'd used a "safe site", but can't help thinking they'd just blame us for sharing them at all and with anyone

You can always tell somebody is scamming you when they start berating you! Real customer service agents don't talk like that. I recently stupidly clicked on a link to buy some shares or something and put in my phone number to sign up (duuuuuuh why lol) and I started getting bombarded with phone calls, then whatsapp messages. I texted back "Not interested" and they replied "Why did you sign up for XYZ then?" "Don't you want to buy shares??" I just blocked them, but I got nuisance calls for weeks.

I thought I'd also read that these institutions don't contact by email?

Yeh but it was actually on my PayPal that's the only reason I fell for it seeing a "transaction" which was just plainly a money request.
Basically like someone walking up to me in the street and saying "can I have £749?" and me saying yes or no.

The only thing making me smile is the fact they must've thought they were onto a winner with me only for it to fall at the very last hurdle!
Then I said no it's a scam he got so abrupt and told me I'd lose all my money.
Oh ok then, you sound like a legit PayPal assistant!

Of course PayPal sends emails!

This is why my PayPal password is about 16 digits long and a total pain in the arse to type out if I ever have to.

Paypal does send legitimate emails, which is why it's easy to get caught out by paypal scams.

Password manager software usually has much stronger security than any old random site <ahem MN> that may not have been coded by anybody security conscious or might be running outdated security.

I know, I know, I know.
I just wasn't thinking today!

This is the problem. They caught me on a off day!

Someone nearly got me once with a "about your transaction on eBay" email- almost clicked on the link, as it just happened to arrive after I had just bought something on eBay, but I noticed the seller name was different, and logged back into eBay instead of clicking on the link.

Interesting scam, thank you for the heads up

As an aside, they use deliberately poor spelling and grammar to weed out the people less likely to fall for the scam - timewasters, from their point of view.

It could be anyone, wrong day wrong time, who doesn't notice these clues. Just received bad news, recent bereavement, extreme fatigue, we are most of us vulnerable at some point or another.

I've just had one of these too 🙄

Yep that's it!

They are obviously on a mission today

it was actually on my PayPal that's the only reason I fell for it seeing a "transaction" which was just plainly a money request

I know, OP; that's why I included the bit about "if it looks even vaguely suspicious"

The bigger question is how these bastards got into Paypal in the first place to scatter their scams around, but that's the nature of the so-called security on sites - they blow a gale about how foolproof theirs is, but experience teaches that it's rarely any such thing

If you see a scam / have been scammed you should report to action fraud.

Yes absolutely. Needs tightening up a lot!

That's weird. I wonder if you also somehow didn't get onto the real paypal site, like accidentally clicked on an ad on google? Maybe the scam did something to your google search results. Seems a bit far fetched I suppose.