PayPal Pixel Scam Email Explained

Received a PayPal email invoice about a Google Pixel phone that you never ordered? Feels suspicious? Your intuition is correct! This scam has a few red flags.

We’ve reported on PayPal invoice scams MANY times before, and such scams just never fade away. This week, they’ve appeared again disguised as Google Pixel phone order confirmation emails: 

How the PayPal Pixel Scam Works 

1. First, scammers create a PayPal account and send you an invoice. (That’s why the email SEEMS to be legitimate — the sender’s email address is service@paypal.com.) Below is an example: 

Source: Consumer Protection WA

2. Then here comes the tricky part: in the “Seller note to customer” section, the scammers instruct you to contact them to cancel the order if you don’t recognize it via a phone number: 

Source: Consumer Protection WA

Of course, the contact number provided is NOT the official PayPal phone number. Guess who will answer the call? Scammers! 

3. If you do contact the scammers, they will try to get you to share detailed personal information or even download some “remote control” software to your cellphone.  
 
Don’t do this! Scammers can thus gain access to your device and steal your PayPal login information along with other stored credentials. With them, scammers can commit further acts such as identity theft. Beware!

Protect Yourself from the PayPal Pixel Scam

• Remember, even if an email seems legitimate, the source of an invoice can be questionable. 
• Contact PayPal Support directly for help. 
• Don’t reply to any requests for money/invoices you don’t recognize. 
• Always log on to PayPal via its official webpage or mobile app directly instead of via links from unknown sources. 
• You can report any suspicious emails to phishing@paypal.com to help more people out. 

How Did the Scammers Get My Email Address? 

 If you’re wondering how the scammers were even able to get your email address in the first place, you’re not alone. They will most often get it from underground internet forums or the dark web — two places that are hotbeds for stolen/leaked data.  
  
If you want a way to check if your personal data — email addresses, bank account numbers, Social Security number, passport number, and more — have been leaked online, consider checking out Trend Micro ID Security. The app will scan the internet and the dark web 24/7 for your data so if it’s ever leaked, you’ll know about it! Click the button below to learn more and claim your 30-day free trial today!  

This article was published in collaboration with Trend Micro