Security experts warn of two new phishing campaigns targeting PayPal users, employing fake websites and urgent language to steal account details amid increasing online fraud tactics.
PayPal users are being targeted by two phishing campaigns that try to push victims on to fake websites, according to the consumer warning service Watchlist Internet and guidance from PayPal and Digistore24. The scams exploit the scale of PayPal’s user base by mixing plausible payment language with pressure to act quickly, a combination security experts say remains one of the most effective ways to trick people into handing over account details.
In one version, victims receive an email claiming they are due a refund of €95.66 because of a duplicate charge. The message urges the recipient to click a link to claim the money, but the link leads to a counterfeit site designed to look like PayPal’s own pages. PayPal says users should be wary of messages that create a sense of urgency, use generic greetings or contain suspicious links, and it advises checking the sender address before taking any action.
A second scam uses a more alarming claim: an alleged payment of €909 to a merchant called “Digistore24 GmbH” that will supposedly be debited within two days unless the customer objects. Digistore24 says it has published its own anti-fraud advice to help customers identify fake emails and websites, verify legitimate contact details and report suspicious messages. The company also lists official channels so users can compare any incoming communication with verified addresses.
Security advice for both campaigns is the same: do not click links or buttons in the email, mark the message as spam and, if there is any doubt, sign in separately through the official PayPal app or website to check the account directly. Avast, which regularly tracks PayPal-related scams, says fraudsters often rely on impersonation and time pressure, while PayPal’s own phishing guidance recommends hovering over links on a computer to inspect the destination before opening them. If the web address is not a genuine PayPal domain, the safest response is to ignore it and report it.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
