I can often easily recognize phishing scams, but about a month before writing this article, I almost fell victim to one. It was one of the most legitimate-looking emails I’ve ever received, which made it even scarier. Luckily, I acted quickly to minimize the damage.
What did the scam look like?
One afternoon, I was innocently checking my Gmail inbox. Most of the messages were nothing special, but one was.
Its subject line?
“Your $999 invoice” from an account claiming to be PayPal. According to this email, I had purchased something from eBay. For reference, I live in Denmark, and we don’t have eBay here. When I lived in the U.K., I hadn’t used the website in over four years.
Although I’ve heard of the common eBay scam, this was the first time I thought someone had used my account. So, as anyone would, alarm bells started ringing in my mind. Did someone steal my payment information? If so, how did they get it?
Why did I fall for this scam?
While I know the most common phishing attacks, this scam initially seemed legitimate for several reasons. First, Gmail didn’t flag it as dangerous, and it arrived in my main inbox folder. Gmail is often pretty good at determining when someone is trying to swindle you.
Another reason this scam attempt initially seemed legitimate is that it used the same formatting you’d expect from a PayPal invoice. I use PayPal frequently, and its branding is pretty familiar. To their credit (I think), the scammer did a good job of mimicking a PayPal invoice. Clearly, someone had spent a lot of time learning how to use design software.
Third, the email had good spelling and grammar. The easiest way to recognize a phishing email is poor use of English, but that wasn’t the case this time.
Why I realized I was being scammed
If I know I haven’t purchased a product or service, I always adopt a zero-trust policy with my emails. Since I was on high alert, I started looking for signs of fraud; I usually get a notification whenever money is withdrawn from my PayPal account, so I initially checked my phone. But I didn’t find anything, so I started investigating deeper.
Secondly, I didn’t see any verified tick next to the email. All the PayPal email addresses I’ve seen in Gmail have a blue checkmark, but that wasn’t the case with this scam email. For example, when I contacted PayPal about the issue, you can see the verified tick next to their official account.
I also realized that the email address wasn’t associated with PayPal. Although it looked pretty similar, it didn’t use the official PayPal domain.
How I minimized the damage
Unfortunately, PayPal has many scams, and while prevention is the best option, you will sometimes need to enter loss limitation mode. I took some essential steps to minimize the potential impact, which I have listed below.
I didn’t respond to the email
It was important to take a step back and not do anything I might regret, such as responding to the email. A scammer will not admit that he is trying to take money from you, and doing so would not have gotten me anything.
Instead of responding to the email I received, I later sought official customer support. Although I initially deleted the message, I backed it up so I could forward it to the authorities.
I didn’t provide any important details
You will sometimes receive fraudulent attempted emails that ask for sensitive information, such as your bank details. Under no circumstance should you ever provide these details. No company would ask you to submit such information via email, so you are putting yourself at unnecessary risk.
I made sure the scammers did not have access to anything important. They obviously knew my PayPal email address because otherwise, they would not have been able to send me the message. So, I changed my password. This experience also reminded me that it is very important to enable two-factor authentication (2FA) for your PayPal account.
I checked my bank statements to see if the money was withdrawn
In addition to securing my PayPal account, I also wanted to confirm that no one could access my account. My next step was to check my linked bank accounts and statements to make sure there were no strange invoices. Thankfully, there were not.
I have been scammed once before, and when it happened, I immediately cancelled my bank cards. Since I acted quickly, the bank could also cancel the transaction. So, I followed the same principles this time too.