{“lastseen”:”2025-10-30T14:58:50″,”description”:”One of our employees received this suspicious email and showed it to me. Although it’s a pretty straightforward attempt to lure targets into calling the scammers, it’s worth writing up because it looks like it was sent out in bulk.\\n\\nLet’s look at the red flags.\\n\\nFirstly, the **sender address** :\\n\\n\\n\\nPayPal doesn’t use Gmail addresses to send invoices, and they also don\u2019t put your address in the blind carbon copy (BCC) field. BCC hides the list of recipients, which is often a sign the email was sent to a large group.\\n\\nAnd \\”Tina Pal\\” must be Pay\u2019s evil twin\u2014one who doesn\u2019t know it\u2019s customary to address your customers by name rather than \u201cPayPal customer.\u201d\\n\\nBecause the message came from a genuine Gmail address, the authentication results (SPF, DKIM, and DMARC) all pass. That only proves the email wasn’t spoofed and was sent from a legitimate Gmail server, not that it’s actually from PayPal.\\n\\nThe red flag here is that PayPal emails will not come from random Gmail addresses. Official communications come from addresses like `service@paypal.com`.\\n\\nThe email body itself was empty but came with a randomly named attachment\u2014two red flags in one. PayPal would at least use some branding in the email and never expect their customers to open an attachment.\\n\\nHere’s what the invoice in the attachment looked like:\\n\\n\\n\\n\\u003e \u201cPayPal Notification:\\n\\u003e \\n\\u003e Your account has been billed $823.00. The payment will be processed in the next 24 hours. Didn\u2019t make this purchase? Contact PayPal Support right now.\u201d\\n\\nMore red flags:\\n\\n * **Urgency:** \\”The payment will be processed in the next 24 hours\\” or else the rather large amount of $823 is gone.\\n * **Phone number only:** This isn’t how you normally dispute PayPal charges. Genuine PayPal emails direct you to log in to your account or use their online Resolution Center, not to call a number.\\n * **Unverified number:** Reverse lookup tools don\u2019t show it as PayPal\u2019s. Scammers often spoof phone numbers or register them under unrelated businesses. An official PayPal support number will appear on PayPal\u2019s website and be recognized by lookup tools.\\n * **Brand mismatch:** An invoice comes from the company charging you, not from the payment provider. So, this one should have been branded for Geek Squad or be titled something like \u201cpayment notification.\u201d\\n\\n\\n\\n## What tech support scammers do\\n\\nIn this type of tech support scam, the target calls the listed number, and the \u201ctech\u201d on the other end asks to remotely log in to their computer to check for \u201cviruses.\u201d They might run a short program to open command prompts and folders, just to scare and distract the victim. Then they\u2019ll ask to install another tool to \\”fix\\” things, which will search the computer for anything they can turn into money. Others will sell you fake protection software and bill you for their services. Either way, the result is the same: you’ll be scammed out of a lot of money.\\n\\n## Safety tips\\n\\nThe best way to stay safe is to stay informed about the tricks scammers use. Learn to spot the red flags that almost always give away scams and phishing emails, and remember:\\n\\n * Do not open unsolicited attachments.\\n * Use verified, official ways to contact companies. Don\u2019t call numbers listed in suspicious emails or attachments.\\n * Beware of someone wanting to connect to your computer remotely. One of the tech support scammer\u2019s biggest weapons is their ability to connect remotely to their victims. If they do this, they essentially have total access to all of your files and folders.\\n\\n\\n\\nIf you’ve already fallen victim to a tech support scam:\\n\\n * **Paid the scammer? **Contact your credit card company or bank and let them know what\u2019s happened. You may also want to file a complaint with the FTC or contact your local law enforcement, depending on your region.\\n * **Shared a password?** If you shared your password with a scammer, change it everywhere it\u2019s used. Consider using a password manager and enable 2FA for important accounts.\\n * **Scan your system:** If scammers had access to your system, they may have planted a backdoor so they can revisit whenever they feel like it. Malwarebytes can remove these and other software left behind by scammers.\\n * **Watch your accounts:** Keep an eye out for unexpected payments or suspicious charges on your credit cards and bank accounts.\\n * **Be wary of suspicious emails.** If you\u2019ve fallen for one scam, they may target you again.\\n\\n\\n\\nPro tip: **Malwarebytes Scam Guard recognized this email as a scam.** Upload any suspicious text, emails, attachments and other files to ask for its opinion. It\u2019s really very good at recognizing scams.\\n\\n* * *\\n\\n**We don ‘t just report on scams\u2014we help detect them**\\n\\nCybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we\u2019ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!”,”published”:”2025-10-30T13:19:24″,”modified”:”2025-10-30T13:19:24″,”type”:”malwarebytes”,”title”:”Fake PayPal invoice from Geek Squad is a tech support scam”,”source”:””,”references”:””,”id”:”MALWAREBYTES:CAF394CBA6C24AC70A019EDBE8048406″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/10\/fake-paypal-invoice-from-geek-squad-is-a-tech-support-scam”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-30T14:58:50″,”description”:”One of our employees received this suspicious email and showed it to me. Although it’s a pretty straightforward attempt to lure targets into calling the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-24082","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n