The original post: /r/cybersecurity by /u/Synthetic88 on 2024-11-10 19:22:44.

Almost got taken by a Paypal scam I haven’t seen before.

• Buyer wants to buy my Craigslist listing. (They don’t haggle which is a red flag.)

• I get their address and send them a Paypal invoice.

• They send me a screenshot showing they tried to send me money but ‘the buyer isn’t set up to receive funds.’

• I log into Paypal, there is a notification on my account but I confirm with customer service that my account is OK. I ask them to try again.

• I get a Paypal email saying you’ve got a deposit. At the LAST SECOND I notice a typo in the email, “Reply us with tracking number” so I don’t click anything in the email and open PayPal from a new browser window. There is no money in there.

Here’s the twist, the link in the email was to “https://www.paypal.com/” but with a TON of javascript after that. I think the key is the part where they say it didn’t go through, which makes you log into Paypal. The link in the email opens Paypal (where you’re already logged in) and probably transfers money to some account so quickly that you don’t notice until it’s over. And by this point you’ve been expecting the Paypal email so you click it (spear fishing hack.)