Criminals want to use the scam to persuade recipients to call a supposed hotline in order to grant unauthorized access to their devices.

In an email about a change of address, fraudsters initially make you believe that you are making an expensive purchase

The PayPal fraud was discovered by the cybersecurity magazine Bleeping Computer. Accordingly, many users received emails from the actually legitimate address service@paypal.com claiming that they had added a new address to their account.

The email also contained a fake purchase confirmation for an expensive product such as a MacBook M4 Max and a request to contact the phone number provided if unauthorized. However, anyone who calls there will end up directly with the scammers.

Alleged support lures Paypal customers into a telephone trap

They pose as support and try to unsettle victims with PayPal fraud. They urge you to download software to supposedly prevent unauthorized access.

In fact, this allows remote access to the victim’s computer, which can lead to data theft or financial damage.

Due to PayPal vulnerability, emails appear deceptively real

What is particularly perfidious about this scam is that the emails are actually sent from PayPal servers and therefore appear to be genuine. According to the experts, this is due to a vulnerability in PayPal’s address management system. You insert fake purchase confirmations into the “Address Additional” address field. Since PayPal has no character limit in this field, the entire text of the scam message can be pasted there.

This means that the emails easily pass through the security and spam filters and appear as legitimate notifications from PayPal. Those affected who checked the authenticity of the emails found that no new addresses had been added to their accounts – meaning the messages were completely fictitious.

Received email? This is how you protect yourself from the scam

In December 2025 PayPal had closed a similar gapafter this was also uncovered by Bleeping Computer. However, it is unclear whether this also affects the other vulnerability. Customers should PayPal scam So keep this in mind when you receive relevant emails.

If you receive such an email, do not click on any links contained therein or call the telephone number provided. Instead, log in directly to the PayPal website and check whether changes have actually been made to your account. If no new addresses have been added, you can mark the email as spam and delete it.

Bleeping Computer informed PayPal about the scam. It remains to be seen whether the company will introduce measures such as limiting the number of characters in the address field to prevent such attacks in the future. Until then, it is important to remain vigilant and not to reveal sensitive data if you are unsure about the authenticity of a message.

Sources: Bleeping Computer, Security Boulevard