Phishing Scam 2025.01.22 - Email Reporting Suspicious PayPal Activity

Body

Date and Time First Identified

January 22, 2025 at approximately 12:15pm

Phishing Method

Email claiming suspicious activity involving a PayPal account.
This message contains a DocuSign link, a commonly abused low-context file sharing attack vector.
The email language creates a sense of urgency to get the recipient to act quickly.
There are also contact phone numbers included in the email for the recipient to get support.

User Response

Mark the message as spam or junk
Block the sender (so you don’t get another message like this)
Do not reply to the message or call any of the phone numbers included in the email.
Do not click on any links or attachments
Forward the message to phishing@dartmouth.edu

Sample Unformatted Email

Subject: ***Test Document***Your order confirmation report #TRF7868

This document is for demonstration purpose only

pay u sent you a document to review and sign.

We’ve noticed suspicious activity involving your PayPal account. A Bitcoin transaction of 0.013 BTC (equivalent to $549.00 USD) was initiated on January 22, 2025, from an unverified IP address. As a precautionary measure, we have temporarily paused this transaction to ensure your account’s security.

Immediate Action Required

If you did not authorize this payment, please act promptly to safeguard your account. Contact our Customer Support Team to report the issue:

📞 +1(312) 999-5183 / +1(312) 999-5183

Transaction Details
Invoice ID: 46556RTE
Amount: $549.00 USD
Item Purchased: Bitcoin (0.013 BTC)
Transaction Date: January 22, 2025

Need Assistance Now?

Our expert support team is available around the clock to address your concerns. Don’t hesitate to contact us:

📞 +1(312) 999-5183
📞 +1(312) 999-5183

Important Information

This is an automated message and cannot accept replies. If you suspect unauthorized activity, contact our support team immediately. Thank you for trusting PayPal. We remain dedicated to ensuring your online transactions are safe and seamless. Sincerely,

The PayPal Security Team

Committed to protecting your digital finances worldwide.

Do Not Share This Email
This email contains a secure link to Docusign. Please do not share this email, link, or access code with others.

Alternate Signing Method
Visit Docusign.com, click 'Access Documents', and enter the security code:
5C58368E43BD496E8F75C163067C98061

About Docusign
Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management™.

Questions about the Document?
If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly.

Stop receiving this email
Report this email or read more about Declining to sign and Managing notifications.

If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information.

This message was sent to you by pay u who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.