Phone Scam Alert: Fake PayPal Fraud Call

A client forwarded a voicemail the company received claiming to be from “Fraud Solutions” about suspicious activity on a PayPal credit card ending in specific digits.

This client does not have a PayPal credit card either as a business or personally. The business also does not have a PayPal account. None of their business or personal cards end in those numbers.

This is a spear phishing attempt, it is happening nationwide and PayPal is a favorite for scammers as most people have done transactions with PayPal at some point.

This scam relies on three manipulation techniques:

Authority – The caller claims to represent the fraud department to trigger trust.

Urgency – The message implies account compromise and pushes immediate fear based action.

Partial Data Anchoring – Referencing fake credit card digits is designed to lower skepticism and prompt engagement. Many people will tend towards correcting the misinformation before realizing this is fraud. They may pull out all of their credit cards to start comparing the last 4 digits of those to the ones referenced. (Now the scammer knows he’s got them on the hook and has propelled them to action.)

If this call had been answered or returned by our client, the next step would almost certainly have been identity verification harvesting followed by credential capture and some sort of distraction while they steal money from the account they’ve just gained the credentials to.

What to do if you receive a call or voicemail like this?

Do not call the number back

Do not press any keys

Do not provide or confirm personal information

Do not engage in conversation

Instead:

Delete the voicemail

Block the number

Independently contact the company using the number on the back of your card or the official website

Report the attempt to the financial institution

If you accidentally answer the call:

Hang up immediately

Do NOT argue or challenge the caller – they are known to become verbally abusive to those who argue with them. I have argued with them, to waste their time, and the names I’ve been called… just use your imagination.

Do NOT confirm your name, accounts, or identity

Monitor your financial accounts afterward

This is not about being careless or uninformed. These scams are engineered to exploit human trust and fear. Even highly educated and cautious individuals fall for them because the attack is psychological, not technical.

Awareness is prevention.

Verification > reaction.

And on the off chance this is your actual bank and you are being extra cautious your bank will appreciate your extra verification steps, just as they take steps to verify you are who you say you are before initiating transactions.