Office of Information Technology
March 28, 2023
Tags Phishing Email (on campus)

New contract notice from @paypal service

Phish Bowl Alerts

Another phony invoice, supposedly from "@paypal service" for "Geek Prime renewal", that attempts to alarm the recipient enough to call the phone number provided. The linked "Review & sign" option points to a malicious address, according to https://www.virustotal.com/.

From: "@paypal service" <noreply@messaging.squareup.com>
Subject: New contract: #000033 from @paypal service
Date: March 28, 2023 at 1:25:54 PM EDT
To: <JOSIAHCARBERRY@GMAIL.COM>

[ PayPal logo ]

@paypal service
New contract: Amount Charged $699.99 If you wish to cancel this request, call us at +1(800) [ Number redacted ]
Signature requested on March 28, 2023

Review & sign

Recipient
JOSIAHCARBERRY@GMAIL.COM
JOSIAHCARBERRY@GMAIL.COM

Message
Call for Dispute & Cancellation: +1(800) [ Number redacted ]
Payment in transit for $699.99 for Geek Prime renewal appears to be unauthorized.
If you wish to cancel this request, call us at +1(800) [ Number redacted ]

@paypal service
1172 Spanish Bay Ct, Orange Park, FL, 32065-2686
Security | Privacy
© 2023 Square, Inc.

[ Attachment: Amount Charged $699.99 PDF file ]