PayPal Coinbase Scam

A few days ago I got interesting scam mail. The scammer sent a fake invoice (pretending they are Coinbase) directly from PayPal claiming that I should pay my invoice. If that happens to you too (receiving an invoice you don’t expect) simply don’t pay it.

They might claim that you already paid the invoice, but when you log in to PayPal and see nothing in history, it means you didn’t pay it.

Just don’t pay and ignore the message. Don’t call the number, it might be a number with a special tariff or they might claim they are PayPal itself.

In my case, it looks like this. E-mail is sent from service@paypal.com (not spoofed).

Transcription:

Coin base

Please pay your invoice

Coinbase would like to remind you to pay invoice 102576869.
Amount due: $479.00 USD
Due date: February 3, 2023

View and Pay Invoice

Seller note to customer
Dear Customer, Thank you for choosing PayPal Your payment of $479. 00 will be charged through PayPal for Coinbase® Corporation. If you did not make this transaction , please call our Help Desk number: +1(833)478-3743 to cancel and claim a refund. If this is not the case , you will be charged $479. 00 today this transaction will reflect on PayPal activity after 24 hours. Cancellation after 24 hours from this email won’t be valid for a refund or claim. Have a great day! PayPal® Help Desk +1(833)478-3743 Our service hours:(06:00 AM to 06:00 PM Pacific Time)

Don’t know this seller?
You can safely ignore this invoice if you’re not buying anything from this seller. PayPal won’t ask you to call or send texts to phone numbers in an invoice. We don’t ask for your credentials or auto-debit money from your account against any invoices. Contact us if you’re still not sure.

Help & Contact | Security | Apps

PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing
Please don’t reply to this email. To get in touch with us, click Help & Contact.
Not sure why you received this email? Learn more

Copyright © 1999-2023 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.
PayPal RT000274:en_US(en-US):1.3.0:0149b88613055

The button indeed points to a PayPal system’s existing invoice. Once clicked invoice on PayPal is presented:

Invoice is real but the issuer is fake. Someone is pretending to be Coinbase (cryptocurrency exchange) and is sending these massively hoping that a certain percentage of invoices will be paid.

PayPal also appended a notice which says you can safely ignore this invoice if you are not buying anything from this seller.

In reality, I don’t have an account on Coinbase neither I ever used Coinbase, so I don’t expect an invoice from them. But even if I do this invoice is not from Coinbase, Coinbase does not receive payment buy sending invoices.

As you can see they worded their Item description cleverly in order that you call them. I am guessing if you do call them they might present themselves as PayPal support and try to ask for your PayPal access details.

However, PayPal will never send any phone number to call in an e-mail.

I am not sure what can you do if you paid you. Maybe contact PayPal via https://www.paypal.com/us/smarthelp/contact-us and see how to proceed.

Another thing you should do is forward your e-mail to phishing@paypal.com.