Payment notification fraud takes place when the Seller of an item receives an email falsely stating that the buyer has paid for the item. The email is faked to look as if it comes from PayPal or the Online Marketplace (e.g. eBay or Amazon).
The sender will look official (e.g. firstname.lastname@example.org), and the email will contain authentic-looking logos. Often the subject and body text will be very similar to the official text that a Seller is used to receiving.
The Seller ships the item to this scammer, only to discover too late that they haven’t been paid.
Simply sending unpaid items is possibly the “least worst” outcome of this scam.
The fake email may go to some lengths to entice the Seller to click on embedded links or graphics in order to “re-submit” their PayPal or marketplace details.
This link will take the Seller to a webpage that looks like PayPal or whatever, but is in fact a phishing page, designed to obtain your username and password for further malicious theft.
There are some other characteristics to watch out for as this scam plays out.
If the Seller usually takes payment direct to their bank account, the Buyer will insist that PayPal is used. Why? Because PayPal genuinely sends email notifications of payments – your bank account does not, so you’re more likely to notice that something is wrong here. There are reports of scammers sending email purporting to come from *their* bank saying that money has been transferred to your account. This is less popular with scammers, as sellers may be more suspicious of, what is for them, an unusual message, whereas they are quite used to PayPal notifications.
Many sellers report that the buyer explicitly asks for their PayPal email, or for a PayPal Money Request sent to their own email address. This is a red flag, as it is moving the transaction outside of the online marketplace trading and messaging system. The scammer wants the PayPal email because Sellers are accustomed to receiving funding notifications to *that* email, as opposed to a different address linked with their eBay or Amazon account.
Why doesn’t the scammer simply send their fake email through the marketplace messaging system? Some marketplaces simply won’t allow external links to be included in messages sent within their system. Some marketplaces won’t allow email addresses to be mentioned. They will monitor for anything that looks like evidence that trading is taking place (or being encouraged to take place) outside their marketplace, and will move to ban both Buyer and Seller.
So the scammer needs the Seller’s PayPal email. They may not baldly ask for it. To avoid suspicion, they may camouflage their intent in a request for other information. Often, more photographs or requested, or a separate invoice. As many marketplaces won’t allow mention of email addresses in their messaging systems, the scammer has to be a bit creative here. For example, if the Seller helpfully sends an invoice “for their records”, it may include an email and phone number. The Scammer will make contact using these details, and request the PayPal email to complete payment. Once they have the email, that false notification is sent.
Clearly, the best defense against this scam is for Sellers to check their PayPal accounts to verify that they have been paid. Don’t click on links within emails to go to PayPal, remember the cautionary note about phishing.
Open a browser page and type www.PayPal.com.
Variant – “Payment on Hold”
To counteract sensible Sellers checking their PayPal account, scammers will use some additional sophistication. Another fake email will arrive, purporting to be from the Marketplace. This one states that the Marketplace (e.g. eBay) are holding the funds until the Seller emails the tracking number of the item to the Buyer. Of course, the provide the tracking number, the Seller has to go ahead and ship the item. Ingenious.
This is completely fake. EBay or Amazon never hold funds in this way.
This email takes several forms. Here is one example from 2016. This is a double-hander, the Seller got two emails.
Email #1 from Fake PayPal: “You have funds of X pending to be credited to your account. When we receive the Tracking Number from the buyer via email, your account will be credited immediately.”
Email #2 from Scam Buyer: “Please send me the Tracking Number, so I can send to PayPal, thank you.”
When Sellers are Culpable
Sometimes, the Seller is not a faultless victim. When contacted by the scammer, the Seller may decide to keep the transaction outside the Online Marketplace to avoid fees. That is one reason to voluntarily give up one’s PayPal email. Seller Beware!
No Cash! Or “worse things happen at sea, you know”
Obviously, as this scam depends on payment via PayPal, if the Seller’s preferred method is Cash on Delivery then the Scammer must convince the Seller to switch. This usually involves some cock-and-bull story that puts the scammer all-at-sea. Here’s a few examples reported by Sellers:
“I work offshore as an instructor on an oil rig.”
“I am an oceanographer.”
“I’m a Marine contractor at sea.”
But not every scammer is a jaunty sailor. This poor dude had other problems: “sadly I can’t come personally to collect due to my hearing loss and I’m just recovering from heart surgery so I’m home-bound.” In his next email, the unfortunate fellow’s leg had fallen off.