Fake PayPal Account Review Emails Are Reaching Your Staff

A phishing campaign impersonating PayPal is designed to harvest your account credentials by convincing your staff to click through and "confirm" personal and financial details. If acted upon, the consequences extend beyond a compromised PayPal account — reused passwords, linked payment methods, and stored financial data all become accessible to the threat actor, exposing your organisation to fraud and potential downstream compromise of other services.

This campaign has been observed across multiple local organisations, with a cluster of messages appearing in NZ inboxes over a short window spanning several days. The cross-organisational spread suggests an automated distribution effort rather than a targeted attack, meaning your staff are likely to encounter this regardless of industry or size.

The email presents a convincing PayPal template — familiar branding, a measured tone, and a plausible pretext around keeping account details current. However, the sending domain has no affiliation with PayPal whatsoever, originating from a French-registered domain with no legitimate connection to the brand. Despite a passing DKIM result, both SPF and DMARC checks fail, indicating the message was not authorised by PayPal's mail infrastructure and should not have passed as legitimate correspondence.

What makes this campaign particularly worth noting is the combination of a soft-failing SPF result alongside a DKIM pass — a configuration that can cause some filtering systems to treat the message more leniently than a hard fail would warrant. This mixed authentication profile is increasingly used by threat actors to slip past automated defences while still failing the composite authentication check that matters most. The email body also trails off mid-sentence in its feature-restriction warning, suggesting a templated payload that may be part of a broader, evolving kit being reused across multiple campaigns.