PayPal and DocuSign logos on a caution background.

Beware: New PayPal Scam Uses Docusign to Bypass Email Security

by

In a concerning development, scammers are exploiting PayPal’s brand to launch sophisticated phishing attacks that bypass traditional email security measures. By leveraging the Docusign API, these fraudulent emails appear legitimate, tricking users into revealing sensitive information or making unauthorized payments.

Key Takeaways

  • Scammers are using Docusign to send fake PayPal invoices.
  • Emails often bypass security filters, appearing legitimate.
  • Users are advised to verify suspicious emails directly through official channels.

How The Scam Works

Scammers have discovered a method to enhance the credibility of their phishing emails by utilizing the Docusign Application Programming Interface (API). This allows them to send emails that appear to originate from genuine Docusign accounts, complete with templates that mimic reputable companies.

  1. Setting Up Docusign Accounts: Scammers create unauthorized Docusign accounts to send out invoices that look like they are from PayPal.
  2. Bypassing Security Filters: Since the emails come from a recognized service, they often evade spam filters, making them more likely to reach potential victims.
  3. Crafting Deceptive Messages: The emails typically contain alarming messages about unauthorized transactions, prompting recipients to take immediate action.

Recognizing Red Flags

While these emails may look convincing, there are several indicators that can help users identify them as scams:

  • Sender’s Email Address: Often, the email will come from a generic Gmail address rather than an official PayPal domain.
  • Unusual Requests: Legitimate emails from PayPal will not ask you to call a number or provide sensitive information in response to an unsolicited message.
  • Document Verification: If you receive a Docusign email, you can verify its authenticity by visiting the Docusign website directly and checking for the document.

What To Do If You Suspect Fraud

If you believe you have received a fraudulent email or have fallen victim to this scam, take the following steps:

  1. Check Your PayPal Account: Log in to your account and review recent transactions for any unauthorized activity.
  2. Report the Incident: Use PayPal’s reporting features to alert them of any suspicious transactions.
  3. Monitor Your Accounts: Keep an eye on any linked bank accounts or credit cards for unusual activity.
  4. Contact Docusign: If you suspect that your Docusign account has been compromised, report it immediately through their official channels.

Staying Safe Online

To protect yourself from phishing scams, consider these best practices:

  • Do Not Click on Links: Avoid clicking on links in unsolicited emails.
  • Verify Sender Information: Always check the sender’s email address for authenticity.
  • Use Official Websites: Access your accounts directly through official websites rather than following links in emails.

As online scams continue to evolve, staying informed and vigilant is crucial. By recognizing the signs of phishing attempts and taking proactive measures, users can better protect themselves from falling victim to these deceptive schemes.

Sources