Avoid getting scammed by fake "PayPal - Order Has Been Completed" email

What kind of email is "PayPal - Order Has Been Completed"?

After inspecting the "PayPal - Order Has Been Completed" email – we determined that it is spam. This letter is presented as a notification regarding a successful purchase made via PayPal. This spam mail aims to trick recipients into calling the provided helpline and thus getting lured into the scam.

It must be emphasized that this email is in no way associated with PayPal Holdings, Inc.

"PayPal - Order Has Been Completed" email scam overview

The spam email with the subject "Thank you for being Paypal's customer!" (may vary) is presented as a purchase notification. It states that the recipient has purchased 756.40 USD worth of Bitcoin cryptocurrency (at 0.000043 USD/BTC exchange rate) via PayPal. The letter warns that if the recipient does not recognize this purchase, they must call the provided telephone number to restrict the transfer of Bitcoins, as their transactions are irreversible.

As previously mentioned, this email is fake, and it is not associated with PayPal Holdings, Inc. This spam mail operates as a callback scam, a type that is notoriously versatile. What the scammers – under the guise of support – trick the victim into doing can vary drastically.

Schemes related to purchases often operate as refund and/or tech support scams. Cyber criminals typically request victims to allow them to access their devices remotely (via AnyDesk, TeamViewer, UltraViewer, etc.). Once connected, the scammers can remove genuine security tools, install fake anti-viruses, steal data, and even infect the system with malware (e.g., trojans, ransomware, cryptocurrency miners, etc.).

In refund scams, the criminals remotely connect to the victim's device and ask them to sign into their online banking accounts (in this case, potentially – PayPal). Afterward, the scammers use the remote access software's feature to darken the device's screen and ask the victim to enter the refund amount.

During this time, the cyber criminals either manipulate the banking website's HTML code or transfer funds in-between accounts (e.g., from savings to checking). Neither of these methods actually affect the funds – however, when the screen turns visible, the victim is confronted with the trickery of a significantly larger sum having been transferred.

Then scammers plead or demand that the victim return the excess. Since no transaction took place – no funds entered the account, and by attempting to give back an "excess" – the victim will simply send their own money to the criminals.

Scammers prefer difficult-to-trace methods for money transferring, such as cryptocurrencies, gift cards, pre-paid vouchers, or cash hidden in innocent-looking packages and shipped.

Furthermore, since the "PayPal - Order Has Been Completed" email mentions Bitcoins – it is possible that this spam mail also aims to steal victims' cryptocurrency wallets.

What is more, cyber criminals target a variety of sensitive information, e.g., personally identifiable details (names, addresses, occupations, etc.), account log-in credentials (online bank accounts, money transferring, e-commerce, cryptowallets, etc.), and finance-related information (bank account details, credit card numbers, etc.).

This vulnerable data can be obtained by tricking victims into disclosing it over the phone, entering it into a phishing site or file, or typing it where the scammers claim to be unable to see it. Alternatively, criminals can use information-stealing malware to acquire the data.

To summarize, through emails like "PayPal - Order Has Been Completed" – users can experience system infections, serious privacy issues, financial losses, and even identity theft.

If you have allowed scammers to access your device remotely, first – disconnect it from the Internet. Second, remove the remote access program that the cyber criminals used, as they may not need your permission to reconnect. Lastly, use an anti-virus to perform a full system scan and remove all detected threats.

And if you have provided your log-in credentials – change the passwords of all potentially exposed accounts and inform their official support without delay.

If you suspect that your private information (e.g., ID card details, credit card numbers, etc.) is at risk – immediately contact the corresponding authorities.

Threat Summary:

Name	"PayPal - Order Has Been Completed" spam email
Threat Type	Phishing, Scam, Social Engineering, Fraud
Fake Claim	Email is presented as a notification regarding the purchase of Bitcoin cryptocurrency via PayPal.
Disguise	PayPal
Support Scammer Phone Number(s)	+1 (888) 537-2081, +1-877-410-6583, (929) 322-9517, +1 (888) 791-4827, 818-900-9852, +1 (209) 920-4343, 805-220-9803, (888) 989-4860, 704-445-0596, 250-462-6099, (833) 465-6353, 807-808-5449, (888) 226-4503
Symptoms	Unauthorized online purchases, changed online account passwords, identity theft, illegal access of the computer.
Distribution methods	Deceptive emails, rogue online pop-up ads, search engine poisoning techniques, misspelled domains.
Damage	Loss of sensitive private information, monetary loss, identity theft.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Similar spam campaign examples

We have inspected countless spam emails; "Payment For Apple Gift Card", "PayPal - You Authorised A Payment", "Norton360 Total Protection Subscription Charge", and "Thank You For Shopping With Apple" are just a few examples of ones similar to "PayPal - Order Has Been Completed".

In addition to phishing and various scams, deceptive mail is also used to proliferate malware. Various disguises and social engineering techniques are used to gain and subsequently abuse recipients' trust.

Due to how widespread and well-made spam mail can be – we highly recommend exercising caution with incoming emails, PMs/DMs, SMSes, and other messages.

How do spam campaigns infect computers?

Spam emails can have infectious files attached to or linked inside them. These files can be in various formats, e.g., executables (.exe, .run, etc.), archives (ZIP, RAR, etc.), Microsoft Office and PDF documents, JavaScript, and so forth.

When a virulent file is executed, run, or otherwise opened – the infection chain (i.e., malware download/installation) is triggered. For example, Microsoft Office documents infect devices by executing malicious macro commands. While Microsoft OneNote files require users to click on embedded content (files/links).

How to avoid installation of malware?

We strongly recommend exercising caution with incoming emails and other messages. The attachments and links found in suspicious mail must not be opened, as they can be infectious. It is important to use Microsoft Office versions released after 2010 since they have the "Protected View" mode that prevents automatic execution of macros.

However, malware is not spread exclusively through spam mail. Therefore, we also advise being careful while browsing since fake and dangerous online content usually appears harmless.

Additionally, all downloads must be performed from official and verified channels. It is crucial to activate and update software using functions/tools provided by genuine developers, as illegal activation tools ("cracks") and third-party updaters can contain malware.

We must stress the importance of having a reputable anti-virus installed and kept updated. Security programs must be used to run regular system scans and to remove detected threats. If you've already opened malicious attachments, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Text presented in the "PayPal - Order Has Been Completed" spam email letter:

Subject: Thank you for being Paypal's customer!

PayPal

Your payment of $756.40 for OrderID#1248187 has been completed.

Order Number 8NZGDM
Product Order ID #1248187
Product Purchased - Bitcoin
Network Paypal
Order Completed Feb 15, 2023, 09:37 (UTC)
Exchange Rate 0.000043 USD/BTC

View payment receipt
Need help?
If you have not placed this order call immediately at +1-877-410-6583 to restrict the transfer as Bitcoin once credited to the receiver cant be retrieved.

Call Now

Another example of PayPal order-themed spam email:

Text presented within:

PayPal
Dear customer,
Your Order has been Placed
Order No: PX97566455-676454-66Y6

Description
Product code : PADTX5478526
Product name : Bitcoin
Order Date : 21/Feb/2023
Payment Method : Online
Payment Status : Under Processing
Quantity : 0.028btc
Send Btc: faa4f6466f7g98f76f566fg6df5
Total : 600.00 USD
Receipt No : PAY9846534-7755-67P

Thank you shopping with PayPal account.your order has been successfully registered with us.
You will get your shipping as we get confirmation of payment from PayPal.

Please keep receipt number for future reference. You'll need it if you contact customer service at PayPal.

You have 24 hours from the date of the transaction to open a dispute. For assistance Call: +1 (888) 791-4827

Help | Security Centre

Please don't reply to this email. It'll just confuse the computer that sent it and you won't get a response.
Copyright © 2022 PayPal, Inc. All rights reserved paypal 5630 N. First St
san jose Paypal 94663
United States

@Thank You

Another example of an email from "PayPal - Order Has Been Completed" spam campaign:

Text presented within:

PayPal

Monday, 04 March 2024 CST 06:33
Order number: (VTB_VDJB/6596-QAHA/2942)

PayPal will be delivered online this between.

We're getting your order ready, and we'll email you with the tracking information as soon as it's out the door. Here's where it's headed.

Product details
Product: Polkadot-DOT
Merchant: Binance Global, Inc.
Quantity: 0.732
Product No. 7500-689-1042
Amount: $835.83

Buyer details:
Name: -
Email: -
Customer Id: -
Customer wallet address: -

Questions about your order?
Give us a call at 715-752-0006

Thanks again,
PayPal Gateway
Support: 715-752-0006
Candi Holman
Mi Rensselaer New York
Gaetanohaven Michigan USA

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is "PayPal - Order Has Been Completed" spam email?
• Types of malicious emails.
• How to spot a malicious email?
• What to do if you fell for an email scam?

Types of malicious emails:

Phishing Emails

Most commonly, cybercriminals use deceptive emails to trick Internet users into giving away their sensitive private information, for example, login information for various online services, email accounts, or online banking information.

Such attacks are called phishing. In a phishing attack, cybercriminals usually send an email message with some popular service logo (for example, Microsoft, DHL, Amazon, Netflix), create urgency (wrong shipping address, expired password, etc.), and place a link which they hope their potential victims will click on.

After clicking the link presented in such email message, victims are redirected to a fake website that looks identical or extremely similar to the original one. Victims are then asked to enter their password, credit card details, or some other information that gets stolen by cybercriminals.

Emails with Malicious Attachments

Another popular attack vector is email spam with malicious attachments that infect users' computers with malware. Malicious attachments usually carry trojans that are capable of stealing passwords, banking information, and other sensitive information.

In such attacks, cybercriminals' main goal is to trick their potential victims into opening an infected email attachment. To achieve this goal, email messages usually talk about recently received invoices, faxes, or voice messages.

If a potential victim falls for the lure and opens the attachment, their computers get infected, and cybercriminals can collect a lot of sensitive information.

While it's a more complicated method to steal personal information (spam filters and antivirus programs usually detect such attempts), if successful, cybercriminals can get a much wider array of data and can collect information for a long period of time.

Sextortion Emails

This is a type of phishing. In this case, users receive an email claiming that a cybercriminal could access the webcam of the potential victim and has a video recording of one's masturbation.

To get rid of the video, victims are asked to pay a ransom (usually using Bitcoin or another cryptocurrency). Nevertheless, all of these claims are false - users who receive such emails should ignore and delete them.

How to spot a malicious email?

While cyber criminals try to make their lure emails look trustworthy, here are some things that you should look for when trying to spot a phishing email:

• Check the sender's ("from") email address: Hover your mouse over the "from" address and check if it's legitimate. For example, if you received an email from Microsoft, be sure to check if the email address is @microsoft.com and not something suspicious like @m1crosoft.com, @microsfot.com, @account-security-noreply.com, etc.
• Check for generic greetings: If the greeting in the email is "Dear user", "Dear @youremail.com", "Dear valued customer", this should raise suspiciousness. Most commonly, companies call you by your name. Lack of this information could signal a phishing attempt.
• Check the links in the email: Hover your mouse over the link presented in the email, if the link that appears seems suspicious, don't click it. For example, if you received an email from Microsoft and the link in the email shows that it will go to firebasestorage.googleapis.com/v0... you shouldn't trust it. It's best not to click any links in the emails but to visit the company website that sent you the email in the first place.
• Don't blindly trust email attachments: Most commonly, legitimate companies will ask you to log in to their website and to view any documents there; if you received an email with an attachment, it's a good idea to scan it with an antivirus application. Infected email attachments are a common attack vector used by cybercriminals.

To minimise the risk of opening phishing and malicious emails we recommend using Combo Cleaner Antivirus for Windows. 

Example of a spam email:

What to do if you fell for an email scam?

• If you clicked on a link in a phishing email and entered your password - be sure to change your password as soon as possible. Usually, cybercriminals collect stolen credentials and then sell them to other groups that use them for malicious purposes. If you change your password in a timely manner, there's a chance that criminals won't have enough time to do any damage.
• If you entered your credit card information - contact your bank as soon as possible and explain the situation. There's a good chance that you will need to cancel your compromised credit card and get a new one.
• If you see any signs of identity theft - you should immediately contact the Federal Trade Commission. This institution will collect information about your situation and create a personal recovery plan.
• If you opened a malicious attachment - your computer is probably infected, you should scan it with a reputable antivirus application. For this purpose, we recommend using Combo Cleaner Antivirus for Windows.
• Help other Internet users - report phishing emails to Anti-Phishing Working Group, FBI’s Internet Crime Complaint Center, National Fraud Information Center and U.S. Department of Justice.

Frequently Asked Questions (FAQ)

Why did I receive this email?

Spam emails are not personal. Cyber criminals distribute this mail by the thousand with the hopes that at least some recipients will fall for their scams.

I have provided my personal information when tricked by this spam email, what should I do?

If you believe that your log-in credentials have been compromised – immediately change the passwords of all potentially exposed accounts and inform their official support without delay. And if you suspect that your other private data is at risk (e.g., ID card details, credit card numbers, etc.) – contact the appropriate authorities without delay.

I have allowed cyber criminals to remotely access my computer, what should I do?

If you have permitted cyber criminals to access your device remotely – the first step is to disconnect it from the Internet. Afterward, the remote access software that the criminals used must be removed (e.g., TeamViewer, UltraViewer, AnyDesk, etc.), as they may not need your consent to reconnect. Lastly, run a full system scan with an anti-virus and remove all detected threats.

I have read a spam email but didn't open the attachment, is my computer infected?

No, merely reading an email will not result in a system infection. Malware download/installation processes are jumpstarted when a malicious attachment or link is opened/clicked.

I have downloaded and opened a file attached to a spam email, is my computer infected?

Whether your device was infected might depend on the opened file's format. Executables (.exe, .run, etc.) infect devices almost without fail. While document formats may require additional user interaction (e.g., enabling macro commands, clicking embedded content, etc.) to start downloading/installing malware.

Will Combo Cleaner remove malware infections present in email attachments?

Yes, Combo Cleaner is designed to detect and eliminate threats. It is capable of removing most of the known malware infections. Note that since sophisticated malicious programs usually hide deep within systems, running a full system scan is essential.

▼ Show Discussion