The PayPal Scam That Emailed You Your Own Password

The email did not ask for a password. It handed one over.

Under a subject line reading order #002174, a message told a senior executive at a manufacturer that his PayPal Goods Protection had renewed for two years, that 599 USD was already charged to his saved payment method, and that his account username was his own corporate email address. The temporary password was printed right there in the body. To fix the charge, he was told to call a number.

No link. No attachment. One phone number.

That is the entire attack, and it is a good one. It strips out almost everything a secure email gateway (SEG) is built to inspect, then borrows the target's own identity to make a fabricated story feel like a system of record. Themis flagged it at 90 percent confidence and tagged it Credential Theft against a VIP recipient. The gateways in the delivery path did not agree.

The Credential Block Is the Whole Trick

Real providers do not email you a working username and a temporary password out of nowhere. This one did, and the username it "disclosed" was the recipient's own address. Read as you@your-company[.]com where you already know your own email, that block reads as authoritative. It looks like an account you forgot you had, tied to a charge you never approved.

The panic response is not to click. It is to call. The body compressed a phone number into the sentence (rendered as Call8282469290) and framed the 599 USD charge as already in motion. That is telephone-oriented attack delivery, or TOAD: move the victim off email and onto a live call where a "support agent" walks them into surrendering real credentials or a payment. The 2026 Verizon Data Breach Investigations Report puts callback and TOAD lures at roughly 5 percent of the email-gateway attack mix, a small slice that punches well above its weight because there is nothing for a scanner to detonate. Phishing for information like this maps to MITRE ATT&CK T1598, layered on top of standard phishing delivery, T1566.

Why the Gateways Saw Nothing to Score

Here is the part that should bother anyone who trusts authentication as a verdict.

The sender was no-reply@verificationemail[.]com, a domain with no relationship to PayPal. It was not a lookalike and it was not spoofed. It is a real domain registered in 2016 and authorized to send through Amazon Simple Email Service (SES). The message was DKIM-signed with a signature aligned to the From header, and that alignment let it clear Domain-based Message Authentication, Reporting and Conformance (DMARC) at the receiving gateway. Sender Policy Framework (SPF) passed too, though it authenticated the SES envelope rather than aligning to the visible domain.

So the authentication stack did its job and had nothing to reject. There was no forged PayPal domain, because the PayPal impersonation lived entirely in the body text. DMARC cannot fail a domain that is telling the truth about itself.

A note for anyone pulling the headers: a later hop logged dkim=fail and dmarc=fail with a reject policy. That was not the filter catching the attack. A legitimate Barracuda gateway in the path rewrote the message body, which broke the DKIM body hash downstream. The mail was delivered anyway. Barracuda scored it 0.15 against a quarantine threshold of 3.0. Microsoft assigned a Spam Confidence Level of -1, the score reserved for mail it trusts. Two commercial filters looked at this message and rated it cleaner than most newsletters.

See Your Risk: Calculate how many threats your SEG is missing

Behavior Is the Only Signal Left

When the infrastructure is authentic and the payload is text, the tell is not in the domain. It is in the language and the pattern.

That is where behavioral analysis earns its place. The IRONSCALES Adaptive AI read the message structure and language, not just its headers: an unrelated sender invoking a consumer brand, a fabricated credential disclosure, urgency built around a charge, and a phone number as the sole call to action. Community reputation signals lined the message up against previously reported activity with the same shape. Individually, none of those is a blocklist hit. Together they are a credential-theft lure, and Adaptive AI scored them as one while the gateways waved it through.

The pattern is not new, and it is not slowing down. The FBI Internet Crime Complaint Center (IC3) continues to rank phishing and spoofing as its highest-volume complaint category, and the FTC Consumer Sentinel network tracks brand impersonation, PayPal among the most abused names, as one of the most reported fraud vectors. The 2026 Verizon DBIR found credentials involved in 39 percent of breaches across the full kill chain. This email is a small, cheap contribution to that number.

What This Attack Actually Tests

CISA network-defender phishing guidance and the Microsoft Digital Defense Report both point the same direction: authentication and reputation are necessary and no longer sufficient. If your controls treat a DMARC pass and a clean SES send as an all-clear, this is exactly the message that lands.

Three things worth checking against your own stack:

• Do you flag brand-mismatch in the body when the sending domain is unrelated? A message invoking PayPal from a domain that has nothing to do with PayPal should be a signal even when it authenticates.
• Do you treat an unsolicited credential block as hostile? A username plus a temporary password in inbound mail, especially one echoing the recipient's own address, has no legitimate use.
• Can you catch an attack with no link and no attachment? If the answer depends on a URL scanner, callback phishing is a standing gap.

The recipient here never clicked anything, because there was nothing to click. That is the point. The attacks that authenticate cleanly, ship nothing to scan, and hand you back your own identity are the ones that make credential harvesting look like customer service. Score the behavior, not just the headers.

Indicators of Compromise