DKIM signed emails from PayPal are treated favorably by spam filters. The sample I reviewed had been set to an account belonging to (or compromised by) the sca

DKIM signed emails from PayPal are treated favorably by spam filters. The sample I reviewed had been set to an account belonging to (or compromised by) the scammer, modified slightly, and BCC'd to the victim. Specifically, a Reply-To header was added - PayPal does not assert non-existence of a reply-to header in their DKIM signature, and the entire point of BCC is that it doesn't have a header. Thus, these emails can be relayed to any target, and the scammer can choose any reply-to address they like, and the DKIM signature will still be valid. If anyone has samples and can send me them with full headers, I would be very interested to examine more. I have a public email address in my HN profile.