I received a phishing email like this two weeks ago (different text and phone number but same scheme overall): https://pbs.twimg.com/media/FZWERGlXgAIUVF7?forma

I received a phishing email like this two weeks ago (different text and phone number but same scheme overall): https://pbs.twimg.com/media/FZWERGlXgAIUVF7?format=jpg https://pbs.twimg.com/media/FZWERGlXgAIUVF7?format=jpg It took me a while to figure out what's going on, these were the steps that I took: 1. Examined the headers which looked legit, because well, it's really from paypal. 2. Googled the phone number, and could not find any mentioning of it on Paypal (though I must say it did seem like a similar number to at least one of Paypal's numbers) 3. Checked Truecaller and found no record of this number (I later updated this number description to alert other people from phishing attempts. 4. Logged in to my account, just to make sure (without clicking the link), and found no evidence of any funny activity. 5. Googled the phishing text and could not find relevant results, yet Paypal itself did have a page with very similar text (well thought out phishing attempt) 6. I stripped the link from all query strings, opened it in incognito, and voila, I saw that it's an invoice page that anyone can access and pay. 7. I tried to click the "Feedback" button on that page, which I expected to show me an option to report a phishing attempt but instead it just did nothing, absolutely nothing, on both FF and Chrome (not even a console error that I can remember seeing). Some conclusions: 1. Paypal are using _exactly_ the same email address for invoice notifications as other formal emails that I get from Paypal. 2. Paypal are not framing the invoice in any way to indicate that it's originated from the invoice sender, thus allowing fraudsters to convey the same official tone as the rest of their email. 3. Phishing@paypal.com is how you report phishing attempts to Paypal though they do I'm not sure what effect reports have.