I receive them too. They indeed come "From: <service@paypal.com>", but the dead giveaway is that the recipient is "To: fred smith <order_status10@jwa.onmicrosof

I receive them too. They indeed come "From: <service@paypal.com>", but the dead giveaway is that the recipient is "To: fred smith <order_status10@jwa.onmicrosoft.com>". I'm NOT "fred smith" or any of the other random names they use. The emails arrive from the onmicroft.com servers, not the PayPal servers. It looks like they create the fake account at onmicrosoft.com, then have paypal send an email to that account and then make onmicrosoft.com forward it to all their intended victims.