Am I being PayPal scammed?

April 3, 2019 6:30 PM

Last week I received a mysterious Paypal payment of $30 with the message "Hat. Thank you". I refunded the money and tonight received the same message and money from someone else.

The original message was from what appeared to be a legit PayPal address and used my first and last name in the greeting. I didn't click on any links in the email but logged into PayPal from another browser and saw the $30 payment. I emailed the woman who sent it to inquire and she said" thank you so much, I I sent the money to wrong address, etc." so I refunded the money and thought that was the end of it. Now, a week later, I just received another payment of $30 from a different name and email address with the message. Hat! Thanks".

I've checked my account and the original transaction looks fine. $30 in and $30 refunded. But obviously something is up and I'm wondering what the scam is here. Do I ignore this second payment?

posted by gfrobe to Computers & Internet (10 answers total)

Best answer: I'd reply to the first lady and ask what's going on. I'd refund the $30 too. No point losing sleep over 30 bucks.
posted by bbqturtle at 6:44 PM on April 3, 2019

Best answer: It might not be a scam. Might be something like a Kickstarter or similar where for a $30 donation the person can choose a tshirt or hat, or something, and the PayPal address is just very slightly different from yours. If they are getting thousands of donations/orders, only a very tiny percent would have to make a mistake for this to be occurring to you.
posted by lollusc at 6:53 PM on April 3, 2019 [20 favorites]

I've spent the last year having similar problems, and it's nothing more than confusion on the part of people who are accidentally addressing things to MyEmailAddress when they really want My-EmailAddress. I get file transfers, PayPal payments, invitations, etc. I refund the payments, and most of the time I respond to emails with "wrong address" but if I'm not in the mood I just delete 'em.
posted by BlahLaLa at 7:36 PM on April 3, 2019 [5 favorites]

Do a google search for the mail address associated with your PayPal account and see if it’s appearing anywhere you’re not familiar with.
posted by ardgedee at 7:37 PM on April 3, 2019 [3 favorites]

I didn't click on any links in the email but logged into PayPal from another browser and saw the $30 payment. I emailed the woman who sent it to inquire and she said" thank you so much, I I sent the money to wrong address, etc." so I refunded the money and thought that was the end of it. Now, a week later, I just received another payment of $30 from a different name and email address with the message. Hat! Thanks".

Paypal seems to think it's possible - their website includes an overview of common email scams:

Here are some common scams where fraudsters use spoofed emails: [...]

"You've been paid." Some fraudsters try to trick you into thinking that you've received a payment. They want what you're selling for free. Before you ship anything, log into your PayPal account and check that you were actually paid.

Also, as to potentially bogus links in emails:

If there's a link in an email, always check it before you click. A link could look perfectly safe like www.paypal.com/SpecialOffers, but if you move your mouse over the link you'll see the true destination. If you aren’t certain, don’t click on the link. Just visiting a bad website could infect your machine.

The Paypal website also links to an FBI webpage that provides an overview of Business Fraud scams, including:

Overpayment scheme: An individual is sent a payment significantly higher than an owed amount and is instructed to deposit the money in their bank account and wire transfer the excess funds back to the bank of the individual or company that sent it. The sender's bank is usually located overseas, in Eastern Europe for example, and the initial payment is found to be fraudulent, often after the wire transfer has occurred.

Re-shipping scheme: An individual is recruited to receive merchandise at their place of residence and subsequently repackage the items for shipment, usually abroad. Unbeknownst to them, the merchandise was purchased with fraudulent credit cards, often opened in their name.

posted by Little Dawn at 7:57 PM on April 3, 2019 [1 favorite]

Previously.
posted by jeffamaphone at 8:19 PM on April 3, 2019

Somebody has entered their PayPal address wrong in their eBay seller's account, I reckon.
posted by turbid dahlia at 8:49 PM on April 3, 2019

Response by poster: Thanks all. I took the advice above and wrote to the first person who said she belongs to a club in which members were buying hats from someone with same last night as mine. So looks like an honest mistake. Thanks for the help!
posted by gfrobe at 5:11 AM on April 4, 2019 [8 favorites]

Although it seems to have been an innocent mistake in this case, I would be careful about this scenario in future. You could easily have a scam that looked like this, where someone sends you stolen money, you refund it to them, and the bank then reverses the original transfer. The payment from them to you subsequently gets cancelled by Paypal, but the one you sent them remains in place and came from your own funds - which they are long gone with. Basically the same attack vector as the one where someone sends you a rubber check and persuades you to send them some fraction of the money back.
posted by automatronic at 4:49 PM on April 4, 2019

If they are paying to an email address, it might be worthwhile to change your paypal email address to something else if you can; I have an email address (which forwards to my usual email) that I use only for paypal that isn't related to my names or online handles, so I get very few (basically no) scams that aren't immediately identifiable as such.

I'd think that since PayPal has (or should have) a perfect record of all transactions once the fraudulent funds enters their system, a scam like what automatronic outlined should not be possible, and I suspect that this is likely a scenario that they've encountered before.
posted by Aleyn at 12:56 AM on April 6, 2019