Monday, April 28, 2025

A new direction in scams

“Your document has been completed,” the e-mail begins. That would be a Docusign document. Wait a minute: I’ve used Docusign for paperwork concerning my mom’s care. Could this e-mail be real?

The e-mail describes the “document” (a PDF that I did not open) as the record of a PayPal transaction, the purchase of a “Digital Asset (BTC)” — bitcoin. And the e-mail looks real, or almost real. Did someone hack my bank account?

No. The tells:

~ The reply-to address hiding behind the name “Oscar Woodruff” is noreply@nextgensol.online.

~ The e-mail is addressed not to me but to noreply@innocore.store.test-google-a.com. Very strange.

~ The PayPal Support number in the body of the e-mail is +1 (805) 661-1377, a number that appears to be or have been associated with a Low Rider Shop in California. Whatever it is, it’s not the number for PayPal Support, which is 1 (888) 221-1161.

~ The most obvious tell, though, is the e-mail’s opening sentence:

All parties have completed Your Payment Has Been Successfully Processed..
Sic. And oops.

Reminder: when something like this arrives in the mail, do a little close reading. Don’t freak out.

*

After writing this post, I received what might be the most obvious tell of all: two more e-mails with different names but the same identical crap.

comments: 0