Is this a scam email or is it a valid email from PayPal?

To: XXXXXX XXXXXX From: PayPal Credit Request attempted on: June 10, 2017

You attempted to open an account or make a purchase using the PayPal Credit payment method on June 10, 2017. We regret that you were unable to use PayPal Credit at that time. As a convenience, we are providing you with immediate access to view the reasons why your request was not authorized. By clicking on the secure link below, you can begin the process of viewing this important information.

View Important Information About Your Request When you applied, you provided certain information about yourself that we will request for verification when you click the link above. After clicking the secure link above, a screen will appear requiring you to enter this information for verification purposes. 

You will have access to this information for up to 180 days from the date of this email using the link in this e-mail. If you wish to continue to have access to this information, you must keep this email, and use the above link to access this information in the future.

Please do not reply to this email. If you are unable to access this information, you will receive a letter within 30 days.


PayPal Credit 

The lender for PayPal Credit accounts is Comenity Capital Bank

The link points to https://bml.applications.billmelater.com and they want me to put in my birth date and last 4 digits of my SSN. The sender is supposedly from [email protected].

Here is the provided message header:

Return-Path: <[email protected]> Received: from
mx0.slc.paypal.com ([]) by mx.perfora.net  (mxeueus001
[]) with ESMTPS (Nemesis) id 0MTydT-1dCYnS2MwD-00Qg0p  for
<[email protected]>; Fri, 16 Jun 2017 07:31:00 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1;
c=relaxed/relaxed;  q=dns/txt; [email protected]; t=1497591058;
SJdx1RRSxXOg8mF9mHNhsA==; Received: (qmail 11576 invoked by uid 993);
16 Jun 2017 05:30:58 -0000 Date: Thu, 15 Jun 2017 22:30:58 -0700
Message-Id: <[email protected]> AMQ-Delivery-Message-Id:
X-PP-REQUESTED-TIME: 1497591050550 X-PP-Email-transmission-Id:
f642bda6-5254-11e7-bd77-5cb90192ccbc PP-Correlation-Id:
ddc61267a22a1bb0 Subject:
=?UTF-8?Q?Request_attempted_on=3A=C2=A0June_10=2C_2017?= X-MaxCode-Template: PPC001143 To: <[email protected]> From:
PayPal Credit <[email protected]> X-Email-Type-Id: PPC001143
Content-Transfer-Encoding: base64 Content-Type: text/html;
charset=UTF-8 MIME-Version: 1.0 Envelope-To: <[email protected]>
  • If in doubt you can forward the mail to [email protected] and they will take a look at it. Source: paypal.com/us/webapps/mpp/security/report-problem
    – floworbit
    Commented Jun 16, 2017 at 8:47
  • Did you do a payment on June 10? To start with... Commented Apr 22, 2018 at 19:33
  • 1
    @PatrickMevzek question is from 2017, I'm not sure why it's on frontpage. However belongs to 1&1 and I highly doubt that PayPal uses 1&1 to send mails. Commented Apr 22, 2018 at 20:22
  • @TuğberkKaanDuman you highly doubt... is this based on some factual evidence or just gut feeling? As much as I would like to believe that each company handles its outgoing emails sanely I can also see that very often (like everytime ?) companies are using third party to send their emails (for tracking, etc.) and such third parties could use other resources to do their job. So without specific evidences, nothing can be really excluded I fear. Commented Apr 22, 2018 at 20:24

2 Answers 2


Messages from Paypal are all signed with DKIM and can be verified in a mail client supporting DKIM (like with a Thunderbird extension or within gmail). Also, Paypal has a DMARC policy to reject everything claiming to be from Paypal which is not properly DKIM signed.

Based on the current information it can not be said for sure if this is a scam or not but it definitely looks at least suspicious. More information might be provided if the full and original source code of the mail is provided, i.e. including the mail header and without any alterations. Then one could check if the mail contains a DKIM signature and if this signature is valid.

EDIT: based on the provided message header (which is missing essential line breaks) one can see that there is a DKIM signature used. Also the rest of the header look like the ones I usually get from Paypal and the source IP (in the first request header) suggests that the mail was send from a mail server belonging to Paypal. This makes it likely that the mail is not a scam. But it does not prove it since based on the currently provided information (messed up mail header, no mail body) the DKIM signature can not be validated.

  • Message header added to OP. Commented Jun 16, 2017 at 6:35
  • @Daniel: see edit. Commented Jun 16, 2017 at 6:53
  • DKIM could be compared to the ones in other received from paypal messages.
    – Overmind
    Commented Jun 16, 2017 at 12:35
  • @Overmind: A DKIM signature includes a hash over header parts and the body. Since another mail from Paypal has pretty sure a different mail body and header you cannot take another mail as reference to check the DKIM signature for this one. Commented Jun 16, 2017 at 13:45
  • True, I confused it with something else, too tired I guess.
    – Overmind
    Commented Jun 19, 2017 at 11:30

Billmelater.com is owned by PayPal.

Looking at the headers, I don't see anything alarming as the IPs (and DKIM references already mentioned, though it won't do much if your mail provider doesn't check them) all point to PayPal.

I'd be cautious but lean towards it being legitimate. If you haven't tried to purchase anything using PayPal Credit / BillMeLater then I wouldn't recommend following the directions. Best case, would be going directly to Paypal / Billmelater's site and trying to login from there. That's a habit you should make even in the case of emails your certain are legitimate.

The only real red flag for me here is that BillMeLater's homepage says the site doesn't exist anymore since it has been rebranded as Paypal Credit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .