0

Is this a scam email or is it a valid email from PayPal?

To: XXXXXX XXXXXX From: PayPal Credit Request attempted on: June 10, 2017

You attempted to open an account or make a purchase using the PayPal Credit payment method on June 10, 2017. We regret that you were unable to use PayPal Credit at that time. As a convenience, we are providing you with immediate access to view the reasons why your request was not authorized. By clicking on the secure link below, you can begin the process of viewing this important information.

View Important Information About Your Request When you applied, you provided certain information about yourself that we will request for verification when you click the link above. After clicking the secure link above, a screen will appear requiring you to enter this information for verification purposes. 

You will have access to this information for up to 180 days from the date of this email using the link in this e-mail. If you wish to continue to have access to this information, you must keep this email, and use the above link to access this information in the future.

Please do not reply to this email. If you are unable to access this information, you will receive a letter within 30 days.

Sincerely,

PayPal Credit 

The lender for PayPal Credit accounts is Comenity Capital Bank

The link points to https://bml.applications.billmelater.com and they want me to put in my birth date and last 4 digits of my SSN. The sender is supposedly from [email protected].

Here is the provided message header:

Return-Path: <[email protected]> Received: from
mx0.slc.paypal.com ([173.0.84.225]) by mx.perfora.net  (mxeueus001
[74.208.5.21]) with ESMTPS (Nemesis) id 0MTydT-1dCYnS2MwD-00Qg0p  for
<[email protected]>; Fri, 16 Jun 2017 07:31:00 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1;
c=relaxed/relaxed;  q=dns/txt; [email protected]; t=1497591058;
h=From:From:Subject:Date:To:MIME-Version:Content-Type;
bh=1QULyOBdV2fQFWq+fY0tQ1diErpOz89Nr0ZW8Q/t9O8=;
b=0yzdRiM1B55ey8LoOBH0iXb3E5yqxdVk1dhjwi9YZem6zKAM8yP6hPvvl9l5Y/EJ
f93DxSsnM5VTd4EQb803oFL05utxp9GmAXiYeAbba+MRVxl/OTGWThQDk1s7SDJQ
DXX9SCHzYzeVZ/5dijQj0aaCrPw7+9Sw0Vm4yn1B0VysSWcnHGJWwbTC9E7NBaFr
A33cVi3lE1uNVJwz8ypxq6RRjMhWYA5Nmhn0RJfE6v8BbRj8HvMKCO4UUrUg/OIb
e+GiqjR5w3gUsvbEuVBF8IlVFzGEeWE+QTuPzkQQPrWwlQ+Pv59dte7O0sZwT682
SJdx1RRSxXOg8mF9mHNhsA==; Received: (qmail 11576 invoked by uid 993);
16 Jun 2017 05:30:58 -0000 Date: Thu, 15 Jun 2017 22:30:58 -0700
Message-Id: <[email protected]> AMQ-Delivery-Message-Id:
EMAILDELIVERY-Notification_EmailDeliveryEvent-185-1497591052064-3809733053
X-PP-REQUESTED-TIME: 1497591050550 X-PP-Email-transmission-Id:
f642bda6-5254-11e7-bd77-5cb90192ccbc PP-Correlation-Id:
ddc61267a22a1bb0 Subject:
=?UTF-8?Q?Request_attempted_on=3A=C2=A0June_10=2C_2017?= X-MaxCode-Template: PPC001143 To: <[email protected]> From:
PayPal Credit <[email protected]> X-Email-Type-Id: PPC001143
Content-Transfer-Encoding: base64 Content-Type: text/html;
charset=UTF-8 MIME-Version: 1.0 Envelope-To: <[email protected]>
X-UI-Filterresults:
notjunk:1;V01:K0:LdGxQFRpRdo=:36HTTy+jN84T1PARbUXaam6TaP 
/vZtms/sJ5AC2EAGL34ilyA8HGVtQHGuD5/MNyrXPgjCBpMgyCf5HXT0oo5T/94SpRqgh+aHZ
PbAK2JatMnw40up2972ATAveQN4ejppluCgm3tglysTaDhCc+oDjbj5+RoLSdGYL3EpL9ZxnH
NaTkIj9JhebaViiAzA1S89Ea4LxXK43tWjyc9GOVWMh55DI8K69/mQW6dCAjnRKk8MGP6iATN
hHYgWOSEMbJy5HPmwSD5ZwC0SIziTpk+TLftmUGRuDIsXNqUKMynyN+W0eljz6zV2rswrCggJ
GdSynaaVXzQ0WrhPjc4uc39PyX3UlrH0SM7cbGbaMfCgQGz3EJHaVkBlomVUgauBUPgDRB4qY
ZN4JNLCxCDciRxWP3p0MtQ95TK8JDfSF9UYBbkPmEjcbgTqFTYYRAtenlyz2HMTRQW6CMyNDD
AxAZndGz5Jo47ZXivbebQnQTOczSTFG/QrO3yY5PJZfLR5MJcDqHqMca0mzO/8PHErOU0H6J1
CNZ9oVDMp76Z3ZMlnwKBr6npVoUEp1qZ8YCeZ5SA657pA+dSM1/JTfFkq7GqkrtRUscQd4V4o
5MmWoPIG0PUYd8DnA5GsoPn4OQd20zk2naYCRKdhr01PWJ7AkrERSJyZGh/9lgg5Kg/u+vxYn
i4oqqi0PEVzfOz/IQvj7l2I0R1ibJKbjGcDZDheLCXwQXzt8fTUQZDD4MLBsNyY+e5lQQcgaZ
RxnT9QI62oXk9pqvlxknzOmLCcA2Xlwimr6WUNcRc6Joh/wgXQUBJRpl3YdOwQ/UDPDhlskag
H5Qls8E1GUcEy6114jBLZsRmexGsklw7qA+UEvRcajBRktYjPewN7YkQVQlp9vhDpSjVf2gtD
WA5lOh0YlkBOxDrv0m1g5iKvpEZRO7IntT0p9kA5bevZtgWHvBQaa+IGDA1F+Ot4ldT2EEVjs
EkKGGhK4JNwdZCaTwmqgyPzDJt3I6wnVdeZIzR77XtDXjv+maDNZ9M4xVNwOW0/puP4rGAXHM
82SGxdPLv/mnEgLe3zTY1sF8D9eU0Bqtvcv9GYcScoz1n2yObr8P4PJ/SqfQJ0vFvT52qxLxG
1/yQa0OLG1UJlqywAqlWAoNmy8DQYZcrXxebyaN+zslBVh/b9iH+tMc3PVcal+0yiET0DOA1g
IVa/ECYMR8PmIywvSZvQBnAdR8OgGAigSIrItxkj6rPxvkfSoeRgwWTmSmD5PzYPxbAWIpQ0f
khmztigydZcMKglCWABd7iXHmmJSrkIW2sXH1G0fIoJ9PVV6nVzOV6fLUNjy5F15m7zoYFDBV
FiJ3896cAvR+sr69vHk+ivbAWg==
Improve this question
4
  • If in doubt you can forward the mail to [email protected] and they will take a look at it. Source: paypal.com/us/webapps/mpp/security/report-problem
    – floworbit
    Commented Jun 16, 2017 at 8:47
  • Did you do a payment on June 10? To start with...
    – Patrick Mevzek
    Commented Apr 22, 2018 at 19:33
  • 1
    @PatrickMevzek question is from 2017, I'm not sure why it's on frontpage. However 74.208.5.21 belongs to 1&1 and I highly doubt that PayPal uses 1&1 to send mails.
    – Tuğberk Kaan Duman
    Commented Apr 22, 2018 at 20:22
  • @TuğberkKaanDuman you highly doubt... is this based on some factual evidence or just gut feeling? As much as I would like to believe that each company handles its outgoing emails sanely I can also see that very often (like everytime ?) companies are using third party to send their emails (for tracking, etc.) and such third parties could use other resources to do their job. So without specific evidences, nothing can be really excluded I fear.
    – Patrick Mevzek
    Commented Apr 22, 2018 at 20:24

2 Answers 2

Reset to default
1

Messages from Paypal are all signed with DKIM and can be verified in a mail client supporting DKIM (like with a Thunderbird extension or within gmail). Also, Paypal has a DMARC policy to reject everything claiming to be from Paypal which is not properly DKIM signed.

Based on the current information it can not be said for sure if this is a scam or not but it definitely looks at least suspicious. More information might be provided if the full and original source code of the mail is provided, i.e. including the mail header and without any alterations. Then one could check if the mail contains a DKIM signature and if this signature is valid.

EDIT: based on the provided message header (which is missing essential line breaks) one can see that there is a DKIM signature used. Also the rest of the header look like the ones I usually get from Paypal and the source IP (in the first request header) suggests that the mail was send from a mail server belonging to Paypal. This makes it likely that the mail is not a scam. But it does not prove it since based on the currently provided information (messed up mail header, no mail body) the DKIM signature can not be validated.

Improve this answer
5
  • Message header added to OP.
    – Daniel Harris
    Commented Jun 16, 2017 at 6:35
  • @Daniel: see edit.
    – Steffen Ullrich
    Commented Jun 16, 2017 at 6:53
  • DKIM could be compared to the ones in other received from paypal messages.
    – Overmind
    Commented Jun 16, 2017 at 12:35
  • @Overmind: A DKIM signature includes a hash over header parts and the body. Since another mail from Paypal has pretty sure a different mail body and header you cannot take another mail as reference to check the DKIM signature for this one.
    – Steffen Ullrich
    Commented Jun 16, 2017 at 13:45
  • True, I confused it with something else, too tired I guess.
    – Overmind
    Commented Jun 19, 2017 at 11:30
0

Billmelater.com is owned by PayPal.

Looking at the headers, I don't see anything alarming as the IPs (and DKIM references already mentioned, though it won't do much if your mail provider doesn't check them) all point to PayPal.

I'd be cautious but lean towards it being legitimate. If you haven't tried to purchase anything using PayPal Credit / BillMeLater then I wouldn't recommend following the directions. Best case, would be going directly to Paypal / Billmelater's site and trying to login from there. That's a habit you should make even in the case of emails your certain are legitimate.

The only real red flag for me here is that BillMeLater's homepage says the site doesn't exist anymore since it has been rebranded as Paypal Credit.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .