So I received an email from "paypal.com" yesterday (and looks like most people did too(1)) and I've verified the ascii letters are indeed what they appear as (No capital I instead of L in paypal.com etc).
The email looks like a very good attempt of being authentic and passes the tests that they teach most people on "how to detect a hoax email":
- Addresses me in my full name
- Good english
- No fake links
- No real links, i.e. asking me to go to paypal instead
- No dangerous call to action
- From address is from a domain paypal controls
- Signed from a domain paypal controls
There are a few suspicious giveaways like the mailed-by address and if you dig in the header, the Return-Path and Receive sections are strange.
Question is how is it possible that they can send a digitally signed email from a domain paypal controls.