[This is a "soft" question and as such I'm not sure it's appropriate for this site. However, it does involve information security.]
I have an email address, firstname.lastname@example.org that is not associated with a PayPal account, but which is associated with my real name. I.e., if you google my name you will find mailing list posts and so on from this address.
On 6/16 I received a pair of strange emails sent to this email@example.com address, which were then auto-forwarded to my main non-gmail address:
21:10 - "joe schmoe sent you $8.00 USD" 21:11 - "joe schmoe canceled this PayPal payment"
A couple of relevant facts/observations:
- I don't know this person joe schmoe (name changed).
- From header is "joe schmoe via PayPal "
I run my own restrictive Postfix server, and the message seems to have passed dkim:
Authentication-Results: mail.mydomain.com; dkim=pass reason="2048-bit key" header.d=paypal.com firstname.lastname@example.org header.b=nxnKW97L; dkim-adsp=pass Authentication-Results: mx.google.com; spf=pass (google.com: domain of email@example.com designates 220.127.116.11 as permitted sender) firstname.lastname@example.org; dkim=pass email@example.com; dmarc=pass (p=REJECT dis=NONE) header.from=paypal.com
This passed spf/dkim at both the Gmail level and my local mail server.
Therefore, it seems like the messages were legitimately from PayPal.
Which in my mind leads to 2 general possibilities
- This was a mere accident, and the person figured it out and caught it.
- This is some kind of sophisticated attempt to hack/steal identity/???
Thanks in advance for any light your expertise can shed on this.