The UIS Service Desk has noticed an increase in phishing emails targeting people’s work emails. A recent scheme involves sending a PayPal invoice. The emails are sent through the same service@paypal.com email address as other account notifications, which might make them seem legitimate. But anyone can send a PayPal invoice and PayPal doesn’t seem to check whether the invoice is legitimate or not.

Avoid this specific attack by not paying any invoice for a product or service you do not recall purchasing. Generally, if you receive an unexpected email or message from a company, you should not click any link in the email. Instead, go to the company’s website directly by typing its URL in your browser. 

Similar scams are also targeting users of the popular money transfer service Zelle. This How-To Geek article on Zelle scams will walk you through its strategy.

What should I do when I receive a suspicious email?

At a minimum, delete the email. You can also report the email to Microsoft by clicking Report Phishing or Report Message in Outlook’s Reading Pane.

The Report Message function offers a few additional options, such as Junk, Phishing or Not Junk. If you select Report Phishing, the email will be deleted and its address blocked from sending you emails in the future. You will then will receive the following message:

Oh no, I opened a suspicious link or attachment! Now what?

Immediately report it as a possible incident. Reporting it immediately allows the information security team to act quickly, determine the level of impact and contain the incident. Visit the Report an Incident web page to learn more.

Information security incidents can happen to anyone. No retaliation will be taken against anyone who, in good faith, reports a possible information security incident.

You can learn more about phishing scams from the Office of Information Security.