Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe “Set up your account profile” email reported in September 2025 is a PayPal phishing scam. It claims a $910.45 Kraken.com charge, gives a phone number for “disputes,” and pressures you to act within 24 hours. Do not click its link, call its number, or reply. Malwarebytes found that the button could open PayPal while starting an unexpected secondary-user setup, illustrating why a genuine-looking PayPal domain does not make an email safe.
What the PayPal account-profile scam says
Malwarebytes reported on September 3, 2025 that scammers sent messages with the subject “Set up your account profile” (also seen as “Set up your PayPal account profile”). The sample claimed that PayPal had detected a $910.45 payment-profile charge at Kraken.com and told the recipient to call (805) 500-8413 or use a profile-setup link before it expired in 24 hours.
As an Amazon Associate I earn from qualifying purchases.
The subject implies routine account maintenance, while the body describes an urgent cryptocurrency transaction. That contradiction is a warning sign: the message is trying to create panic and then direct you to the attacker’s preferred contact or action.
Malwarebytes observed displayed sender addresses such as [email protected] and [email protected]. The report also noted generic or missing greetings, unusual recipient addresses involving .test-google-a.com, and wording that was awkward without necessarily containing obvious spelling mistakes. The evidence described activity for at least a month before publication; it does not establish that the identical campaign is still operating today.
Why a PayPal-looking sender address proves nothing
The address shown in an email client is a display identity, not proof of who sent the message. Malwarebytes said the PayPal address in this campaign had been spoofed. In general, authentication checks such as SPF, DKIM and DMARC evaluate the sending infrastructure, while the destination and behavior of a link determine what happens after a click. A familiar logo or address cannot substitute for independent verification.
PayPal’s U.S. guidance says authentic emails include your full name or business name exactly as shown on the account. That is a useful clue, not an infallible test: personalized messages can still be malicious, and formatting can be altered in forwarded or compromised mail.
The unusual danger: a genuine PayPal destination can still be abused
According to Malwarebytes’ investigation, the button in this campaign led to PayPal and initiated a workflow for adding a secondary user instead of resolving a Kraken charge. This behavior is a reported characteristic of that campaign, not a guarantee that every copy of the email or every PayPal account behaves identically.
A link can therefore be dangerous even when the final domain is genuine. It may:
- Use an already-authenticated browser session.
- Open a privileged settings or user-management screen.
- Start an account action you did not intend to approve.
- Exploit your expectation that you are merely checking a transaction.
Malwarebytes said a secondary user could potentially issue payments, creating a route for an attacker to move money. That is a possible impact mechanism, not proof that every recipient lost funds. Clicking, opening a page, starting the workflow, approving a new user, disclosing credentials or codes, and seeing an unauthorized transaction are separate risk levels.
Red flags in this campaign
| Signal | Why it matters |
|---|---|
| Unexpected $910.45 cryptocurrency charge | Creates fear and makes unfamiliar activity harder to evaluate. |
| Twenty-four-hour deadline | Suppresses careful checking and independent login. |
| Phone number supplied in the email | Can divert you to a fake-support operator. |
| Subject/body mismatch | Routine profile setup conflicts with an urgent payment warning. |
| Generic greeting or odd recipient address | Does not match the account-specific communication a real service may use. |
| Link that starts an unexpected workflow | A genuine domain can still perform an unauthorized account action. |
Poor grammar is not required for phishing. Familiar branding, a personalized greeting, or paypal.com somewhere in a URL is not conclusive evidence of safety.
How to check whether the alleged charge is real
- Ignore the email’s link and phone number.
- Type
paypal.comyourself or open the official PayPal app. - Sign in and inspect notifications, recent activity, linked payment methods, users, contact details and security settings.
- Use PayPal’s official Help Center or Resolution Center if an issue appears.
PayPal says suspicious emails should be forwarded in full to [email protected] without changing the subject or sending the message as an attachment. Delete it after forwarding. Do not use a search-ad phone number as a substitute for navigating to PayPal directly.
Recommended Free Tools
What to do if you have not clicked
- Do not click, call, reply, download attachments or provide information.
- Forward the complete message to
[email protected]. - Check your account independently as described above.
- Delete the message after reporting it.
What to do if you clicked
You opened a page but entered nothing
Close it, sign in through the official site or app, and review recent activity and settings. Look specifically for an added secondary user, email address, phone number, payment method or shipping address. If you are unsure what the page did, change your PayPal password and enable two-step verification. Also review the security of the email account linked to PayPal.
You entered a PayPal password
Change the password immediately from the official PayPal site or app. Change it anywhere else you reused it, including the associated email account if applicable. Then enable two-step verification, review account changes and contact PayPal through an official support channel. PayPal’s security guidance warns against password reuse.
You entered a two-step-verification code
Treat the account as potentially compromised. Change the PayPal password, inspect every account change and contact PayPal immediately. PayPal says it will not ask for a two-step code by phone, email or text.
You approved a new user or other account change
Remove any unknown or unnecessary user, review that user’s permissions and inspect payment and audit activity. Business accounts should involve the administrator and follow internal approval procedures for transfers or new payees.
An unauthorized transaction appeared
Log in directly and report it through the Resolution Center. Check for changed email addresses, phone numbers, mailing addresses, users and payment methods; change passwords, PINs and security questions; and secure the linked email account.
A file or suspected malware was downloaded
Stop using the device for sensitive account activity until it is checked. Disconnect it if appropriate, run a reputable security scan, update the operating system and browser, and change passwords from a separate trusted device. Contact financial institutions if payment credentials may have been exposed. The reported PayPal campaign describes phishing and account manipulation, not a confirmed malware payload.
Does “paypal.com” in the link make it safe?
No. Check the registered domain, not just a word appearing in the address. A URL such as paypal.example.com is controlled by example.com, not PayPal. Redirects can also hide an intermediate service. Most importantly, even a legitimate PayPal page can begin an action you did not request, as Malwarebytes reported in this campaign. Verification means logging in independently and checking what PayPal itself shows in notifications and activity.
Who may be at risk?
Any PayPal user who receives the message could be targeted. Malwarebytes suggested that unusual recipient addresses may reflect purchased or stolen address lists associated with PayPal use. Receiving the email does not prove PayPal was breached, that your account was compromised, or that the sender obtained your information from PayPal. Bulk targeting, leaked data, marketing lists and prior service use are all possible explanations.
Scams also mutate. A later version may use a different amount, phone number, cryptocurrency, refund, suspension warning, new-device alert or expiring profile link. Evaluate the pressure, callback request, mismatch and account behavior rather than searching for an exact phrase.
Extra precautions for business accounts
Business administrators should review every login and permission, remove unknown or unnecessary secondary users, limit who can add users or initiate payments, and require approval for new payees and large transfers. Use separate administrator accounts, unique passwords and audit-log reviews. PayPal’s business payment documentation describes separate logins and permission-based access, which makes an unexpected secondary-user workflow especially significant for business accounts.
Official help and reporting links
- Report suspicious PayPal messages
- Report fraud or unauthorized activity
- Protect your PayPal account and set up two-step verification
- PayPal Security Center
The current U.S. browser path for two-step verification is Settings (gear icon) → Security → Set Up under 2-step verification, then choose an authenticator app or SMS option. Labels can differ by country, account type, device or later redesigns.
Frequently Asked Questions
Was PayPal hacked because I received this email?
There is no evidence in the cited report that this campaign resulted from a PayPal breach. Receiving it does not by itself show that your PayPal account was compromised.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What if I called the number in the message?
End the call and contact PayPal through its official site or app. If you disclosed a password, verification code, remote access or payment information, change credentials immediately and report any resulting activity.
Should I contact my bank?
Contact your bank or card issuer promptly if an unauthorized PayPal transaction occurred or payment credentials may have been exposed. Also report the transaction to PayPal through the Resolution Center.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
