Scams+Security : Email*Text*Calls*Internet*Crypto*Apps*Ads

It'll be there, unless PP have removed it after sending the notification.

It still won't be genuinely owed to the sender, of course. But that's what it relies on - the recipient assuming that it is legit and just paying it.

I've recently taken on a role, "dead man's shoes", with a backlog of email. In there were a stack of scammy-looking debt collector messages. A little digging, and it turned out they were genuine, debt for a server hosting account that everybody assumed had long since been cancelled....

It could also be that sender has been phished, and the scammer has configured the senders email route replies to the email so that the sender does not see them and is thus not aware that they have been phished similarly with the out going emails. Plus the scammer could potenitally have configured an auto response confirming that the original email is real.

One of the things we teach users is that if they want to confirm an email either do it with a known phone number, not one that is in the email, or if doing it by email create a new email thread and don't mention the subject of the orginal email in either the subject or content of the new email.

You are correct, most mobile and tablet email apps don't show underlying email addresses and URLs, one reason why we time phishing simulations to go out after people have left for the day so that they are more likely to see the emails on a portable device.

Thats about they way of things, its no different to invoice fraud using high street banks but potentially much easier to set up. We had a major one locally back where the scammers set up a bank account in the name of a local construction firm and then invoiced all the sites where sign boards were displayed and accompanied the invoices with a change of account notice. By the time it got reported and the bank closed the account the scammers had received and withdrawn tens of thousands pound. It should be noted this was some years back before it became harder to set up bank accounts and the banks became more liable for fraud.

Lucky if any invoices were paid in less than three months from receipt in the construction industry... And gone over with a fine tooth comb to see where they can pare it back!

Correct.

Almost certainly a disposable email and account, the money will quickly be transferred out of PP, and - as you say - sunset...

Remember, a shedload get sent out at zero cost, and it only needs one or two gullible muppets for the scammers to be in profit.