How do they spoof emails to not trigger any spam filter? I know you can change the headers but I thought email providers protected against that
The vector here is:
1. Create a PayPal account. 2. Create an invoice through PayPal's invoice tool and send to nabakin@example.com. 3. PayPal sends an email to notify the recipient of the outstanding invoice.
When PayPal detects fraudulent invoices are generated, they cancel those invoices so consumers no longer see them and can no longer pay on them; however, it's too late to stop the emails.
The sample I reviewed had been set to an account belonging to (or compromised by) the scammer, modified slightly, and BCC'd to the victim. Specifically, a Reply-To header was added - PayPal does not assert non-existence of a reply-to header in their DKIM signature, and the entire point of BCC is that it doesn't have a header.
Thus, these emails can be relayed to any target, and the scammer can choose any reply-to address they like, and the DKIM signature will still be valid.
If anyone has samples and can send me them with full headers, I would be very interested to examine more. I have a public email address in my HN profile.