The content of this article is provided for informational purposes only. You should always obtain independent business, tax, financial, and legal advice before making any business decision.
Fraud surged by 25% in 2024 compared to the previous year, showing just how much craftier fraudsters are getting.1 Empowered by technologies like AI, scammers will pose as trusted partners, vendors, or even colleagues to trick businesses into handing over money or sensitive information.
Given the financial stakes involved, protecting your business from common scams is essential. But what is phishing? What is spoofing? And how do you recognize their red flags before it’s too late?
If you suspect fraud or a security issue associated with your PayPal account, visit our Security Center for help. Otherwise, keep reading to learn how to strengthen your defenses against phishing and spoofing attacks.
Phishing is a type of online fraud where scammers attempt to trick you into revealing information such as your login credentials, credit card information, or other sensitive data.
But how does phishing work? A phishing attack often relies on social engineering tactics, such as creating a sense of urgency to get someone to take action. This could mean tricking you into clicking a link that goes to a spoofed website, downloading malware, or responding with confidential information.
To strengthen your phishing defense, watch out for messages that ask for personal information like credit or debit card numbers, bank account information, driver's license numbers, passwords, or your full name.
And when you suspect an email is fake, don't open it, reply to it, click on any links, or download any attachments. Instead, report the email to your IT security team or directly to the service the scammer is impersonating.
Tip: If you receive an unexpected PayPal notification via email, proceed with caution. PayPal will never ask for sensitive information in an email. Always verify every payment notification by logging in to your account and locating the corresponding transaction. All transactions (even pending ones) sent by you or to you will show up in your transaction history.
Spoofing is a deceptive tactic where fraudsters disguise their email address, name, phone number, URL, or other identifying information to make you think you're interacting with someone else. Essentially, they “spoof” their identity — much like an impersonator — so their messages look authentic.
Phishing attacks often use spoofing to appear to be from a legitimate organization. Oftentimes, it comes in the form of an email or text message from someone you're likely to trust, such as your bank. It then asks you to click a link to take action.
For example, you may be prompted to update information or check on a transaction. However, the link actually directs to a fake website that collects your login information, which the fraudsters then use to access your account.
While you may now be familiar with the answer to questions like “What is phishing?” and “What is spoofing?”, it’s important to note that these aren’t one-size-fits-all scams. Cybercriminals use different tactics depending on their target, the platform, and their end goal. Some attacks cast a wide net, while others are highly targeted and personalized.
Here are the most common types of phishing attacks to familiarize yourself with.
Spear phishing is a targeted form of phishing where scammers focus on specific individuals rather than sending mass phishing emails. Unlike traditional phishing, which casts a wide net hoping for any victim, spear phishing is more precise — like a spear hunter targeting a single fish.
For example, a spear phishing attack might send a fake email to your accountant that appears to come from the business owner. The email might ask for a login password or perhaps include an invoice with instructions to pay it immediately. Since it appears to be coming from the boss, the accounting department may be more likely to fall for the scam, especially if it includes personalized information that can be easily gleaned from social media or an online search.
By tailoring their approach, they increase the chances of deceiving their target, making these cams harder to detect and more dangerous for businesses.
Whaling is a subset of spear phishing that targets high-level people in your organization, such as the owner, CEO, CFO, or other senior executives. Just as spear phishing refers to targeting specific individuals, whaling takes it a step further by going after the "big fish."
These attacks can be particularly damaging since executives have access to critical company assets. An example of a whaling attack may be someone impersonating the CEO, asking the CFO for sensitive login information or trade secret information. Because executives are busy and often respond to emails on their phones between meetings, they may not give the email the scrutiny it deserves.
To defend against spear phishing and whaling attacks, train employees with access to sensitive information to be especially on guard. Any urgent or unusual requests should be followed up with the person requesting the information.
Smishing is a form of SMS phishing where scammers use text messages to steal personal information, such as login credentials or financial details. The term, as you might guess, comes from combining "SMS" and "phishing.”
These messages often impersonate financial providers, delivery services, or government agencies to create a sense of urgency and pressure the recipient into clicking a malicious link. For example, a smishing attack might involve receiving a text from your bank asking you to review a transaction by clicking a link, which then sends you to a spoofed website that harvests your login information.
To defend against smishing, don't click on any links that come from an unidentified source or number. If you think the request may be legitimate, contact the purported sender directly through a known phone number to confirm.
Vishing (or voice phishing) combines “voice” and “phishing,” and is a type of scam where a fraudster uses phone calls — either automated robocalls or live callers — to trick people into revealing sensitive information, such as account details or PINs.
Typically, the calls mention an “urgent account problem” with a bank account, credit card, or other service and ask you to share account information to remedy it. An example of a vishing attempt is if you receive a call about a possible fraudulent transaction on your account that asks you to enter your PIN to hear the transaction details. In reality, the scammer is harvesting your information for fraudulent use.
To protect against vishing, never provide any account information unless you initiate the phone call yourself. Caller IDs are also easily masked, so don't rely on them to verify the call is authentic.
With search engine phishing, fraudsters will create fake websites that copy a financial institution or retailer, and then use search engine optimization to trick a search engine (like Google or Bing) into displaying the spoofed website instead of the real site in their search results.
For example, an employee searching for the company's bank might get the fake site instead. Once they try to enter their login information into the fake site, the scammers capture that information and use it to log into the searcher's real account.
Protect against search engine phishing by teaching employees to type in the website URL directly instead of clicking on a search result.
Outside the office, individuals can stay safe by bookmarking frequently used websites and verifying URLs before entering login credentials. Additionally, enabling two-factor authentication (2FA) on sensitive accounts can help prevent unauthorized access, even if login details are compromised.
If you think you’ve clicked on a bad link, don’t panic. That said, you’ll want to act quickly to minimize potential damage from malware — malicious software designed to steal data, spy on activity, or even lock you out of your own system. Some types of malware can silently track your keystrokes, capturing passwords and financial details, while others can install ransomware or unwanted programs without your knowledge.
Take these steps as soon as possible:
For effective risk management and phishing protection, schedule regular antivirus scanning to detect threats before they become serious. Most antivirus programs allow you to set up automatic scans on a daily or weekly basis.
Scammers often try to impersonate PayPal through phishing emails, spoofed websites, and fake text messages, making it crucial to verify the legitimacy of any communication. Fortunately, PayPal has strict security measures in place to protect our customers and ensure safe interactions:
If you receive an email that looks like it’s from us but seems suspicious, follow these steps immediately to report to PayPal:
To help prevent cybercriminals from using phished information in a transaction with your business, the following tools are available through PayPal and other fraud prevention and management vendors:
Even the most cautious individuals can occasionally fall for a spoofed website or deceptive phishing attempt. To reduce risk while browsing (and take away some of the stress), consider using site safety rating tools to identify potentially harmful websites:
These services collect reports about suspicious sites and rank them. They can't catch every bad link, but they can be a good first line of defense.
If you're running an online business, keep in mind that there are other types of fraud you need to watch for. Cybercriminals are constantly refining their tactics, targeting businesses through chargeback fraud, fake invoices, and account takeovers.
That said, phishing and spoofing remain among the most deceptive and damaging fraud tactics. Luckily, using antivirus software, investing in risk management services, and training employees to spot red flags can make all the difference in keeping your accounts and data safe.
Most importantly, when in doubt, always verify before you click, respond, or share information. A cautious approach can be the key to avoiding scams altogether.
Check out more fraud prevention best practices.
In partnership with three expert business owners, the PayPal Bootcamp includes practical checklists and a short video loaded with tips to help take your business to the next level.
If you accept cookies, we’ll use them to improve and customize your experience and enable our partners to show you personalized PayPal ads when you visit other sites. Manage cookies and learn more