I would perhaps have expected that email to include some kind of "message from seller: / company: " type subject to at least identify it as such.
This is the real/root issue. I've seen a few of these and the email itself contains no identifying information which increases the phishing risk/suspicion substantially. Both PayPal, and some banks still send emails with buttons like "confirm your account" - it's wild.
And in fact, it should come from some kind of subdomain like "user-service@random-users-can-send-whatever-they-want-from-this-address.paypal.com" and then the header should be "THIS ISN'T AN OFFICIAL PAYPAL EMAIL" etc. etc.
I wouldn't fall for this scam, because I'm technically minded, but a less technical relative wouldn't stand a chance here.
Comments
This is the real/root issue. I've seen a few of these and the email itself contains no identifying information which increases the phishing risk/suspicion substantially. Both PayPal, and some banks still send emails with buttons like "confirm your account" - it's wild.
And in fact, it should come from some kind of subdomain like "user-service@random-users-can-send-whatever-they-want-from-this-address.paypal.com" and then the header should be "THIS ISN'T AN OFFICIAL PAYPAL EMAIL" etc. etc.
I wouldn't fall for this scam, because I'm technically minded, but a less technical relative wouldn't stand a chance here.