[ale] I'm sure it's a phishing attack, but can't see why?

[Phil Turmel]

Multi-step attack leveraging throw-away PayPal accounts.

Step 1: Pretend to be a merchant to get PayPal to send you an invoice 
for something you presumably ordered.

Step 1a: You ignore the bogus invoice.

Step 2: Pretend to be a merchant and file a non-payment complaint for 
the ignored invoice claiming to have delivered some bogus product.

( I get one or two bogus invoices a week.  I use PayPal for certain 
transactions to *receive* money, but very little sending of money. 
PayPal's machine learning algorithms seem to be killing off the 2nd step 
in my cases. )

On 3/13/25 13:28, dj-Pfulio via Ale wrote:
> Always check the message header to see where the email originated.
> 
> On March 13, 2025 12:08:50 PM EDT, Neal Rhodes via Ale <ale at ale.org> wrote:
>> I got yet another email about an alleged paypal dispute.    Which I deleted.
>>
>> But normally I do just hover over the hyperlinks to confirm they are bogus.
>>
>> And the last couple of these, I just can't see where it goes off the rails.   It just looks ok to me.
>>
>> https://www.paypal.com/us/resolutioncenter/PP-R-YSJ-566648816?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000299&utm_unptid=93f1518f-001e-11f0-b526-c57aab365dc0&ppid=RT000299&cnac=US&rsta=en_US%28en-US%29&unptid=93f1518f-001e-11f0-b526-c57aab365dc0&calc=f695230a25ca0&unp_tpcid=Disputes-PPC001688&page=main%3Aemail%3ART000299&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.314.0&tenant_name=PAYPAL&xt=145585%2C150948%2C104038&link_ref=resolutioncenter_pp-r-ysj-566648816 [1]
>>
>> What am I missing?
>>
>> Links:
>> ------
>> [1] https://www.paypal.com/us/resolutioncenter/PP-R-YSJ-566648816?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000299&utm_unptid=93f1518f-001e-11f0-b526-c57aab365dc0&ppid=RT000299&cnac=US&rsta=en_US%28en-US%29&unptid=93f1518f-001e-11f0-b526-c57aab365dc0&calc=f695230a25ca0&unp_tpcid=Disputes-PPC001688&page=main%3Aemail%3ART000299&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.314.0&tenant_name=PAYPAL&xt=145585%2C150948%2C104038&link_ref=resolutioncenter_pp-r-ysj-566648816
>>
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> https://mail.ale.org/mailman/listinfo/ale
>> See JOBS, ANNOUNCE and SCHOOLS lists at
>> http://mail.ale.org/mailman/listinfo