When a verified PayPal email becomes a phishing tool

I had to bring this one to PayPal's attention: it looks like you're providing tools for phishing.

I received an email from a PayPal address. It's a valid, verified sender, and the button redirects correctly to the PayPal website and takes you to the message. Someone managed to hack the prompt and behavior to inject their own objective.

Even though it's technically just an invite, a significant number of people are bound to call the phone number in it. Only by looking closely at the message can you tell the template's language apart from the injected placeholders. The email header and subject don't separate the intent, or distinguish PayPal's template message from the abuser's text.

Why I'm posting this

My first reaction was to ignore it, delete the email and carry on with my day. Then I thought about reporting it through official channels, since PayPal runs a bug bounty program. But a quick search shows the scam has been going on for more than two months. Either the company doesn't have the resources to fix it, or the issue couldn't gain enough traction. Hopefully this helps everyone.

Simple fixes

1. Limit the number of characters allowed in a business name until KYC is complete, or at least truncate it in the email.
2. Change the template's subject to separate the invitation intent and name the sender properly. Ideally, never give a third party control of the subject line.
3. Make the email more boring, and highlight the third-party message placeholder more clearly.