--- title: "PayPal Phishing Nibble | DuoCircle" description: "I just ran across this site Phishing Site in our spam quarantine folder." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/" --- Quick Answer A PayPal phishing campaign caught in DuoCircle's spam quarantine illustrates the 'nibble' technique: each screen asks only for as much information as the victim is comfortable giving at that step, deferring more sensitive prompts (date of birth, full card details) to later screens that feel like routine verification. Across the full flow, the attacker would have collected PayPal credentials, physical address, full name, credit card number with CVV and expiration, and date of birth. The kit replicates the PayPal login on the first screen, then a 'verify your account' page for card details, then a 'Verified by Visa' page (with minor typos but accurate Verified by Visa branding) for the 3-D Secure step. Page transitions and loading states were polished enough to avoid suspicion. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fpaypal-phishing-nibble%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=PayPal%20Phishing%20Nibble&url=undefined%2Fblog%2Fphishing-protection%2Fpaypal-phishing-nibble%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fpaypal-phishing-nibble%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fpaypal-phishing-nibble%2F&title=PayPal%20Phishing%20Nibble "Share on Reddit") [ ](mailto:?subject=PayPal%20Phishing%20Nibble&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fpaypal-phishing-nibble%2F "Share via Email") ![DuoCircle blog post image](https://media.mailhop.org/duocircle/images/2017/05/PayPal_Phishing_Nibble_-_DuoCircle.png) I just ran across this site Phishing Site in our [spam quarantine folder](/email/smart-quarantine/), the sender had targetted a few thousand users on the system over the course of a few days. The thing that I found most interesting about this particular Phishing site is what I like to call the **nibble**. **Each of the screens asked only for enough information to make you comfortable.** Nothing more, there was no asking for a birthday on the account validation screen, they waited until the next step in the process to ask for information that would immediately cause you to question the validity of the website. They baited the hook and waited for the Phish to come. Please watch the video below. **Had it all worked I would have provided:** - PayPal Credentials - Physical Street Address - First / Last Name - Credit Card, CVV and Expiration Date - My Date of Birth The only thing they did not ask for is mothers maiden name. ### Initial Credentials Page. This served to create trust, looks just like a PayPal login ![](https://media.mailhop.org/duocircle/images/2017/05/Log_in_to_your_PayPal_Account-1024x751.png) ### Internal Page, Verify your account The purpose here is to get you to verify your PayPal account, they already have your username and password to your actual PayPal account on the line before, but now they want your credit card info. ### Internal Page, Verified by Visa There are a few typos, but overall a great page. Nice touch using the Verified by Visa Logo. ![](https://media.mailhop.org/duocircle/images/2017/05/3-D_Security_Auth_.png) I do have to mention that their “loading” and “transitions” between the pages were spot on target. I’ll give them an A for effort. **If you’d like to educate your company on what to be on the lookout for when it comes to [Spear Phishing](/phishing-protection/increased-sophistication-in-phishing-attacks-spells-disaster-for-unprotected-businesses/) please let us know.** ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Phishing 11m AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[ Phishing 5m 10 Applications of ChatGPT that Hackers Are Already Exploiting May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[ Phishing 4m 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[ Phishing 9m 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"PayPal Phishing Nibble","description":"I just ran across this site Phishing Site in our spam quarantine folder.","url":"https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/","datePublished":"2017-05-24T07:01:58.000Z","dateModified":"2025-05-08T15:57:04.000Z","dateCreated":"2017-05-24T07:01:58.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/"},"articleSection":"phishing-protection","keywords":"","wordCount":287,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2017/05/PayPal_Phishing_Nibble_-_DuoCircle.png","caption":"DuoCircle blog post image","width":1246,"height":1064},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"PayPal Phishing Nibble","item":"https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"PayPal Phishing Nibble","item":"https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"PayPal Phishing Nibble","description":"I just ran across this site Phishing Site in our spam quarantine folder.","url":"https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/","datePublished":"2017-05-24T07:01:58.000Z","dateModified":"2025-05-08T15:57:04.000Z","dateCreated":"2017-05-24T07:01:58.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/paypal-phishing-nibble/"},"articleSection":"phishing-protection","keywords":"","wordCount":287,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2017/05/PayPal_Phishing_Nibble_-_DuoCircle.png","caption":"DuoCircle blog post image","width":1246,"height":1064},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```