In Connecticut, a vintage furniture shop called Palomino Bazaar discovered its name on more than 200 fake PayPal invoices sent to people across the U.S. The owner, Kate Ferguson, wasn’t chasing payments—her business was inactive. But her inbox and phone lit up anyway: confused strangers, even a whole school district in Pennsylvania, asking about “their” bill.
The invoices looked real and demanded about a thousand dollars. Instead of a normal PayPal button, the message told recipients to call a