{"success":true,"data":{"id":"paypal-account-hold-phish","label":"Fake PayPal notice claiming the account has been limited or put on hold due to suspicious activity, requiring information verification within 48 hours to restore access — credential-harvest attack; real PayPal account limitations are communicated through the authenticated PayPal Resolution Center, never via cold email links demanding 48-hour credential re-entry.","description":"Fake PayPal security or account notification claiming the recipient's PayPal account has been limited or put on hold due to suspicious activity, requiring information verification within 48 hours via email link to restore access and lift the limitation — credential-harvest attack. Real PayPal account limitation notices are communicated exclusively through the authenticated PayPal dashboard (Resolution Center at paypal.com) and never require credential re-entry via cold inbound email link under a 48-hour restore-or-suspend deadline. The \"your PayPal account has been limited — verify within 48 hours\" pattern is one of the most consistent PayPal phishing templates across all APWG phishing reports since 2020. Distinct from fake-cashapp-zelle-venmo-1099k-aml-kyc-threshold-lure (KYC/AML 1099-K variant involving multiple platforms) — this targets the PayPal-specific account-limited / account-hold narrative. Detection: PayPal account limited/hold/restricted/suspended + verify information within 48 hours/restore access vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R26; APWG PayPal phishing report Q1 2026; Anti-Phishing Working Group PayPal impersonation trends; FTC PayPal impostor scam advisory.","tier":"danger","category":"phishing","isThin":false}}