The holiday shopping rush is right around the corner. Unfortunately, online fraudsters are already ahead of the curve. Security experts are warning consumers about a sophisticated new wave of scams targeting PayPal users, powered by generative artificial intelligence.
This year, the threat centers on highly convincing “refund” schemes. Attackers are using AI to mimic legitimate customer service agents, tricking victims into purchasing or handing over PayPal gift cards. It is a modern twist on an old con, but the technology involved makes it far more dangerous.
The Evolution of the Refund Trap
Historically, phishing scams were relatively easy to spot. They often featured spelling mistakes, clunky graphics, and suspicious email addresses. Generative AI has changed all of that. Today, malicious actors use large language models to draft flawless, highly personalized messages that look identical to official communications from PayPal.
According to a new report by cybersecurity firm SentryOps, these attacks often start with an automated alert. The victim receives an email or a text message claiming their account was double-billed for a recent purchase. To claim their refund, they are directed to contact a helpline or click a secure link.
“The sheer speed and quality of these messages are unprecedented,” says Marcus Vance, lead threat analyst at SentryOps. “The AI translates templates instantly, adapts the tone to match the target’s regional dialect, and even crafts real-time responses to questions. It feels entirely human.”
Why Gift Cards are the Target
Once the victim engages, the scam takes a specific turn toward digital gift cards. The AI-guided “agent” explains that due to a temporary system glitch, the refund cannot be processed directly back to a bank account or credit card. Instead, the victim is instructed to purchase a digital PayPal gift card to verify their identity and clear the pending balance.
Once the victim buys the card, the scammer asks for the redemption code or PIN to “activate” the transfer. As soon as those numbers are shared, the money is gone forever.
Gift cards remain a favorite tool for cybercriminals. Unlike credit card transactions, gift card payments cannot be reversed. They are virtually untraceable once redeemed, allowing thieves to launder the stolen funds across various online platforms in minutes.
A Growing Threat in 2026
SentryOps reported a massive 142% spike in AI-generated phishing campaigns over the last quarter. The average financial loss per incident has climbed to $430, a painful hit for families gearing up for holiday shopping.
The use of deepfake voice technology has escalated the risk. If a user calls the helpline provided in the phishing email, they might not talk to a cheap chatbot. Instead, they interact with an AI voice agent that sounds like a professional, friendly support worker based in their own country. The system can even handle complex, natural conversations, answering objections without missing a beat.
“We are seeing tools that can mimic human hesitation, breathing, and keyboard typing noises in the background,” Vance explains. “It strips away the usual red flags that people look for. You think you are speaking to a representative in a quiet call center, but you are talking to a server running in an offshore basement.”
How to Protect Yourself
Staying safe requires a mix of skepticism and strict security habits. Experts recommend keeping these key rules in mind:
- Never use gift cards for verification: No legitimate business, including PayPal, will ever ask you to buy a gift card to receive a refund or secure your account.
- Go straight to the source: If you receive a suspicious alert, do not click any links or call the numbers provided in the message. Log in directly through the official PayPal app or website to check your status.
- Enable multi-factor authentication: Adding an extra layer of security to your account makes it much harder for scammers to gain access, even if they manage to steal your login credentials.
As the holiday season approaches, vigilance is your best defense. If an offer or refund process feels overly complicated or requires buying gift vouchers, pull back. It is almost certainly a trap.
About the Author
