Holiday shopping starts earlier every year. But this year, bad actors are already ahead of the game. The Federal Trade Commission (FTC) issued a stark warning this week about a sophisticated new phishing wave. It targets PayPal users buying or receiving digital gift cards. What makes this threat different is its brainpower. Scammers are now using generative artificial intelligence to craft incredibly convincing traps that are nearly impossible to spot with the naked eye.
The timing of the alert is no accident. With the 2026 holiday shopping rush just around the corner, online transactions are about to skyrocket. Digital gift cards remain one of the most popular presents because they are convenient and instant. Unfortunately, they are also a favorite tool for cybercriminals. Once a gift card is compromised, the funds are usually gone forever. This year, the FTC warns, the threat has evolved.
How the AI-Powered Trap Works
In the past, phishing emails were relatively easy to catch. They often had terrible grammar, weird formatting, or suspicious sender addresses. Generative AI has changed all of that. Today, scammers use advanced language models to generate flawless, highly personalized messages. They can perfectly mimic the tone, layout, and branding of official PayPal correspondence.
According to the FTC, the scam typically starts with an email or a text message. It looks like an automated receipt or a transaction confirmation. The message claims you just purchased a high-value digital gift card—often worth $100 to $250—for a major retailer like Target, Apple, or Amazon. Because you did not make this purchase, your natural reaction is panic.
The email plays directly into this fear. It prominently features a helpful-looking button that says “Not you? Dispute this transaction” or “Cancel order.” Clicking that link does not take you to PayPal. Instead, it directs you to a highly convincing spoofed website. Once there, you are prompted to log in to resolve the issue. If you type in your credentials, the hackers instantly harvest your username and password.
The Bypass of Security Measures
Getting your password is only the first step. Many consumers assume their accounts are safe because they have multi-factor authentication (MFA) enabled. However, the FTC warns that these new AI-driven phishing kits are sophisticated enough to bypass these barriers.
When you enter your login details on the fake site, the malicious system immediately triggers a real MFA code from PayPal to your phone. The spoofed site then asks you to enter that verification code. Once you comply, the hackers use it in real-time to hijack your actual account. Within minutes, they can drain your linked bank accounts, purchase genuine gift cards, and lock you out of your profile entirely.
“These scams are highly automated and run at lightning speed,” says FTC consumer protection specialist Sarah Jenkins. “The AI writes the copy, translates it if necessary, and helps the scammers deploy hundreds of thousands of targeted emails in seconds. It strips away the classic warning signs consumers have been trained to look for.”
How to Protect Your Wallet This Season
With the 2026 holiday season fast approaching, the FTC is urging shoppers to change how they interact with transaction alerts. Staying safe requires a shift in habits.
- Never click direct links: If you receive an unexpected email about a PayPal transaction, do not click any buttons inside the message. Instead, open a new browser window, type in PayPal’s official web address, and log in securely to check your activity.
- Examine the sender’s address closely: While the body of the email might look flawless, the actual sender domain often reveals the fraud. Check for subtle misspellings or unusual domain names.
- Set up push notifications: Use the official PayPal mobile app and enable push notifications for transactions. If a real charge occurs, you will get an instant alert from the app, not just an email.
- Report suspicious activity: If you spot a phishing attempt, report it immediately to PayPal’s security department and file a complaint with the FTC at ReportFraud.ftc.gov.
Cybercriminals rely on speed and panic to make their schemes work. By taking a breath, pausing, and logging in through official channels, you can keep your money safe this holiday season.