“The email, the URLs, and everything else is perfectly valid,” Windsor explained, and when you click on the link (don’t do that,) the victim is redirected to a PayPal login page showing a ...