The Fake PayPal Invoice Scam: What It Looks Like and What to Do

This scam is sneakier than most, because the email is real. It genuinely comes from PayPal. The sender address checks out, the logo is right, and your spam filter waves it through. And yet it's still a scam.

How the scam works

Anyone can open a PayPal account and send an invoice to any email address for free. That's a normal feature meant for freelancers and small businesses. Scammers abuse it by blasting out invoices for things you never bought: crypto subscriptions, Norton renewals, online purchases you don't recognize.

The invoice does not charge you. It just sits there, asking. But it's dressed up to cause panic, and the "seller's note" adds the hook: if you didn't authorize this, call our fraud team.

That phone number is the actual scam. It doesn't reach PayPal. It reaches the scammer's call center, where a "fraud specialist" will offer to cancel the charge and refund you. To do that, they'll ask for remote access to your computer, your card number, your bank login, or a "verification" payment. Some victims who called about a fake $479 invoice ended up losing thousands.

A second version skips the phone number and includes a "Cancel" or "View Invoice" link that leads to a fake PayPal login page built to steal your password.

The red flags in the example above

• An invoice for something you never bought. Real sellers don't invoice strangers. There's no order behind it.
• A phone number in the seller's note. PayPal doesn't put customer service numbers inside invoice notes. Scammers do.
• "Contact us immediately" language. Panic and deadlines are the signature of every scam.
• A seller name designed to alarm you. "Bitcoin Exchange Ltd" is chosen so you'll think your account was hacked.
• The ask makes no sense. If a charge were really unauthorized, you'd dispute it inside PayPal, not by phoning the "seller" who charged you.

What to do

1. Don't pay it, don't call the number, don't click links in the email.
2. Check for yourself. Type paypal.com into your browser or open the PayPal app and log in. Look at your activity. You'll see the invoice is just a pending request, and no money has moved.
3. Cancel and report the invoice. From your PayPal activity, open the invoice and choose the option to cancel or report it as spam or fraud. That deletes it and flags the sender.
4. Forward the email to phishing@paypal.com, then delete it. You can also report it at reportfraud.ftc.gov.

If you already paid or called

1. Paid the invoice: log in to PayPal, go to the Resolution Center, and open a dispute for an unauthorized or fraudulent transaction. Do this as soon as possible.
2. Entered your password on a lookalike page: change your PayPal password immediately and turn on two-factor authentication in PayPal's settings.
3. Gave card or bank details on the phone: call your bank with the number on the back of your card and ask for a replacement.
4. Allowed remote access: disconnect the device, uninstall the remote-access program, restart, and change your passwords from another device.

The one-sentence defense: a PayPal invoice is a request, not a charge, and anything you need to do about your PayPal account can be done by logging into paypal.com yourself. Everything else is noise.