Scam library · Email & phishing · Banking & payment apps · Tech support
PayPal invoice scam: real PayPal email, fake charge
An email from service@paypal.com, PayPal's real address, says you have a money request or invoice for $599 for a crypto purchase or antivirus plan. In the note field it says: 'If you didn't authorize this, call PayPal at 1-888-...'
This one is tricky because the email really did come from PayPal. Scammers create a free PayPal account, send you an invoice, and put their own phone number in the note.
What the message looks like
From: service@paypal.com (real PayPal email)
Subject: You have a new invoice from Billing Department: $599.99
Invoice: Crypto purchase, 0.0091 BTC · Amount due: $599.99
Seller note: Your payment will be auto-debited within 24 hours. If you did not authorize this transaction, contact PayPal Support immediately at 1-888-555-0129.
How this scam works
Because the email passes all the technical checks, spam filters let it through and the sender looks right. The danger is the phone number. Calling it reaches a scammer who asks for remote access, your PayPal login or your bank details 'to cancel the invoice'.
Nothing is charged unless you pay the invoice. An invoice is a request, not a charge, and you can simply ignore it or decline it in your PayPal account.
The same trick is used with real invoices from other services, like QuickBooks or Square, and with fake 'subscription renewed' messages from tech support scammers.
Red flags
- A phone number written in the invoice's note or 'seller message'.
- An invoice for something you never bought, like crypto or antivirus.
- Claims that it will be 'auto-debited'. Invoices aren't charged unless you pay.
- A seller name like 'Billing Department' or 'Support Team'.
- Urgency to call within hours.
How to tell it’s fake
- Sign in to PayPal by typing paypal.com yourself and look at your activity. An unpaid invoice hasn't charged you.
- Contact PayPal only through the Help center on its website or app.
- Ignore any phone number inside an invoice or note.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you only opened the email, decline or ignore the invoice and report it to PayPal through your account, or forward it to phishing@paypal.com.
If you paid
- If you paid the invoice, report it in the PayPal Resolution Center right away. If you gave bank details on a call, call your bank.
If you shared personal info, a password or a code
- If you gave remote access or your PayPal password, change passwords from another device and get the computer checked.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
In Chrome or Edge on your computer, Scam Guard reads invoice emails you have open in Gmail or Outlook on the web. It recognizes the 'call this number to cancel' trick even when the email comes from a real service, and explains that an invoice isn't a charge. If an email seems legit because it really is from PayPal, an expert second look is exactly what helps.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- The email came from service@paypal.com. How can it be a scam?
- Anyone can send a real PayPal invoice to anyone. The scam is in the note, which the scammer writes.
- Will I be charged if I ignore the invoice?
- No. An invoice is just a request. You have to approve it to pay.
- How do I contact PayPal for real?
- Go to paypal.com or the app yourself and use the Help center.