That PayPal Invoice Is A Scam — How To Tell

An email or app notification says PayPal has an invoice waiting for you — for a product, a service, or a cryptocurrency purchase you never made — and the note inside urges you to call a number right away to cancel the charge before it goes through. PayPal’s own help pages warn about exactly this pattern by name: invoice and money request scams. The calm truth is simple. An invoice is only a request for payment, not proof that money has left your account — and the phone number in the note is the trap, not the help line.

What Arrives

It can arrive two ways, and both are designed to look official. The first is a fake invoice email dressed up to look like a real PayPal message, complete with logos, an invoice number, and a large amount meant to make your heart race. The second is trickier: a scammer creates a real invoice or money request inside PayPal itself, so the notification genuinely comes through PayPal’s system. Anyone can send an invoice to an email address — receiving one does not mean you owe anything, ordered anything, or were charged anything.

Inside the invoice or the email is an alarmist note: your account has an issue, a big charge is about to be completed, call this number immediately to stop it. If you call, the person who answers is not PayPal. That caller’s job is to keep you worried, talk you into sharing personal or financial details, persuade you to let them connect to your computer to “process the refund,” or get you to pay the invoice — or send back a fake over-refund — by gift card, wire, crypto, or a payment app, where the money is gone like cash.

The 5 Red Flags

1. The invoice is for something you never ordered. A product, service, subscription, or crypto purchase you do not recognize is the first sign. A real bill matches a real purchase you can point to; this one matches nothing in your life.
2. The note tells you to call a phone number to cancel or fix it. This is the headline sign in PayPal’s own warning: do not call any phone numbers stated in the invoice note. A legitimate company does not hide its only help line inside an invoice note — that number reaches the scammer who sent it.
3. The message is urgent and alarmist. “Call quickly,” a charge about to complete, an account about to be closed — the pressure exists to make you act before you check. A genuine invoice simply sits there; it cannot hurt you while you take your time verifying it.
4. It asks you to pay, log in through a link, or open an attachment to dispute it. The email version of this scam wants your password or card details on a look-alike page. Never use the links, buttons, or attachments in the message to investigate the message.
5. The “refund” needs remote access, a code, or money sent back. If a caller asks to connect to your computer, read out a verification code, or return an overpayment by gift card or crypto, the call itself is the scam completing. No real refund works that way, ever.

What PayPal Actually Does

Here is the calm version, from PayPal’s own guidance. An unpaid invoice or money request is not a charge — no money moves unless you choose to pay it. PayPal says to verify any claim by logging in to your account on the PayPal website or the PayPal app, reached your own way — by typing the address yourself or opening your saved app — and checking whether any action is actually needed. If a real, completed charge existed, it would appear in your account activity; an invoice sitting unpaid proves nothing was taken. PayPal also asks people to report unwarranted invoices and money requests from inside their account, and to forward suspicious emails to its phishing-report address and then delete them. The Federal Trade Commission gives the same rule for phony company emails generally: the phone number in the message is part of the scam, too.

What To Do Instead

• Do not pay it, do not call the number in it, and do not click anything in the message. Not the links, not the buttons, not the attachments. An ignored scam invoice cannot charge you — it can only wait, and you can simply leave it waiting.
• Check your account your way. Open the PayPal app you already have, or type PayPal’s address into your browser yourself, sign in, and look at your recent activity. If there is no completed payment matching the invoice, nothing was taken from you.
• Report it from inside your account. Report the unwarranted invoice or money request while logged in to PayPal, forward a suspicious email version to PayPal’s phishing-report address, delete the message, and report the attempt to the FTC at ReportFraud.ftc.gov.
• Make your sign-in harder to steal. Turn on two-step verification in your PayPal and email accounts, use a long, unique password for each, and consider a hardware security key such as the YubiKey 5C NFC for your most important accounts, so a stolen password alone is never enough to get in.
• Warn the people who would call. This invoice is built for the moment someone panics and dials. Tell family members the one-line rule: a number inside an invoice is never the number to call.

Already Paid, Called, Or Clicked? Do This Next

First, take a breath. This invoice is engineered to look like it came from a company you trust — some versions are even sent through that company’s real system. Reacting to it is not carelessness; it is exactly what the design counts on. What matters now is acting in the right order, quickly and calmly:

1. Call your bank first. If you paid the invoice, sent money on a call, or entered card or banking details anywhere, call your bank right away using the number on the back of your card, explain what happened, and ask what can still be stopped or reversed and whether your card should be replaced. Speed matters — do this before anything else. Also report the payment inside PayPal as unauthorized activity.
2. Change your passwords. If you entered your PayPal or email password on a page the message led to, change it right away from a clean device you trust, turn on two-step verification, and change any other account where you used the same password. Watch your account activity and statements closely for anything unfamiliar.
3. Get your device checked. If a caller connected to your computer, or you installed anything they asked for, stop using that device for banking, remove what was installed if you can do so safely, and have the device checked before you trust it again, to make sure nothing was left behind.

#ad Disclaimer: As an Amazon Associate and affiliate partner, AOP3D earns from qualifying purchases made through links in this post.

Got a weird text? Describe it in the comments and we'll check it

🧙 AOP3D Tech — Rockport's Tech Wizards · Text 781-507-1606 · aop3d.com