That PayPal Invoice for Something You Didn't Buy Is a Scam. Here's the Twist
Fake PayPal invoice and payment emails often come from PayPal's real servers, which is what makes them dangerous. How the scam abuses genuine invoicing and how to check it safely.
A PayPal email showing an invoice or payment for something you never bought, often a few hundred dollars of crypto or electronics, with a phone number to "dispute" it, has a nasty twist: it is frequently sent from PayPal's genuine servers. Scammers create a real PayPal invoice or money request and send it to you through PayPal itself, so the email passes every authentication check and really does come from paypal.com. The scam is not the email; it is the phone number.
How the genuine-invoice trick works
Anyone can open a PayPal account and send an invoice or money request to any email. The scammer sends you one for a scary amount with a note like "Unauthorized charge? Call 1-8XX...". You panic, call to dispute a charge you never made, and reach a fake "PayPal agent" who walks you through "reversing" it, which is where the real theft happens: remote-access software, a staged overpayment, or gift cards.
Check it the safe way
Never call the number in the email
Real PayPal support is reached only through the app or paypal.com, never a number a message hands you.
Log in to PayPal yourself
Open the app or type paypal.com. If there is no such charge in your real activity, it does not exist. An unpaid invoice you ignore simply expires.
Don't pay an invoice for nothing
An invoice is a request, not a charge. Ignoring a fraudulent one costs you nothing.
Report it to PayPal
Forward the email to phishing@paypal.com so they can shut the sending account.
The version that is spoofed
Some fake PayPal emails are the ordinary kind, spoofed and sent from a lookalike domain with a phishing link to a fake login page. For those, the header and domain checks in our email-tracing guide catch them instantly: real PayPal mail comes from paypal.com and authenticates. If you ever do want to know who is behind a specific sender address, a reverse email lookup can help, but with genuine-server PayPal invoices the answer is simply another scammer's throwaway PayPal account.
Run a private check on any phone number
Get a 60 second report with possible owner, line type, location signals, and risk indicators. The phone owner is not notified.
Run a checkFrequently asked questions
The email really came from PayPal. How is it a scam?
Scammers send real invoices and money requests through PayPal's own system to any email, so the message authenticates as genuine. The scam is the phone number and the fake dispute process, not the email's origin. Ignore or cancel the invoice; never call the number.
Did I actually get charged?
Log in to PayPal directly, through the app or paypal.com, and check your activity. An invoice or money request is not a charge; it is a request you can decline or ignore, and a fraudulent one expires on its own.
How do I tell a spoofed PayPal email from a real one?
Check the sender domain and headers: genuine PayPal mail comes from paypal.com and passes authentication. Lookalike domains or failed authentication mean it is spoofed. But note that some scam invoices come from the real PayPal, so also verify by logging in yourself.
Related articles
The 'Your Account Was Compromised' Email: Phishing Explained
Emails warning that your account was hacked or suspended are the most common phishing template. How to tell a real security alert from the bait, and what the login link really does.
The Sextortion Email Scam: 'I Recorded You' Explained (2026)
The sextortion email that claims to have webcam footage and demands Bitcoin is a mass bluff. Why it names your real password, why it's empty, and what to actually do.
How to Trace Where an Email Really Came From
The sender name on an email is trivial to fake. How to read email headers to find the real origin, tell spoofing from a genuine sender, and identify who is actually behind a message.
Fake Amazon Order Texts: The Refund Scam Explained (2026)
Texts and calls about a suspicious Amazon order or an iPhone purchase you never made are refund scams. How the fake-order script works and how to check the number behind it.
Check the number. Know more.
Run a private 60 second report. The phone owner will not be notified.
Start your check