All scamsPhishing
PayPal invoice scam
A real PayPal invoice for something you never bought, with a phone number to 'cancel' it.
How it works
Scammers abuse PayPal's genuine invoicing feature, so the email really does come from paypal.com and passes every authenticity check. The invoice — often for antivirus software or a large purchase — includes a note: 'Call this number if you didn't authorize this.' Calling connects you to the scammer, who refunds you 'by mistake' too much, or asks you to install software or share card details.
Red flags
- An invoice or money request for something you never ordered
- A phone number inside the invoice note urging you to call
- Pressure to act before a deadline to avoid the charge
- The 'agent' asks for remote access or card numbers to process a refund
Real-world example
"Invoice from Norton Security LLC — $399.99. Note: Your subscription renews today. If you did not authorize, call our cancellation team at (8xx) xxx-xxxx within 24 hours."
What to do
- 01Don't call the number in the invoice — log in to PayPal directly and check your activity.
- 02An unpaid invoice charges you nothing; simply report and decline it in your account.
- 03Report the invoice to PayPal through their official phishing report address.
- 04If you paid or shared details, contact your bank and PayPal support immediately.
Related scams
Got a message that looks like this?
Paste it into the detector for a personalised analysis and next steps.
Open the detector