All scamsPhishing

PayPal invoice scam

A real PayPal invoice for something you never bought, with a phone number to 'cancel' it.

How it works

Scammers abuse PayPal's genuine invoicing feature, so the email really does come from paypal.com and passes every authenticity check. The invoice — often for antivirus software or a large purchase — includes a note: 'Call this number if you didn't authorize this.' Calling connects you to the scammer, who refunds you 'by mistake' too much, or asks you to install software or share card details.

Red flags

  • An invoice or money request for something you never ordered
  • A phone number inside the invoice note urging you to call
  • Pressure to act before a deadline to avoid the charge
  • The 'agent' asks for remote access or card numbers to process a refund

Real-world example

"Invoice from Norton Security LLC — $399.99. Note: Your subscription renews today. If you did not authorize, call our cancellation team at (8xx) xxx-xxxx within 24 hours."

What to do

  1. 01Don't call the number in the invoice — log in to PayPal directly and check your activity.
  2. 02An unpaid invoice charges you nothing; simply report and decline it in your account.
  3. 03Report the invoice to PayPal through their official phishing report address.
  4. 04If you paid or shared details, contact your bank and PayPal support immediately.

Related scams

Got a message that looks like this?

Paste it into the detector for a personalised analysis and next steps.

Open the detector

Weekly scam alerts

The scams to watch this week, in your inbox.

A short Friday email with the most-reported new tactics. No spam, unsubscribe anytime.