A PayPal invoice you did not expect is not proof that you owe money. Don’t pay it, call a number printed in its note, or follow its links. Open PayPal’s app or type its website address yourself to check your account and report the request. The most dangerous scams use a fake invoice to lead into a phone call, remote computer access, or a demand to send money elsewhere.
How to spot the five common PayPal invoice scams
| Pattern | What the message asks you to do | What the scammer may be after | Safer verification |
|---|---|---|---|
| Unsolicited invoice or money request | Pay for something you did not order | Your money | Check activity directly in PayPal’s app or website |
| Alarmist note with a phone number | Call urgently to avoid a charge or account suspension | Personal or financial details | Use PayPal’s official app or website support |
| Fake refund and remote-access trap | Call, complete a form, allow access, then repay an alleged over-refund | Computer access, information, and money | Do not call or grant access; verify through PayPal directly |
| Cryptocurrency payment demand | Send money to a crypto wallet | Funds sent outside PayPal’s ordinary dispute process | Do not transfer; check and report the request in PayPal |
| Vendor invoice or payment-change impersonation | Pay a convincing invoice or redirect payment to a new address | Business funds | Contact the vendor using a number already on file |
1. An invoice or money request for something you never bought
A scammer can send an invoice or money request for a product, service, or cryptocurrency you never ordered. The request may appear in your PayPal account because it is a request for payment, not proof that a purchase took place. PayPal advises customers not to pay an invoice for an unrequested item and to check account activity by signing in through its app or website (PayPal’s scam guidance).
2. An alarming note that tells you to call
Some fraudulent invoices include urgent claims that your account will be charged, restricted, or suspended unless you call a listed “customer service” number. The number is part of the scam: PayPal warns that callers may use it to solicit personal or financial information. Do not call it. Go to PayPal’s official app or website and find support there (PayPal’s scam guidance; PayPal’s phishing guidance).
3. A fake refund that turns into remote access and manufactured debt
This pattern can unfold in stages: an unexpected invoice prompts a call to a fake support number; a person posing as support sends a form or instructions that expose the victim’s computer; then the caller claims the victim received too large a refund and must repay the difference. In a January 2024 case, the FBI described a victim who received an apparent PayPal invoice for purchases she had not made, called the number on it, and was drawn into a scheme involving people posing as PayPal, bank, and government representatives. The FBI said an online form likely gave the criminals computer access before they alleged an over-refund debt (FBI, January 2024). A caller’s claim that you owe money is not confirmation of a real PayPal debt.
Recommended Free Tools
#1 Best Overall
4. A request to send cryptocurrency
PayPal identifies invoices or money requests that direct recipients to pay a cryptocurrency wallet as a scam pattern. Do not send funds to the wallet named in the request. A crypto transfer takes the payment outside PayPal’s normal account and dispute channels, so verify the request directly in PayPal instead (PayPal’s scam guidance).
5. A convincing vendor invoice or changed payment details
Businesses can be targeted by messages that appear to come from a real vendor and request payment on an invoice or provide a new payment address. The FBI describes this as a business email compromise (BEC) pattern: criminals pose as a known source and make a legitimate-looking request. Confirm any new or changed payment instructions using a phone number or contact channel you already had for the vendor—not the details in the message (FBI’s BEC guidance).
What to do with a suspicious PayPal invoice
- Do not act through the message. Don’t pay, reply, click its links, open attachments, or call a number in the invoice or email. PayPal says, “If you receive a suspicious invoice or money request, don’t pay it,” and warns against calling numbers in invoice notes or opening suspicious URLs (PayPal’s scam guidance).
- Check your account independently. Open the PayPal app or type PayPal’s address into your browser yourself. Review activity and invoices there; don’t use a link supplied by the message.
- Report the request to PayPal. Use the reporting option in PayPal’s website or app for the unwarranted invoice or money request. Forward suspicious emails or websites to [email protected], then delete them (PayPal’s scam guidance; PayPal’s phishing guidance).
- For a business payment change, verify out of band. Call a vendor at a previously known number or use another established contact method before changing payment details. Do not rely on the sender’s email address or phone number in the request (FBI’s BEC guidance).
- Report losses or attempted fraud. In the United States, report fraud to the Federal Trade Commission at ReportFraud.ftc.gov. You can also submit a complaint to the FBI’s Internet Crime Complaint Center when appropriate (IC3).
If you called the number or gave remote access
Act promptly, especially if someone controlled your device or you disclosed passwords, financial details, or identity information. Remote access can expose much more than the invoice itself: in the FBI case, it was followed by a fabricated claim that the victim owed money.
- Disconnect the affected device from the internet or network to end an active remote session.
- Preserve the invoice, emails, phone numbers, messages, and other evidence. Do not continue communicating with the caller.
- From a different, trusted device, change passwords for affected accounts, starting with email and financial accounts. Use unique passwords and enable multifactor authentication where available.
- Contact PayPal, your bank, card issuer, or other affected financial institution through a contact method you independently verify. Explain what information or access you shared and ask what protective steps they recommend.
- Report the incident to the FTC and, where appropriate, the FBI’s IC3. If the computer was accessed, seek reputable technical help to check and secure it before using it for sensitive account changes.
Why invoice impersonation deserves attention
FTC data show that about 10,000 consumer reports in 2023 named PayPal as the impersonated company (FTC, 2024). Separately, consumers reported more than $12.5 billion in fraud losses in 2024; reported imposter-scam losses were $2.95 billion, and 38% of people who reported fraud said they lost money (FTC, 2025). These figures cover reported fraud broadly, not losses caused specifically by PayPal invoices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
