Fake PayPal invoice emails: how to tell a scam from a real request

"Your PayPal invoice for $499.99 from Norton Billing is due. If you did not authorize this purchase, call our support team." Messages like this arrive every day, and some of them really do come from PayPal. That's what makes this scam confusing: the email can be perfectly genuine while the request inside it is fraud. This guide shows the three versions, how to check one without risk, and what to do next.

What is a fake PayPal invoice scam?

A fake PayPal invoice scam is an email that bills you for something you didn't buy, using PayPal's name or PayPal's own invoicing service, to make you pay, call a phone number or enter your login details. PayPal's help page on invoice scams says these scams "often try to trick you into sending money to a fraudster," and some aim to get you to call a number and share personal or financial details.

There are three main versions:

The third version overlaps with callback phishing, which covers what happens on the phone. For non-PayPal billing scams, see fake invoice and payment emails.

How do scammers send real PayPal invoices?

Scammers send real PayPal invoices by opening their own PayPal account and using PayPal's normal invoice or money request feature, addressed to your email. PayPal then delivers the message from its own systems, with its normal branding and authentication.

The scam lives in the text the sender controls, especially the note. PayPal warns about "alarmist messages in invoices and money requests warning you to call them quickly," and requests for products or services you never ordered. A typical note looks like this (an invented example):

[Example only]
Note from seller: Your account has been charged $499.99 for
Geek Support Annual Plan. If you did not authorize this payment,
call our Billing Department at +1 (202) 555-0177 within 24 hours.

The FTC described a similar message in a May 2023 alert: a phony PayPal message claimed "BNC Billing cancelled your payment to Binance" and gave "a phone number to reach PayPal…except that's a scam, too."

Why authentication can't stop it

Email authentication proves who sent a message, not whether the request is honest. SPF, DKIM and DMARC check that a message claiming to be from a domain was authorized by that domain. DMARC (RFC 9989) only addresses exact-domain spoofing; it doesn't judge the content.

At the time of writing (October 2026), paypal.com publishes a DMARC policy of p=reject. You can confirm that with the DMARC Checker. That means a forged message using @paypal.com in the From address should be rejected by receivers that enforce DMARC, which pushes forgers to lookalike domains and display-name tricks. A real invoice created by a scammer, though, passes every check, because PayPal sent it.

How can you tell if a PayPal invoice email is fake?

You can tell most fake PayPal invoices by checking three things: whether you recognize the purchase, how the email addresses you, and what it asks you to do. Then confirm inside your account, never through the email.

Red flags:

• A purchase you didn't make, often antivirus, tech support, crypto or electronics, for a few hundred dollars.
• A phone number to "cancel" or "dispute". PayPal says: "Don't call any phone numbers in the invoice note or open suspicious URLs."
• A generic greeting. PayPal says its emails "will always address you by your first and last names or by your business name." A greeting with your name isn't proof either; scammers can include it.
• A request for your password outside PayPal's site. PayPal says it will "only ask you to enter your password on our login page."
• A crypto wallet. PayPal says never to send money to a cryptocurrency wallet mentioned in an invoice or money request.
• Urgency. "Within 24 hours" or "your account will be limited".
• A display name that doesn't match the address. "PayPal Billing" sending from a free webmail account or a domain that isn't paypal.com.

Here's how a request PayPal says is normal compares with the scam pattern:

Check the sender in the headers

For forged messages, the headers show where the email came from. Paste them into the Email Header Analyzer and look at the From domain and the DMARC result. A From domain such as paypal-billing-support.example is fake, however good the logo looks. Our guide to display name spoofing explains the trick. Remember that a pass for paypal.com only tells you PayPal sent it, not that the seller is honest.

What should you do with a suspicious PayPal invoice?

Don't pay, call or click. Check your account through the PayPal app or by typing the address yourself, then report the email. Step by step:

1. Don't use anything in the email. No links, attachments, buttons or phone numbers.
2. Open PayPal yourself. PayPal says to "always log in to your account on the PayPal website or the PayPal app to verify if any action is needed." Check your activity for a real charge.
3. Remember that an invoice isn't a charge. Money only moves if you approve and pay the request.
4. Report the invoice or money request from inside your PayPal account on the website or app.
5. Forward the email to phishing@paypal.com, then delete it, as PayPal asks.
6. Report the scam elsewhere if you want to help. The FTC asks you to forward phishing to reportphishing@apwg.org and report it at ReportFraud.ftc.gov. At work, use your mail app's report button too; see how to report a phishing email.

If you already paid, called or signed in

• You paid the invoice: contact PayPal through the app or website right away and ask about your options. If you paid by card or bank, call your bank on the number on your card.
• You called the number: if you installed anything or let someone connect to your computer, disconnect it from the network and follow the recovery steps in our callback phishing guide.
• You entered your PayPal password on a linked page: change it on the PayPal website or app, turn on 2-step verification, and check for payments or changes you didn't make. If you reuse that password elsewhere, change it there too. Our guide on what to do after clicking a phishing link has the full checklist.
• You lost money: report it at ic3.gov and ReportFraud.ftc.gov, and keep the email with its headers.

How do businesses stop fake PayPal invoices?

Businesses stop fake PayPal invoices mainly with process, because a genuine PayPal message can't be blocked without blocking real PayPal mail. Accounts payable and anyone with a company PayPal login are the targets.

• Pay only against a purchase order or a known supplier. An invoice that arrives with no matching order is checked, not paid.
• Never call numbers from invoices. Use the number in your supplier records or on the provider's real website.
• Keep PayPal access with a few people, each with their own login and 2-step verification.
• Filter the forged versions. Lookalike domains, display-name spoofs and new domains are where an inbound filter helps; see lookalike domain phishing.
• Train with real examples. Show staff a genuine PayPal invoice carrying a scam note, so they learn that a real sender doesn't make a real request.

Next steps

• Share the "don't pay, don't call, log in yourself" rule with anyone who has PayPal access at work.
• Add a fake-invoice example to your next security awareness training session.
• Check a suspicious message's real sender with the free Email Header Analyzer.
• If forged invoices and lookalike senders reach your staff often, iBlockSpam's phishing and spoofing protection filters them at the MX level before they reach the inbox; see how it works.

Browse our other phishing and threat guides.