The invoice lands in your inbox on a Tuesday morning: $649.99 for a crypto mining device you never ordered, charged to your PayPal account. The email wears PayPal’s exact shade of blue, the logo is pixel-perfect, and — this is the part that makes your stomach drop — the sender address genuinely belongs to PayPal. A modern PayPal scam doesn’t look like a scam anymore. It looks like paperwork.
The numbers explain why scammers keep coming back to this playbook. The Federal Trade Commission reported that American consumers lost more than $12.5 billion to fraud in 2024, a 25% jump over the prior year, and the agency’s 2024 data spotlight ranked PayPal the third-most impersonated company in the country. The FBI’s 2025 Internet Crime report, meanwhile, counted 47,794 tech and customer support scam complaints — the category most PayPal impersonation falls into — with $2.13 billion in reported losses. When a fake invoice can be dressed in a real company’s uniform, the volume follows.
This guide walks through exactly how these schemes unfold, the twist that lets a scam arrive from PayPal’s real email address, and the verification steps that catch every version of it. One habit will protect you through all of them: never use the contact details inside the message — verify the request yourself.
How a PayPal Scam Actually Works: The Invoice Trap
Almost every PayPal scam follows the same six-beat script. Learn the beats and you’ll recognize it from the first line, no matter which product or dollar amount the scammer plugs in:
Beat 1: The invoice you never bought. You receive a PayPal invoice or money request for something you didn’t order — a crypto miner, a graphics card, antivirus software, a “merchant account setup fee” of $255.77. The amount is deliberately sized to sting: big enough to panic you, small enough to seem plausible.
Beat 2: The helpful phone number. The invoice includes a “dispute” or “support” number and urges you to call if you don’t recognize the charge. That number is the whole point of the email. As the FTC warned back in May 2023 about phony PayPal emails, a phone number in the message that supposedly reaches PayPal is “a scam, too.”
Beat 3: The call. You call and reach a confident “agent” who confirms the charge is real, then offers to cancel it or refund you. They sound like billing support because that’s the job they’re auditioning for.
Beat 4: The screen takeover. To “process the refund,” the agent asks you to install remote-access software — AnyDesk, TeamViewer, or Quick Assist — so they can see your screen. A legitimate PayPal representative never needs to watch you log in to your bank. This is the moment to hang up.
Beat 5: The fake overpayment. The caller opens your banking page and “refunds” you — but oh no, they typed $5,000 instead of $500. Except nothing moved. They often shuffle money between your own accounts so the screen shows a bigger number, then insist you owe them the difference.
Beat 6: The real theft. You “return” the overpayment via gift cards, wire transfer, cryptocurrency, or a payment app. The FTC’s September 2025 tech support scam guidance names this exact “you were refunded too much” trick: scammers want gift cards, wires, crypto, or payment apps because paying that way is like handing over cash. Your real money leaves. The invoice was never real, the refund was never real, and the only thing that ever moved was your cash going out.
That six-beat structure covers the vast majority of cases. But one variant deserves its own section, because it breaks the rule most people rely on.
The Nastiest Twist: A Real PayPal Email Carrying a Fake Invoice
Here’s the twist that fools even careful people: the email can be genuinely sent by PayPal and still be a scam. Scammers create real invoices using PayPal’s own invoice and money-request tools, aimed at your email address. PayPal’s servers then deliver a legitimate email — it passes every technical check, comes from service@paypal.com, and shows up in your inbox with all the right branding. The email is real. The seller behind it is a criminal, and the “support number” typed into the invoice notes is their hotline.
This is my single biggest practical judgment on the topic: stop trying to verify the sender and start verifying the request. Checking the sender address, the logo, the formatting — none of it helps when PayPal itself mailed the thing. What helps is ignoring every link and number in the message, opening the PayPal app yourself, and looking at your actual account. If the charge isn’t in your Activity, there is no charge, no matter what the email says.
Security researchers have been documenting this exact pattern since at least 2021, when a wave of fake PayPal invoices for firearms started circulating, and news outlets were still reporting the same firearm-invoice scheme in early 2026. The lure changes; the plumbing doesn’t. Which brings us to the checks that actually work.
PayPal Scam Red Flags: The Checks That Actually Work
Run any suspicious PayPal message against this list. One flag means caution; two or more means it’s almost certainly a PayPal scam:
- An invoice for something you never bought. This is the opener in nearly every version. If you didn’t order it, start from “scam” and make the message prove otherwise.
- A phone number inside the invoice or email. Real PayPal disputes happen inside your PayPal account. A message that pushes you toward a phone number is routing you to the scammer’s call center.
- A generic greeting. PayPal says its genuine emails address you by your full name — “Dear user,” “Dear customer,” or “Hello” are phishing tells.
- Urgency or threats. “Call within 24 hours or the payment goes through.” Real billing systems don’t work on ultimatums.
- A request to install remote-access software. AnyDesk, TeamViewer, Quick Assist — no legitimate refund requires the company to watch your screen.
- An “overpayment” you’re asked to return. The refund was staged on your own screen. Nobody overpays you by accident and then demands gift cards.
- Payment demanded by gift card, wire, or crypto. Ask to pay by card instead and watch the “billing department” suddenly develop system issues.
- A caller asking for your password or one-time code. PayPal says it never asks for passwords, validation codes, or account information by email, text, or phone — not even its own reps.
- Links that don’t lead to paypal.com. Hover (or long-press) before tapping. Lookalike domains like paypaI.com or paypal-secure.net are cheap to register.
- An unexpected attachment. Real PayPal doesn’t send attachments demanding action on your account.
What to Do If You’re Already Targeted
If the message is sitting in your inbox right now: don’t call the number, don’t click the links, don’t reply. Open the PayPal app — the one already on your phone — or type paypal.com into your browser yourself, and check your Activity. No matching transaction means no problem, and you can delete the message.
If you already called and installed something, treat it as a device compromise: uninstall the remote-access software, run a full security scan, install your system updates, and then change your PayPal and banking passwords from a different, clean device. Microsoft’s own guidance after remote-access scams says exactly this — remove what they installed, scan, update, and consider a full reset if anything feels off.
If you already sent money: call your bank or card issuer immediately on the number printed on your card and ask about a reversal — the FTC notes that federal law protects you against unauthorized card use, and speed matters enormously. If you paid with gift cards, call the card company’s number on the back of the card right away and keep your receipts; recovery is harder but not always impossible. Then report it — the section below covers where.
How to Verify the Real Thing: 5 Checks
- Log in yourself, every time. Use the PayPal app or type the address manually. Never reach your account through a link in a message — even one that looks perfect.
- Check Activity for the actual charge. An invoice that’s genuinely pending will appear there. But remember the twist: a scammer-sent invoice can also appear there, since it came through PayPal’s system. An invoice sitting in your account is not proof the charge is legitimate — it’s proof someone sent you a request.
- Ignore the contact details in the message. The phone number in the invoice is the scammer’s. If you need support, find the number inside your logged-in account or on PayPal’s official site.
- Test the greeting and the address. Your full name in the greeting and a genuine paypal.com sender domain are supporting evidence, not proof — but their absence is a loud alarm.
- Ask the awkward question. Did you buy this? Did you authorize this? If the answer is no, the invoice is junk regardless of how official it looks. Decline or cancel it inside your account and move on.
How to Report a PayPal Scam
Reporting does more than vent — it feeds the systems that get these campaigns shut down:
- Forward the email to PayPal. Send the suspicious message to phishing@paypal.com. You can also report it from inside your PayPal account under the resolution or security options.
- Report scam texts to your carrier. Copy the message and forward it to 7726 (it spells SPAM). This helps your wireless provider spot and block similar messages.
- Report to the FTC. File at ReportFraud.ftc.gov — the FTC’s fraud database is what investigators use to spot large scam rings and build cases.
- Report to the FBI. If you lost money, file at ic3.gov, the FBI’s Internet Crime Complaint Center.
Include the invoice ID, the sender’s number, the phone number from the invoice, and screenshots when you file. The more concrete the details, the more useful the report.
The Bottom Line on PayPal Scams
A PayPal scam succeeds because it borrows trust — PayPal’s name, PayPal’s branding, sometimes even PayPal’s own mail servers — and aims it at your panic. The defense is one stubborn habit: treat every unexpected invoice as guilty until proven innocent, and prove it only inside your own logged-in account. The scammer’s entire business model depends on you calling the number they gave you. Don’t.
Sources
- ESET, “Most Common PayPal Scams in 2025 & How to Spot Fake Emails” — https://www.eset.com/blog/en/home-topics/privacy-and-identity-protection/paypal-scam-fake-emails/
- MalwareTips, “PayPal Merchant Account Scam: Fake $255.77 Setup Fee Email Fully Exposed” — https://malwaretips.com/blogs/paypal-merchant-account-scam/
- Sheftali, “Renewal Invoice Scam: The Refund Trap” (October 2026) — https://www.sheftali.net/2026/10/renewal-invoice-scam-refund-trap.html
- Canadian Fraud Prevention resource, CFFC, “Phishing: Don’t Take The Bait” — https://www.cffc.com/blog/post/phishing-don-t-take-the-bait
- AAR Educational Investments, “PayPal Scam Alert: A Real Email Can Carry a Fake Invoice” (September 2026) — https://aareducationalinvestments.org/2026/09/29/paypal-real-email-fake-invoice-scam/
- Federal Trade Commission, fraud reporting portal — https://reportfraud.ftc.gov
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.