PayPal invoice / money-request scam
A genuine-looking PayPal invoice or money request, often "from" a crypto exchange or a retailer, with a phone number in the note "if you did not authorise this". The invoice may really come through PayPal's system, which is why it passes filters; the number is the scam.
- Impersonates
- PayPal
- Arrives by
- First seen
- not dated
- Specimens
- 0
- Updated
- 2026-09-02
Right now what this family looks like
How to recognise it
- You did not buy anything, but the email arrives through PayPal itself
- A phone number inside the invoice note
- Pressure to call rather than to open PayPal
What to do
- Do not call the number in the note and do not pay the request
- Open PayPal by typing paypal.com and check Activity; report the request from there
- Forward the email to phishing@paypal.com as PayPal asks
Already called, clicked or paid? what to do in the next hour
- Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device
- Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers
- Expect a call-back from a "refund department" — that is act two of the same scam. Hang up
How it changed
nothing to compare yet · no specimen on recordGot a version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry
Family created
Opened at launch; no dated specimen on record yet — send yours.
Same trick, other brands
- Geek Squad renewal invoice scamactive · 2026-09
- Amazon "order confirmation" callback scamactive · 2026-09
Indicators
- None on record yet. Indicators change weekly; an empty list never means an email is safe.
In other streams
- Nothing yet.
Registry data
- Machine-readable
/scams/paypal-invoice.json- Timeline feed
/scams/paypal-invoice/feed.xml- Sources
- 1 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02