{
  "slug": "paypal-invoice",
  "canonical_name": "PayPal invoice / money-request scam",
  "family": "fake-invoice-callback",
  "impersonates": {
    "brand": "PayPal",
    "disclaimer": "PayPal is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://www.paypal.com/us/security/suspicious-activity"
  },
  "goal": [
    "callback",
    "payment"
  ],
  "channels": [
    "email"
  ],
  "summary": "A genuine-looking PayPal invoice or money request, often \"from\" a crypto exchange or a retailer, with a phone number in the note \"if you did not authorise this\". The invoice may really come through PayPal's system, which is why it passes filters; the number is the scam.",
  "status": "active",
  "first_seen": null,
  "last_seen": null,
  "recognise": [
    "You did not buy anything, but the email arrives through PayPal itself",
    "A phone number inside the invoice note",
    "Pressure to call rather than to open PayPal"
  ],
  "variants": [],
  "specimen": null,
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call the number in the note and do not pay the request",
      "Open PayPal by typing paypal.com and check Activity; report the request from there",
      "Forward the email to phishing@paypal.com as PayPal asks"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "PayPal: report suspicious activity",
        "url": "https://www.paypal.com/us/security/suspicious-activity"
      },
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Opened at launch; no dated specimen on record yet — send yours.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "geek-squad-renewal-invoice",
    "amazon-order-callback"
  ],
  "sources": [
    "https://www.paypal.com/us/security/suspicious-activity"
  ],
  "legacy_urls": [],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/paypal-invoice",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}