Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteA PayPal invoice for something you never ordered may be a scam even if it appears in your PayPal account. Don’t pay it, call a number printed in its note, or follow its links. Open PayPal directly through its app or by typing its address yourself, check your activity, and report the unwanted invoice there.
How the five scams work
PayPal warns: “If you receive a suspicious invoice or money request, don’t pay it.” The patterns below differ in what the sender wants you to do, but each relies on getting you to act before you verify the request.
As an Amazon Associate I earn from qualifying purchases.
| Pattern | Trigger and requested action | What the scammer may seek | Safer verification |
|---|---|---|---|
| Unsolicited invoice or money request | A charge for a product, service, or cryptocurrency you did not order; pay it. | Your money, and potentially personal or account information. | Check PayPal activity by opening the app or website directly. |
| Alarmist note with a fake support number | A warning of an account charge or suspension; call the number in the note. | Personal or financial details. | Ignore the number and contact PayPal through its official app or site. |
| Fake refund and remote-access trap | A fake invoice leads to a call, an online form or remote access, then a claim that you owe a refund. | Computer access, information, and money. | Do not call the invoice number or grant access; use official PayPal support. |
| Cryptocurrency payment demand | An invoice or request directs you to send funds to a crypto wallet. | A cryptocurrency transfer outside normal PayPal dispute and support processes. | Do not send funds to the wallet; verify through PayPal directly. |
| Vendor invoice or payment-change impersonation | A message appears to be from a known vendor and requests payment or new payment details. | Payment rerouted to an account controlled by the criminal. | Verify with the vendor using a contact method you already know. |
1. Unsolicited invoice or money request
The invoice may name a product, service, subscription, or cryptocurrency purchase you never made. Its presence is not a reason to pay. Instead, log in to PayPal by opening the app or typing the site address yourself and inspect your activity. PayPal’s guidance is to avoid paying for an item you did not request and to report the invoice or request through the service. PayPal’s guidance on suspicious invoices and requests.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Alarmist note with a fake customer-service number
A note may claim that your account will be charged, suspended, or otherwise compromised unless you call immediately. The number is part of the trap: a person answering may pose as PayPal support and ask for personal or financial details. PayPal says not to call numbers in invoice notes or open suspicious URLs. Use support reached through the official app or website instead. PayPal: spot and report suspicious messages; PayPal: learn about scams.
3. Fake refund, remote-access, and overpayment trap
This scam can escalate from a bogus invoice into a claim that you owe money. In a January 2024 case, the FBI said a victim received an apparent PayPal invoice for purchases she had not made, called the number in it, and was led by people posing as PayPal, bank, and government representatives to an online form that likely gave them computer access. The callers then claimed she had entered too much for a refund and owed PayPal money. The sequence shows why an invoice-related call can become a device and financial compromise, not just an attempt to collect the invoice. FBI Internet Crime Complaint Center case alert, January 16, 2024.
4. Cryptocurrency payment demand
An invoice or money request that directs you to pay a cryptocurrency wallet is a strong warning sign. PayPal identifies wallet-directed payment demands as a scam pattern and says not to send funds to the wallet named in the request. A crypto transfer also moves the payment outside the ordinary PayPal dispute and support path. Verify the request in PayPal directly; do not follow the payment instructions in the note. PayPal’s suspicious-invoice guidance.
5. Business invoice or payment-change impersonation
A business may receive a plausible invoice or a request to update a vendor’s payment address from someone impersonating a known supplier. The FBI describes business email compromise as messages that appear to come from a known source and make a legitimate-looking request; invoice and changed-payment-address requests are examples. Before paying or changing account details, confirm the request through a previously known vendor phone number or another independent channel—not the details in the message. FBI: Business Email Compromise.
What to do if you receive a suspicious PayPal invoice
- Do not act on the message. Don’t pay, reply, click links, open attachments, or call a phone number printed in the invoice note or email.
- Check PayPal independently. Open the PayPal app or type PayPal’s address into your browser. Review activity and determine whether a real transaction exists; don’t use links in the message to sign in.
- Report the request through PayPal. Use the reporting option in the app or website for an unwarranted invoice or money request. For suspicious emails or websites, PayPal says to forward them to [email protected], then delete them. PayPal’s reporting instructions.
- For a vendor payment change, verify out of band. Call a vendor number you had on file before receiving the message, or use another previously established contact route. Do not trust a new number or address included in the request.
- Report financial fraud where appropriate. In the United States, report it to the FTC at ReportFraud.ftc.gov. The FBI’s Internet Crime Complaint Center also accepts relevant internet-crime complaints at IC3.gov.
If you called the number or allowed remote access
If you entered a form, installed software, or allowed someone to control your computer, treat the device and any accounts used on it as potentially exposed. The FBI’s documented case shows how a fake invoice can lead to remote access and a fabricated debt claim.
- Disconnect the affected device from the internet or local network to end an active remote session.
- Keep the invoice, email, phone number, messages, and any payment records as evidence. Avoid deleting relevant records before reporting.
- From a device you believe is clean, change passwords for PayPal, email, banking, and other accounts that may have been exposed. Use unique passwords and enable available additional account protections.
- Contact PayPal and any affected bank or payment provider using contact details from their official apps or websites. Explain what access or information you disclosed and ask them to secure the account and review activity.
- If money was transferred or account details were compromised, report the incident to the FTC and, where appropriate, the FBI’s IC3.
How common are impersonation and fraud reports?
The FTC’s 2024 report says about 10,000 consumer reports in 2023 named PayPal as the impersonated company. In the FTC’s 2025 reporting on 2024, consumers reported more than $12.5 billion in total fraud losses; imposter scams accounted for $2.95 billion, and 38% of people who reported fraud said they lost money. These are reported figures, not a count of every scam or a measure of the odds that a particular invoice is fraudulent. FTC: PayPal scams, October 2024; FTC: reported fraud losses in 2024, March 2025.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
