What it looks like
You’ve got an invoice from Norton Billing Dept. Amount due: $499.99. If you did not authorize this transaction, please contact PayPal support immediately at +1 (808) 555-0183 to cancel and get a refund.
Other forms it takes
PayPal: Geek Billing Services requested $649.99 USD. Note from seller: “Your account was used to buy a 3-year PC security plan. If this wasn’t you, call the Billing Desk at (213) 555-0186 within 24 hours to cancel and get a full refund.”
From: PayPal Service <service@paypal-resolve.example-pay.top>. Subject: Your account access is limited. We noticed unusual activity. To restore full access, confirm your identity here: https://paypal-resolve.example-pay.top/verify
Invoice #88-1204 from Digital Asset Services. Amount due: $1,150.00. To avoid account suspension, pay now, or send the amount in Bitcoin to the wallet in the note: bc1q-example-wallet-0000.
How the scam plays out
- An invoice or money request shows up for something you never bought, often antivirus, a computer plan or crypto. It can be sent through PayPal itself, so the email may come from a real PayPal address.
- A note in the invoice tells you to call a “support” number right away. That number reaches the scammer, not PayPal.
- A friendly “agent” offers to cancel the charge. They ask for your PayPal login, your bank or card details, or a code sent to your phone.
- Some ask to connect to your computer “to process the refund.” Then they say they refunded you too much and ask you to send the difference back, often with gift cards.
- The goal is always the same: get you to send money, or get what they need to take it.
Signs it’s a scam
- A phone number in the invoice note or message asking you to call to “cancel” or “dispute”.
- A charge for something you never bought (antivirus, crypto, gaming gift cards).
- A sender name that isn’t PayPal or a company you deal with, even if the email address looks real.
- Pressure: “within 24 hours”, “your account will be limited”.
What to do
- Don’t call the number and don’t pay the invoice.
- Open the PayPal app or type paypal.com yourself and check your activity. A real charge will be there.
- Forward the email to phishing@paypal.com, then delete it.
How to check if it’s real
- Close the email. Open the PayPal app, or type paypal.com into your browser yourself, and log in.
- Look at your Activity. If an invoice or request is for something you never ordered, don’t pay it.
- Report an invoice or money request you don’t recognize from inside your PayPal account, on the website or in the app.
- Need to talk to PayPal? Use the Help or Contact page on paypal.com. Never use a number from an invoice note or an email.
Already clicked, paid or shared something?
- If someone used your PayPal account without your OK: on the PayPal website, open the Resolution Center, click “Report a problem,” choose the payment, then choose “I want to report unauthorized activity.” PayPal says it will email you within 10 days.
- If you paid the invoice yourself, report the payment to PayPal right away and ask them to reverse it. The FTC gives the same advice for every payment app.
- If the money came from a credit card, call the number on the back of the card and dispute the charge. Federal law limits what you owe for unauthorized credit card charges to $50.
- If the money came from your bank account or debit card, call your bank now and ask them to reverse the payment.
- If you gave out your PayPal password, change it now, plus anywhere else you used it, and turn on two-step login.
- If you let them onto your computer, update your security software, run a scan and delete anything it flags.
Where to report it
Related scams
- Is this Geek Squad email a scam?
- Venmo scams: how to spot them
- Zelle scams: how they work and what to do
- Make a family safe word