IsThisSpam Logo
IsThisSpam.org
PayPal Invoice Scam Checker

Check a PayPal invoice for scam before you call the number or pay.

The PayPal invoice scam is uniquely dangerous because it uses PayPal's own invoicing system. The email comes from a real PayPal address, the invoice looks official, but the charge is fake — and buried in the seller note is a fraudulent phone number designed to steal your banking credentials.

Security Insight

The PayPal invoice scam exploited PayPal's own infrastructure, which means the emails pass authentication checks that would normally catch phishing. Analysis of a large public scan dataset confirmed 'PayPal invoice scam' as a distinct and recurring high-intent query separate from general PayPal phishing.

Designed specifically for PayPal invoice fraud
Catches the phone-number-in-notes pattern
Explains why the email looks completely real
Check a PayPal InvoiceRun Deep Scan (SuperScan)

How to spot a PayPal invoice scam

Unlike a phishing email that tries to look like PayPal, this scam uses real PayPal invoices. The fraud is in the invoice content, not the sender. Here is the exact pattern.

Invoice for something you never purchased

A sudden $299–$499 charge for Geek Squad renewal, Norton Antivirus, McAfee, Coinbase, or a crypto platform you never use. The amount is chosen to be alarming enough to make you want to dispute it.

Seller note contains a fake phone number

The scam instruction is always in the 'Note from seller' section: 'If you did not authorize this charge, call 1-800-XXX-XXXX immediately.' That number connects to a fraudulent call centre, not PayPal.

Urgency to dispute within 24–48 hours

The invoice note often warns that the charge will process and become non-refundable unless you call to cancel. This deadline is completely fabricated to prevent you from checking calmly.

Email address sent from 'service@paypal.com'

Because the scammer uses the real PayPal invoice tool, the email genuinely does come from PayPal's servers. Traditional email verification will not catch this scam — you have to analyse the invoice content itself.

What IsThisSpam checks before you trust a sender

Quick verdicts are useful, but the real value is understanding why something looks safe, uncertain, or risky.

Fake seller business name

Scammers set up PayPal business accounts with names like 'Geek Squad Billing' or 'Norton Security Solutions' to make the invoice look like a real subscription charge.

The phone number is not on PayPal's website

PayPal's real customer service number is on paypal.com, not in an invoice note. Any number in a seller note that asks you to call is fraudulent by design.

Call centre social engineering script

If you call, the agents are trained to extract your banking credentials, install remote access software, or guide you into transferring money through wire transfer or gift cards.

No matching activity in your PayPal account

If you log into PayPal directly (not via the invoice email link) and see no matching transaction in your account history, the invoice is a scam — it was sent to you as a request, not as a receipt.

Related guides

Use the checker for the fast answer, then read the deeper guidance for recurring scam patterns.

PayPal Scam Checker

The broader guide covering all PayPal phishing and fraud patterns beyond just the invoice scam.
Read the guide

Invoice Fraud Checker

Detect fake invoices across all platforms — not just PayPal — including wire transfer and BEC fraud.
Read the guide

Gift Card Scam Checker

PayPal invoice scams often end by asking victims to pay via gift cards. Learn how this works.
Read the guide

FAQ

These are the questions people usually ask right before they click, reply, or pay.

Got a screenshot or attachment? Our AI can analyse it.

Free scan first, deeper analysis when you need it

Check the sender before you trust the message.

Start with a fast scan, then move to SuperScan when the message involves money, account access, or sensitive documents.

Check a PayPal InvoiceRun Deep Scan (SuperScan)