The email passed every check I know. Can it still be a scam?

Yes. With this one, the email itself is usually genuine — it was generated by PayPal because someone used PayPal's invoicing feature to bill you. The sender address, the formatting and the links can all be real. What the scammer controls is the invoice they created: the seller name, the amount, and the text in the note field. That text is where the fake phone number lives.

Does an invoice mean I've already been charged?

No. An invoice or money request is a request for payment. Money does not move unless you approve it. The panic the message is trying to create depends on you believing a charge has already gone through, so it helps to know that it hasn't.

Is it safe to call the number on the invoice just to ask?

No, and the call is the whole point of the scam. The number belongs to the person who sent the invoice, not to any payment company. On the call they typically ask you to install remote-access software so they can "process the refund", then use that access to see your screen and your accounts. If you want to check the charge, open the app yourself and look at your own activity.

I called and let them onto my computer. What should I do?

Disconnect that computer from the internet, then uninstall the remote-access software they had you install. Change the passwords for your email and any financial accounts from a different device, and turn on two-factor authentication. Call your bank using the number on your card and tell them your accounts may be exposed. If any transfer was made during the call, say so — speed matters more than certainty here.

← Is This A Scam?

PayPal Invoice and Money Request Scams

You get an emailed invoice for something you never bought. The email is real. The charge is not. The trap is the phone number printed inside, and it only works if you call it.

Most scam advice tells you to check the sender and hover over the links. That advice does nothing here, because the email genuinely came from the payment company. Anyone with an account can create an invoice and send it to any email address. The system did exactly what it was built to do. It just did it for someone dishonest.

So the question to ask is not "is this email real". It's "who wrote the words inside it".

What one of these looks like

The email looks like every other invoice notification you've had. The part the scammer wrote is the line item and the note attached to it:

1 x Crypto Asset Purchase — Order #BTC-40192 — $749.99

NOTE: This charge will be debited automatically within 24 hours. If you did NOT authorise this transaction please contact our Billing Dept immediately at +1 (888) 555-0147 to cancel. Do not reply to this email.

Read the note on its own and it's a stranger's text message. All caps for emphasis, a deadline, a large enough amount to make your stomach drop, and one action offered: call this number. The invoice around it is just the envelope that made you take the note seriously.

Red flags to look for

A phone number written into the note, memo or description field. A real company puts its support number on its own website, not inside a document a stranger filled in.
The amount is large and the item is vague — "crypto asset purchase", "annual protection plan", "software renewal". Big enough to alarm you, generic enough that you can't check it against anything.
The note tells you the money will be taken automatically unless you act. Invoices don't work that way. An unpaid request just sits there.
The wording is pushy or oddly formatted — all caps, missing spaces, mixed British and American spelling. You're reading the scammer's own typing, not a template.
The seller or business name is a near-miss of a brand you know, or a real-sounding department like "Billing Support Team" that no company actually invoices under.
You're told to call rather than click. That's deliberate: it moves you somewhere nothing can be inspected, and a lot of people who'd never tap a strange link will happily dial a number.
You never bought anything from anyone, and the invoice can't name an account, an order you placed, or a date you'd recognise.

Why this one gets past careful people

The usual tell is a lookalike web address, and there isn't one here. If you inspect the links in the email they really do go to the payment company. Our guide on checking a suspicious link is the right habit for most messages, but it gives this one a clean bill of health, which is exactly why the technique was chosen. When legitimate infrastructure is doing the delivery, the only thing left to judge is the content a stranger typed.

What to do instead

1Don't call the number, and don't reply to the email. Neither is how you reach a payment company.
2Open the payment app on your phone, or type the company's address into your browser yourself. Look at your own activity and pending requests there. If the invoice is real it will be visible in your account; if it isn't, you've learned that in ten seconds without speaking to anyone.
3If the request is sitting in your account, cancel or decline it from inside the app, and use the app's own report option on the sender. Don't pay it to make it go away.
4Check your card statement for an actual charge. An unpaid invoice is not a charge, and seeing nothing there takes most of the pressure off.
5Mark the email as spam or phishing so your provider learns from it, then delete it. Forwarding it to the company's own abuse address, found on their site, is useful too.
6If you already called and were asked to install anything, treat the computer as exposed and work through the recovery steps below.

Got an invoice or money request you don't recognise?

Paste it into the free checker and see the specific red flags in it. No signup, no email.

Check a message

If you already called

Calls like this follow a script. The person is helpful, apologetic about the charge, and asks to connect to your computer to issue the refund. Once connected they usually claim to have refunded too much and ask you to send the difference back — by transfer, gift cards or crypto. The "overpayment" on your screen is a page they edited while you watched.

If you got that far, disconnect, remove whatever they installed, and change your passwords from a different device. Our reporting guide sets out the order to work through and where to file. If the call ended with you being told to expect a text code from your bank, read our guide on bank fraud alerts before you act on it.

Common questions

The email passed every check I know. Can it still be a scam?: Yes. With this one, the email itself is usually genuine — it was generated by PayPal because someone used PayPal's invoicing feature to bill you. The sender address, the formatting and the links can all be real. What the scammer controls is the invoice they created: the seller name, the amount, and the text in the note field. That text is where the fake phone number lives.
Does an invoice mean I've already been charged?: No. An invoice or money request is a request for payment. Money does not move unless you approve it. The panic the message is trying to create depends on you believing a charge has already gone through, so it helps to know that it hasn't.
Is it safe to call the number on the invoice just to ask?: No, and the call is the whole point of the scam. The number belongs to the person who sent the invoice, not to any payment company. On the call they typically ask you to install remote-access software so they can "process the refund", then use that access to see your screen and your accounts. If you want to check the charge, open the app yourself and look at your own activity.
I called and let them onto my computer. What should I do?: Disconnect that computer from the internet, then uninstall the remote-access software they had you install. Change the passwords for your email and any financial accounts from a different device, and turn on two-factor authentication. Call your bank using the number on your card and tell them your accounts may be exposed. If any transfer was made during the call, say so — speed matters more than certainty here.

This page is informational and we aren't affiliated with any company or agency named on it. We can't tell you whether your specific message is genuine. Verify independently: open the company's official app or type their website address yourself, and call the number printed on your card, statement, or the back of your ID — never a number supplied by the message.

Want simple scam alerts for your family?

Join the early-access list. This is an idea we're testing, not an active protection service — nothing is monitored today, and joining changes nothing about your accounts.