Usually yes. Scammers send real-looking PayPal invoices or “payment received” emails for things you never purchased, hoping you’ll panic and call the “customer service” number in the message. That number reaches the scammer, not PayPal — and the call is where the real theft happens.
What this scam looks like
This scam is clever because the email is often a genuine PayPal notification — the scammer really did create an invoice or send a money request through PayPal’s system, so it passes spam filters and looks authentic. What’s fake is the story (“you paid $499 for Bitcoin / a Norton renewal”) and the phone number they want you to call.
Call it and a fake agent will “help you cancel the charge” — by getting you to install remote-access software, read out codes, or send a refund that actually drains your account.
Example is illustrative and de-fanged; links are shown broken so they can't be clicked.
Red flags to watch for
- A charge you don’t recognize paired with a phone number to call — the core of the scam.
- Pressure to act “immediately” to cancel or dispute the charge.
- The “agent” asks you to install software (AnyDesk, TeamViewer) or share a screen so they can “process the refund.”
- You’re told you were “refunded too much” and must send the difference back by gift card or transfer.
- Requests for your password, one-time codes, or card number — PayPal never needs these to reverse a charge.
What to do if you got one
- Don’t call the number in the email. Assume any phone number inside an unexpected invoice is the scammer’s.
- Log in to PayPal by typing paypal.com yourself (or the official app) and check Activity. If there’s no such payment, there’s nothing to cancel.
- Report the message to [email protected], then delete it. You can decline or report an unwanted invoice from inside your PayPal account.
- Never install remote-access software or read out codes because someone on a support call asked you to.
- Unsure whether an invoice is real? Paste it into GotAScam before doing anything.
Frequently asked questions
Because scammers use PayPal’s real invoicing/money-request feature to send it. The delivery is genuine; the claim and callback number are the fraud. Judge it by logging into your account directly.
Not necessarily — anyone can send an invoice to your email. But change your password and enable two-factor authentication to be safe, and never reuse that password elsewhere.
No. The “refund” is fake or reversible, and anything you send is real money gone. This “overpayment” trick is a classic; stop and verify in your real account.
Not sure about a message you got?
Paste the exact text, email, or screenshot into GotAScam and get a clear verdict — Likely Safe, Uncertain, or Likely Scam — backed by live threat intelligence. It's free, and no sign-up is required for text checks.