Fake PayPal invoice: "payment of $499"

"A payment of $499 has been made. If you don't recognise this transaction, call us." This fake PayPal email looks like a receipt or an invoice. Sometimes it claims to be an "invoice" for a service you never ordered. It isn't trying to make you click. It's trying to make you phone the scammers.

How the scam works

1. You get a fake receipt, often with the PayPal logo and a large amount.
2. There's no button to click, just a phone number to "dispute the charge".
3. When you call, a fake agent answers. They sound helpful, then ask you to log in or install remote-access software.
4. Once they're inside your computer or account, they empty your accounts or get you to approve transfers.

This is called a callback scam. Because you made the call, you trust it more.

Signs to look for

• A purchase you didn't make, usually a round, high amount.
• A phone number to call in the middle of the message. A real receipt doesn't ask you to ring a number.
• The sender's address: the display name says "PayPal", but the address belongs to another domain or a free mailbox.
• No real name: "Dear customer", "Dear user".
• A PDF attachment holding the "invoice" and the number.
• Urgency: "cancel within 24 hours".

Be careful: sometimes the invoice is sent through a real invoicing system that a scammer abused, so the email can look genuine. A number to call is still the warning sign.

What to do

1. Don't call the number and don't reply.
2. Open paypal.com or the official app yourself. If no payment shows up, it's fake.
3. Never install software because a stranger on the phone asks you to.
4. Report it: in the US at reportfraud.ftc.gov, in the UK by forwarding it to report@phishing.gov.uk.

What if I already called or paid?

• You shared banking codes or approved a transfer: call your bank straight away.
• You installed software: disconnect from the internet, remove it, then change your passwords from another device.
• You lost money: report it to the police and keep the email.
• Expect follow-up calls in the next few days, often from a "bank agent".

To learn what to look for in any suspicious message, see how to spot a phishing email, and the parcel delivery fee scam, which also targets your card.

Check it with Fishi

Forward the suspicious email to check@fishi.email, ideally as an attachment so the technical details are kept. Fishi examines the sender, links, attachments and content, then replies with a clear verdict and what to do. It's free and needs no account. No tool is perfect: if in doubt, always go to the official website yourself.