Bank & Financial Scams
PayPal Scam Emails: How to Spot Them
Some PayPal scam emails are forgeries. Others are genuine PayPal emails carrying a fraudulent invoice. Here is how to tell them apart.
Quick answer
Never call a phone number printed inside a PayPal email or invoice, and never click through to pay. Log into PayPal yourself at paypal.com or in the app and check your activity — if the charge or request is not there, it is not real. Be aware of a twist unique to PayPal: criminals abuse PayPal's genuine invoicing and money-request features, so the email really does come from PayPal but the invoice is fraudulent. Cancel or report the request inside your account rather than responding to the message.
Warning signs to look for
- An invoice or money request for something you never bought, often for a large amount
- A phone number in the invoice notes urging you to call about a 'charge'
- A 'payment sent' receipt for a purchase you did not make
- Claims your account is limited until you upload documents
- Sender domains such as paypal-service.net rather than paypal.com
- A request to move the conversation to email, text, or a remote-access app
Two very different kinds of PayPal scam email
The first is ordinary forgery: a message designed to look like PayPal, linking to a fake sign-in page that captures your password and then your one-time code. The second is more confusing, because the email is genuinely from PayPal. Anyone with an account can send an invoice or money request, and the notification that lands in your inbox passes every technical check. The fraud lives in the content of the invoice — a large amount, an alarming note, and a phone number to call. That number connects you to a fake support desk that talks you into remote access or a refund transfer.
What genuine PayPal messages look like
Real PayPal notifications address you by your registered full name rather than 'Dear Customer', and every transaction they mention also appears in the Activity list when you sign in independently. PayPal's own guidance is that it will not ask for your password, your card's security code, or your bank details by email, and will not ask you to install software or grant remote access. Any request that only exists in your inbox is not a real obligation.
The right way to check
Do not tap the buttons in the email. Open the PayPal app or type paypal.com into your browser and sign in. Look at Activity for the charge, and at the Invoices or Requests section for anything pending. If it is not there, delete the email. If a fraudulent invoice or request is there, cancel or decline it and use the reporting option — paying attention to the fact that ignoring an unpaid invoice costs you nothing at all.
What PayPal asks you to do
PayPal publishes a security page and asks customers to forward suspected phishing emails to phishing@paypal.com and then delete them. Suspicious invoices and money requests should be reported through the Resolution Centre inside your account. Never call a number from the message; use the contact options inside the app.
If you already paid or shared details
Open a dispute in PayPal's Resolution Centre straight away, and contact the card or bank behind the payment as well. Change your PayPal password from a trusted device, remove any unrecognised linked cards or bank accounts, and turn on two-factor authentication. If you granted remote access to your computer, disconnect it from the internet and have it scanned. Report the incident at reportfraud.ftc.gov and, for losses, at ic3.gov.
When the email really is from PayPal but still feels wrong
This is exactly the case where a second opinion pays for itself. Forward the message to check@spamcheck.com and SpamCheck will explain what the message actually is — a genuine notification carrying a fraudulent request, or a straight forgery — and what to do about it.
SpamCheck is not affiliated with or endorsed by the companies mentioned in this guide. Brand names are used only to help consumers identify potential impersonation scams.
Frequently asked questions
- The email passed every check and really is from PayPal. Can it still be a scam?
- Yes. Criminals use PayPal's real invoicing system, so the notification is authentic while the invoice is fraudulent. Judge the request, not the sender.
- What happens if I ignore a fake invoice?
- Nothing. An unpaid invoice is not a debt and there are no consequences for leaving it. Cancel or report it inside your account and move on.
- I called the number in the invoice. What now?
- If you gave card details, contact your bank. If you installed remote-access software, disconnect the device, uninstall it, run a full antivirus scan, and change passwords from a different device.
- Is SpamCheck affiliated with PayPal?
- No. SpamCheck is independent and is not affiliated with, sponsored by, or endorsed by PayPal. The brand is mentioned only to help identify impersonation.
Sources
SpamCheck provides informational risk assessments and cannot guarantee that any message is completely safe. When money or sensitive information is involved, independently contact the organization using a trusted phone number or website.
About SpamCheck
SpamCheck helps people understand suspicious emails by letting them forward the message to check@spamcheck.com and receive a plain-English analysis. This guide was published by SpamCheck and written and reviewed by the SpamCheck Editorial Team.
Related guides
Fake Invoice Emails: How to Spot Them
Invoice scams work because paying bills is normal. Here is how to check any unexpected invoice before money moves.
Is This Email a Scam? How to Check
You have a suspicious email open right now. Here is the fastest reliable way to decide whether it is a scam, without clicking anything in it.
Amazon Scam Emails: How to Spot Them
Fake order confirmations and Prime renewal notices are designed to make you call. Here is how to check any Amazon message in under a minute.
Is This Bank Email Real or Fake?
Bank alerts are the most imitated emails there are. Here is how to separate a real notice from a convincing fake in a couple of minutes.
10 Things Scammers Say (Word for Word)
Scam scripts are recycled across thousands of criminals. Learn these ten exact phrases and you'll recognize the play in the first sentence.
5 Ways to Tell If an Email Is Really From Your Bank
Fake bank emails are the most dangerous scams because they target the money directly. These five checks settle it.