PayPal Invoice Fraud: How the Fake Invoice Scam Works — and Why It's So Convincing
Most invoice scams rely on a fake or spoofed domain that a careful reader can catch. PayPal invoice fraud is different — the email really does come from PayPal's own servers, passes every authentication check, and looks completely official, because the platform is real. Only the request inside it is fake. This guide covers how the scam works, what it looks like, and how to catch it before you pay.
How the Scam Actually Works
PayPal lets any account holder send an invoice or "money request" to any email address, free of charge, with no verification that the sender actually provides the goods or services listed. A scammer uses this feature — not a security hole, an ordinary feature — to send what looks exactly like a routine business invoice.
Because PayPal itself generates and delivers the email, it comes from a real paypal.com sending address, carries PayPal's real logo and formatting, and passes SPF/DKIM/DMARC authentication. Email filters and even trained employees are taught to trust exactly those signals — which is what makes this version of invoice fraud harder to catch than a typosquatted-domain scam.
An invoice for antivirus software, "IT services," domain renewal, or office supplies you never ordered — sent to a generic company inbox, hoping someone pays without checking.
A scammer researches a real vendor you use and sends a PayPal invoice under a similar business name, hoping it blends in with your normal AP workflow.
The invoice includes a phone number to "dispute or cancel" the charge. Calling it connects you to a scammer posing as PayPal support, who then talks you into remote access to your computer or further payments.
Large, alarming amounts ("$899.99 — Order Confirmed") designed to make someone panic and call the fake support number rather than calmly checking their PayPal account directly.
6 Signs a PayPal Invoice Is a Scam
Since the email itself is genuinely from PayPal, none of the usual domain-spoofing checks apply here. Look at the content instead.
No legitimate vendor sends a first-time invoice out of nowhere for a purchase nobody at your company remembers making. If nobody can point to the order, the contract, or the conversation that led to this invoice, don't pay it.
This is the core of the scam. Real PayPal invoices don't need a phone number to resolve a problem — disputes happen inside your PayPal account. A callback number is there to get a person on the phone who will then try to extract payment, remote access, or account credentials.
Invoices for "Norton Antivirus Renewal," "Geek Squad Protection," or "Office 365 Support" are common templates in this scam because those brand names create instant, unquestioned trust — without the real companies being involved at all.
Large round numbers, "your card has been charged," or "order confirmed" language is designed to trigger a panicked reaction — call the number, click the link — rather than a calm, independent check.
If a vendor you normally pay by ACH, check, or wire suddenly invoices you through PayPal for the first time, that's a channel change worth a phone call — the same logic as a changed routing number on a traditional invoice.
Scammers often blast these invoices to public-facing addresses like info@, billing@, or accounts@, betting on volume rather than targeting anyone specific. A request landing in a shared inbox with no personalization is a weaker signal on its own, but combines with the flags above.
How PaySentinel Helps With PayPal Invoice Scams
PaySentinel doesn't connect to your PayPal account or verify transactions directly — it analyzes the details you paste in against known fraud language and sender patterns, the same way it evaluates a suspicious email or invoice from any other channel.
| Signal | PaySentinel detects? | How |
|---|---|---|
| Urgency / pressure language | ✓ Yes | Detects urgency, alarm, and pressure phrasing patterns common in scam invoices and BEC content |
| Vague or brand-generic item description | Partial | Flags vague scope language when included in the details you submit — best combined with your own check of the vendor |
| Vendor payment-channel history | ✓ Yes | Compares against your local vendor history — flags a first-time PayPal request from a vendor previously paid another way |
| Live PayPal account/transaction verification | Not covered | PaySentinel has no integration with PayPal's systems — always verify directly in your own PayPal account, not through the invoice |
Open the Email tab in the app and paste in the sender info, item description, amount, and any phone number or link included. PaySentinel checks the content for known scam language patterns and returns a risk score — free, no account required.
Check a suspicious PayPal invoice now
Paste in the sender, item description, and amount — PaySentinel checks for known scam patterns and gives you a risk score in under a minute. Free for small businesses.
Check it free →Frequently Asked Questions
No. Anyone with a free PayPal account can send an invoice request to any email address, and PayPal delivers it from its own real domain because the platform itself is legitimate — only the request inside it is fake. The email passing every spam and authentication check is exactly what makes this scam effective.
Open a dispute in the PayPal Resolution Center immediately and select the reason that fits — unauthorized transaction or item not received. Then report it to PayPal's phishing team by forwarding the invoice to phishing@paypal.com.
If the payment was funded from a linked bank account or card, also contact that bank directly, since a PayPal dispute is not guaranteed to result in recovery, especially for payments marked as "services."
Compare it against a prior invoice from that same vendor — the sender's PayPal email/account, the item description style, and the amount pattern should match what you've seen before.
Any first-time PayPal invoice from a vendor you normally pay by check, ACH, or wire is itself worth a phone call before paying, regardless of how official the invoice looks.
PayPal's Purchase Protection program has significant exclusions, and payments sent for services — rather than physical goods — are frequently not covered. Treat a PayPal invoice payment with the same verification standard as a wire transfer: assume it isn't reversible once sent.