PayPal email scam: how to check a fake invoice or purchase message

Three things this message could be

The words “PayPal invoice” do not tell you exactly what happened. Start by separating these possibilities:

1. A fake email pretending to be PayPal. It may copy PayPal’s logo and wording, spoof a sender address or lead to a lookalike website. Scamwatch: email scams explains that copied branding and spoofed addresses can make a scam look convincing.
2. A genuine PayPal invoice or money request abused by a scammer. PayPal says scammers can send an invoice through PayPal for something you never ordered and add an alarming note with a fake customer-service number. The delivery system may be genuine while the request and note are fraudulent.
3. A real transaction you did not authorise. If you find an unrecognised payment in your own account, use PayPal’s official Resolution Centre. Do not call a number in an invoice note to resolve account activity.

This distinction matters: “the email came from PayPal” is not sufficient proof that you should pay or call. PayPal AU: common scams and how to spot them covers all three situations.

Example: “You purchased…” with a callback number

From: PayPal Billing <billing@example.invalid>
Subject: Your payment of $649.00 is complete

You purchased Home Security Premium.
If you did not authorise this payment, call our cancellation team
on [fictional phone number] within 24 hours.
Do not sign in to your account until our representative helps you.

View invoice: hxxp://example[.]invalid/invoice

Scamwatch: fake purchase callback scams describes messages about purchases you do not recognise, prominent callback numbers, time pressure and subsequent requests for financial details, gift cards or remote access. Its examples include PayPal invoices and texts. Personal details in a message do not make the purchase genuine.

Is a PayPal email address enough to prove safety?

No. Check the full address behind the display name, but treat it as one piece of evidence—not a verdict.

• Display names can be copied. “PayPal Support” could sit above an unrelated address.
• Addresses can be spoofed. Scamwatch warns that scammers can make an organisation’s address look real.
• Lookalike domains can be subtle. Extra words, hyphens or changed letters are warning signs.
• A genuine sender does not validate the invoice. A scammer can abuse PayPal’s invoice or money-request feature.

Email authentication such as SPF and DKIM can help mail providers assess sending domains, but it cannot tell you whether a purchase is genuine or an invoice note is honest. You do not need to decode headers before choosing the safer route: verify independently.

How to check without using the message

1. Leave the email alone. Do not click, reply, call, download an attachment or scan a QR code.
2. Open the official PayPal app. If you use a browser, type the known PayPal address yourself rather than following the message or copying its link.
3. Check Activity and any invoice or money request. Look for a transaction you recognise. A message about an account you never opened is a reason to pause, not a reason to call the note.
4. Use official help. For an unauthorised payment, go to the Resolution Centre through your account. Find support through PayPal’s own site, not the contact details supplied in a suspicious message.
5. Ask a trusted person for help if needed. Do not let a caller rush you into installing software or reading out codes.

If you have not clicked or paid

• Do not pay an invoice for something you did not order.
• Do not call a number in the invoice note or reply to the sender.
• Check your account independently as described above.
• Use PayPal’s current reporting instructions. PayPal AU Security Centre: report fake communications says to forward the entire suspicious email to phishing@paypal.com.au and delete it. PayPal AU: common scams and how to spot them currently lists phishing@paypal.com. Because those official AU pages differ, follow the current PayPal page you trust rather than assuming every variation is valid.
• Report an unwarranted invoice or money request through the PayPal app or website, as PayPal’s common-scams guidance explains.

Reporting helps the impersonated service investigate. It is separate from getting a second opinion from AskScam.

If you called, paid or shared something

If you only called

End the call. Do not follow further instructions, share codes or install software. Write down what you discussed. If you disclosed nothing, you may not need account recovery, but stay alert for follow-up contact and report the attempt.

If you never had a PayPal account

Do not create an account through the message to investigate. Report it using PayPal’s official guidance and contact your bank if you paid or disclosed financial information another way.

How to help a parent or family member

Try: “Let’s not call that number. We can open the PayPal app together and see whether there is a real transaction. You haven’t done anything wrong by asking me to check.”

Preserve the message and a note of what happened for the bank, PayPal or support service. Do not ridicule the person or take over without consent. Scamwatch: help someone who’s being scammed recommends calm, non-judgemental support and practical recovery help.