Possibly — and the tricky part is that some scam invoices are sent through PayPal's real system, so the email is genuine but the invoice is fake. Scammers create an invoice or money request for something you never bought (often crypto, “Bitcoin”, or a big tech purchase) and add a “call this number if you didn't authorise this” note. Calling reaches scammers who then run a refund or remote-access con.
A legitimate invoice matches something you actually purchased from a seller you recognise. PayPal itself never adds a phone number telling you to call to dispute — you handle disputes inside your PayPal account. Don't call any number in the invoice and don't pay a request you don't recognise; simply decline or report it in the PayPal app. If a link is attached, check it before opening.
Free — no email needed
What to do right now
1Don't call any number in the invoice or pay the request.
2Open the PayPal app/site directly and decline or report the invoice there.
3Paste any link into Scam Detective and report the message to PayPal.
Get free scam alerts
Fake-invoice scams like this PayPal invoice are spreading fast — get a heads-up on the next one. Optional — the steps above are free either way.
These are the signals to watch for with this PayPal invoice. Not sure about a link involved? Our report grades every one and tells you exactly what it found.
1. An invoice for something you never bought
Crypto, gift cards, or a costly gadget you didn't order is the setup.
2. A phone number to “dispute” the charge
PayPal never tells you to call a number to cancel — that number is the scam.
3. Pressure and alarm in the note field
“Your account will be charged in 24 hours” rushes you into calling.
4. A request from an unknown business or person
Unfamiliar sender names on a money request are a red flag.
5. Links to “confirm” outside the PayPal app
Real actions happen inside your account, not via an emailed link.
This page is general guidance to help you decide — not a verdict on any specific business, and not legal or financial advice. We check URLs and sites; we don’t recover funds or execute takedowns.