Why a real PayPal invoice can still be a scam
A stranger can send you a money request through PayPal and put their own phone number in the note. Open Activity in your PayPal app before calling anyone. An unpaid request and a completed charge need different responses.
Check an invoice link →One free scan. Full findings require Pro.
Use only a public hostname. Keep your private invoice link out of the scanner.
First check what actually happened in PayPal
Open the PayPal app yourself or type paypal.com in a new tab. Go to Activity. Look for the merchant, amount and transaction status. A request to send money and a payment that has already left your account call for different actions. PayPal says an unexpected invoice can arrive through its own service, complete with a note written by the sender. PayPal’s invoice scam guidance
- No matching entry
- Keep the email closed. If it claimed to come from PayPal, you can forward it to phishing@paypal.com. Use PayPal’s own Help Center if you still need help.
- An invoice or money request you did not expect
- Leave it unpaid. Select the item in Activity and use Report or Report this invoice where offered. PayPal also provides cancellation and decline options. PayPal’s reporting steps
- A completed payment you did not authorize
- Report the transaction through PayPal’s Resolution Center. Declining a separate request will not reverse a completed payment. PayPal’s unauthorized transaction guidance
Who wrote the phone number on the invoice?
Imagine a bill for a software renewal you never ordered. In the seller’s note, someone offers to cancel the charge over the phone. That number came from the person requesting payment. Even if the invoice sits inside your real PayPal account, the note gives you no reason to trust the caller. You can inspect and report the request in Activity without making a call. How PayPal describes callback scams
If you do recognize the merchant but the amount surprises you, open your existing order or contact the merchant using details from a prior purchase. Ask for the invoice number and amount on their side. Keep the phone number in the unexpected note out of that conversation.
When to use Scanify on an invoice email
Sometimes the email’s “view invoice” button points off PayPal altogether. On a computer, right-click the button and copy the link address. On a phone, use Copy Link if available. If the address contains an invoice ID, email address, login token or payment link, use just the public hostname. Leave the private invoice and its attachments out of the scanner. Scanify’s submission policy
Paste the public address into Scanify and select Run Scan. You can run one scan free. Scanify then offers checkout for the verdict and source findings. If the domain is flagged, leave the link alone. If the report shows a genuine PayPal domain, go back to Activity to verify the request itself. A scanner can examine a website, but only you and the merchant can confirm what you ordered. Check an invoice email’s public link
If you called the number or shared information
End the call. If you shared a login, change the password through the official service, including anywhere you reused it. If you gave card details or sent money, contact the card issuer or payment service immediately through a known channel. Describe what you did, including any payment you personally sent after being misled. FTC guidance by payment method
If the caller persuaded you to install remote-access software, treat that as a separate device issue. Follow the FTC’s device-recovery instructions and contact PayPal through the app for account support. Checking the invoice link again cannot tell you what the caller accessed. FTC guidance on remote access
Did the email send you to an unfamiliar website?
Inspect the public hostname in Scanify. Verify the invoice and its status independently inside PayPal.
Check an invoice link →