PayPal Scam: How Fake 'Payment Received' and Invoice Scams Work

PayPal scams aren’t one single tactic — they’re a family of related scams that all borrow PayPal’s brand recognition and payment infrastructure, and they work differently enough that it’s worth knowing which version you’re looking at. The three most common are phishing emails/texts, fake “payment sent” overpayment scams, and — the trickiest to spot — real PayPal invoices sent by a scammer for something you never bought.

Phishing: fake “account limited” or “you’ve received a payment” emails

This version looks like Apple ID or bank phishing: an email claims your PayPal account has been limited, that unusual activity was detected, or that you’ve received a payment and need to “confirm your identity” to accept it. The link leads to a convincing fake PayPal login page on a domain that isn’t paypal.com. Anything entered there — email and password — goes to the scammer, who can then access the real PayPal account, including any linked bank account or card.

Overpayment scams (common on marketplace sales)

If you’re selling something online and paid through PayPal, a buyer might send what looks like a payment confirmation for more than the agreed price, then ask you to refund the difference — sometimes with an urgent story about a “shipping mix-up.” The catch: the original “payment” is fake or will be reversed once the scammer disputes it as unauthorized, meaning you’ve refunded real money for a payment that never actually completes. This is the same underlying mechanic behind fake-check scams, just running through PayPal’s transfer system instead of a physical check.

Fake but real invoices

This is the version that trips up even careful people, because the invoice you receive genuinely comes from PayPal’s own system — it’s not spoofed or faked. A scammer creates a PayPal Business account, then sends an invoice through PayPal’s actual invoicing tool for something you never ordered, often a large “confirmation” for antivirus software, cryptocurrency, or electronics, with a phone number listed to “cancel this order.” Calling that number connects you to the scammer directly, who then tries to get remote access to your computer or a refund sent by a different payment method (since a real PayPal transaction, once actually paid, can be disputed — the scammer wants you to “cancel” through them instead, off-platform).

Warning signs

• A link in an email asking you to “confirm” or “verify” your account — go to paypal.com directly instead of clicking.
• A payment for more than the agreed amount, especially combined with a request to refund the difference before the payment has time to fully verify as legitimate.
• An invoice for something you never ordered, especially one urging you to call a phone number to “dispute” or “cancel” rather than handling it inside your own PayPal account.
• Urgency and unfamiliar amounts — large, round, alarming numbers are chosen specifically to prompt an immediate reaction.

How to check if something is real

For any PayPal email or text, don’t click the link — log in directly at paypal.com (typed yourself, or through PayPal’s official app) and check your account activity and messages there. Anything genuinely happening on your account will show up when you navigate there independently. For a suspicious invoice, do the same: log into your actual PayPal account and check the transaction directly rather than calling any phone number listed on the invoice or emailed to you.

Protection tips

• Never click a link in an email or text claiming to be from PayPal — navigate to paypal.com directly or use the official app.
• If you receive an invoice for something you didn’t order, don’t call any number on it — log into PayPal directly, and use PayPal’s own “report” function on the transaction.
• For marketplace sales, wait until a payment fully clears and shows as available in your actual balance — not just as a notification — before shipping anything or refunding any amount.
• Forward suspicious PayPal emails to phishing@paypal.com, PayPal’s official reporting address.

The Marketplace Scam Risk Calculator is built for exactly the overpayment and off-platform-pressure pattern described above, and the Website Trust Score Calculator can check a suspicious “PayPal” link’s actual domain before you click it.

FAQs

Is a PayPal invoice always legitimate since it comes through PayPal’s real system? The invoice itself is real (sent through PayPal’s actual tools), but that doesn’t mean the sender or the product being billed is legitimate — anyone can create a PayPal Business account and send an invoice for anything.

What should I do if I receive an invoice for something I never ordered? Don’t call any number listed on it. Log into your PayPal account directly and use the report/dispute function there, or simply ignore it if no payment has actually been taken.

I refunded an “overpayment” to a buyer and now the original payment reversed — what happened? This is a common scam pattern: the original payment was fraudulent or disputed as unauthorized after you’d already sent the refund, leaving you out the refunded amount. Report it to PayPal and, if it involved a marketplace platform, report the buyer there too.

How do I report PayPal phishing? Forward suspicious emails to phishing@paypal.com and report suspicious texts the same way you would any smishing attempt.