PayPal Scams: Fake Invoices, Phishing Emails, and What Purchase Protection Covers

Why most PayPal scams are not sent by PayPal

In most PayPal scams, PayPal is either the tool being misused or the name being copied. The scammer is the one sending the invoice, writing the fake email, or pretending to be a buyer, and PayPal is not the author of any of it.

That distinction explains why these scams are hard to spot. Some of them arrive through PayPal itself: a scammer with a PayPal account sends an invoice or a money request, and the notice reaches you through PayPal’s normal system. Others are fake emails built to look like PayPal. And some target sellers, with a buyer who never paid at all.

The FTC’s guide to phishing lists the stories these messages tell: suspicious activity on your account, a problem with your payment information, an invoice you do not recognize. The PayPal versions follow the same scripts, with two extra details that matter: the phone number written inside a real invoice, and the protection rules that decide whether your money can come back.

The fake invoice with a phone number in the note

A PayPal invoice or money request for something you never ordered is a scam, even when the email comes from PayPal’s own system. Do not pay it, and do not call any phone number written in its note. PayPal’s page on invoice and money request scams says exactly this.

The trick uses a real feature: invoices and money requests sent through PayPal, which carry a note written by the sender. The scammer puts an alarming message in that note along with a phone number that looks like PayPal’s. PayPal describes it as an alarmist note asking you to call a fake customer service number in the hope of getting your personal or financial details over the phone. This example is made up, and it follows the pattern PayPal describes:

• Invoice for $499.99, “Computer Security Plan, annual renewal.” Note from seller: “Your order will be charged today. If you did not authorize this purchase, call our billing department immediately to cancel and receive a refund.”

The price is chosen to alarm you, the product is one you never bought, and the only way offered to “cancel” is the phone number in the note. The person who answers usually asks you to install a remote access program or to read back a code. The FTC describes the same script in fake subscription renewal notices: you call to dispute the charge, the caller asks for remote access, then claims they refunded you too much and asks you to pay back the difference.

An unpaid invoice takes nothing from you. To deal with it, log in to PayPal yourself, find the invoice or request, and use the option to report it. PayPal also says never to send money to a cryptocurrency wallet mentioned in an invoice or money request.

How to tell if a PayPal message is real

The most reliable test is to leave the message and check your account yourself: open the PayPal app or type paypal.com into the browser, log in, and see whether the payment, limitation, or request is really there. PayPal’s own guidance on fake emails comes back to that step several times.

The list below uses only what PayPal says about its own messages. Each item is something you can check in under a minute:

• The greeting. PayPal says its emails address you by your first and last name or your business name, never “Dear user” or “Hello PayPal member.”
• Where the link really goes. A link can display a paypal.com address and lead somewhere else. PayPal suggests hovering over the link on a computer to see the true destination.
• Where you are asked to type your password. PayPal says it only asks for your password on its own login page.
• Attachments. PayPal warns about unknown attachments, especially invoices from companies you do not know.
• Urgency. A warning that you must act immediately is, in PayPal’s words, a common sign of a fake. If something urgent is really needed, you will find it after logging in.
• A payment notice with shipping instructions. PayPal says it will never ask you to share a tracking number by email, and that a real payment always appears in your PayPal activity.

A message can pass all of these and still be fake, and a real invoice from a scammer can pass them too, because it really was sent through PayPal. Logging in yourself is the one step that works for both. For a longer walk through sender addresses and link previews, see how to spot a fake email before you click.

To report a suspicious email, PayPal asks you to forward it to [email protected] and then delete it. The same address takes suspicious text messages.

The “your account has been limited” email

PayPal does limit accounts, so an email saying yours is limited can be real. The way to know is to log in: if there is no limitation in your account, the email is fake. PayPal’s page on limited accounts says this directly and asks you to forward the fake to [email protected].

That is what makes this email work. The same page lists real reasons for a limitation, such as a review after someone accessed an account without permission, or a request for identity documents. A scammer copies that tone and adds a button that leads to a fake login page.

A real limitation is resolved inside your account, in the Resolution Center or the notification bell on the dashboard, where PayPal asks you to complete the steps. PayPal also says that in most cases customer service cannot remove a limitation over the phone. So an email or call that offers to fix the limitation through a link, a phone number, or a payment does not match how PayPal says it works.

If you already clicked a link or opened an attachment from one of these emails, PayPal’s advice is to log in and review your payments and to change your password.

Fake payment notices and overpayments aimed at sellers

If you sell things online, the most common PayPal scam is a buyer who never actually paid. Before you ship anything, log in to PayPal and confirm the payment appears in your activity. PayPal says a real payment always shows there.

The fake payment notice is an email built to look like PayPal telling you money has arrived, sometimes adding that the funds will be released once you send a tracking number. PayPal says it never asks for a tracking number by email.

The overpayment is a variation. PayPal’s list of common scams gives the example of a buyer who claims to have paid $500 for a $300 camera and asks you to send back the extra $200 along with the item. Sometimes the email is fake and nothing was paid. Other times a real payment arrives, funded with a stolen card or bank account, and PayPal warns that if the real account owner reports it, the money can be taken back from your account. You then lose the item, the shipping cost, and the “difference” you sent.

Shipping is the other weak point. PayPal’s page describes buyers who ask you to use their own shipping account or prepaid label, or who reroute the package after it ships, and then claim it never arrived. Its advice is to use only your own shipping account and ship only to the address on the Transaction Details page. The same pressure to pay or ship outside the normal process shows up across marketplace scams.

What Purchase Protection covers, and what it does not

PayPal’s Purchase Protection may refund an eligible purchase when the item never arrives or is significantly different from its description. It does not cover payments sent as Friends and Family, and it does not cover every kind of purchase. These details come from PayPal’s Purchase Protection Program page, last updated January 26, 2026.

What it can cover

• Item Not Received: you paid and the item never came. PayPal says this claim does not qualify if the seller shows proof of shipment or delivery.
• Significantly Not as Described: a completely different item, a used item sold as new, a counterfeit sold as authentic, missing parts that were not disclosed, or damage in shipping, among other cases.

When it applies, PayPal says coverage may include the full purchase price plus the original shipping, but not the cost of shipping the item back if you are asked to return it.

What it does not cover

• Personal payments, including those sent as Friends and Family.
• Real estate, vehicles (with a few exceptions such as bicycles), businesses, and industrial machinery.
• Gift cards, prepaid cards, and other payments equivalent to cash, plus gold, financial products and investments, and NFTs.
• Donations, payments to government agencies, and gambling.
• Item Not Received claims for things you picked up in person, with some exceptions for goods and services QR code payments.

The deadlines

An Item Not Received dispute must be opened within 180 days of the payment. A Significantly Not as Described dispute must be opened within 30 days of delivery or 180 days of the payment, whichever comes first. If you and the seller cannot agree, you must escalate the dispute to a claim within 20 days, or PayPal closes it.

If you paid through PayPal with a credit or debit card, you may also be able to dispute the charge with your card issuer, and PayPal’s policy says card rights may be broader. You have to choose one route: a dispute with PayPal or one with the card issuer, not both at once. Our guide on how to dispute a credit card charge covers the card side.

What Seller Protection covers for sellers

Seller Protection may let a seller keep the payment when a buyer claims the payment was unauthorized or that the item never arrived. It does not cover claims that the item was not as described. The rules below come from PayPal’s Seller Protection Program page, last updated January 26, 2026.

The requirements that matter most for the scams above:

• The primary address on your PayPal account must be in the United States.
• You must ship to the address on the Transaction Details page. If the package is redirected to a different address after shipping, the sale is not eligible, which is why PayPal recommends not using a shipping service arranged by the buyer.
• You need proof of shipment or delivery from the shipping company, with an online tracking number and an address that matches the Transaction Details page.
• For an unauthorized transaction claim, the payment must be marked eligible or partially eligible on the Transaction Details page.
• Items sent after PayPal advised you not to release them are not covered.

Personal payments sent as Friends and Family are excluded here too. A buyer who pays you that way and then asks for the item to be picked up or shipped somewhere else is leaving you without the protection that would cover a disputed sale.

If you already paid, called the number, or typed your password

Act on the account first and report second. How much can come back depends on what happened: money someone else moved out of your account is treated very differently from a payment you sent yourself.

1. If you gave out your password or a code, or let someone connect to your computer, change your PayPal password now from a device you trust. If a caller had remote access, the FTC’s advice is to update your security software and run a scan. Change the password anywhere you used the same one.
2. Report any payment you did not make. In the Resolution Center, choose Report a problem, pick the payment, and choose the option for unauthorized activity. PayPal says you will get an email within 10 days.
3. If you paid for something that never came, open a dispute in the Resolution Center, and keep the 20-day escalation deadline in mind.
4. Call your bank or card issuer if you shared card or bank details, or if the payment was funded by a card and you want to dispute it there instead.
5. Forward the email or text to [email protected], then delete it.
6. Report it to the FTC at ReportFraud.ftc.gov. If you shared your Social Security number or bank account number, IdentityTheft.gov gives a recovery plan for that specific information.

For money taken without your permission, PayPal’s user agreement says it will cover the full amount of unauthorized activity as long as you cooperate and follow its procedures, and asks you to tell it at once. It warns that if you wait more than 60 days after the statement showing the transfer, you may not get back money lost after that point. The CFPB’s Electronic Fund Transfer FAQs add that when someone tricks you into giving them your login or a texted code and then moves money, the transfer counts as unauthorized under Regulation E.

A payment you sent yourself, especially as Friends and Family, is harder. The FTC notes that once you send money through a payment app, it is hard to get it back. Be wary of anyone who contacts you afterward offering to recover it for a fee. That is a refund scam, and it often follows the first one. Other places to file are listed in the guide to reporting a scam.

PayPal scam questions