Fake PayPal invoice / callback scam: كيف يعمل وعلامات التحذير وماذا تفعل

Payment fraud · médio

The victim receives an invoice or money request for something they never bought, sometimes sent through PayPal's own system. The note contains an alarming message saying the charge will go through and offers a "support" number to cancel. On the other end of the line is the scammer, who asks for personal and financial details.

PayPal also warns about emails imitating its messages and requests to pay a cryptocurrency wallet. The advice is not to pay, not to call numbers in the note and to check your account by logging in directly on the website or app.

Sinais / Signs

An invoice for something you didn't buy
A phone number to "cancel" in the note or email
Alarmist language demanding quick action
A request to pay a crypto wallet
An email with links imitating PayPal

Prevenção / Prevention

Don't pay suspicious invoices or money requests
Don't call numbers included in the note
Log in by typing the website or using the official app
Never send money to a crypto wallet listed in an invoice
Never give remote access to someone you reached by phone

O que fazer / What to do

Report the invoice or request from inside your PayPal account
Forward suspicious emails to phishing@paypal.com
If you shared data, change passwords and notify your bank
Report to the FTC (US) or Action Fraud (UK)

FAQ

The invoice came from PayPal's real email. So it's legitimate?

Not necessarily. Scammers use the invoicing system to send fake charges with "support" numbers.

If I don't pay, will the money be taken?

Check by logging in through the website or app. Don't call the number in the note.

Radar

2026-11-01 — PeckShield: 56 hacks drained US$6.48bn from crypto in October, up 745% from September · US$ 6,48 bi. Binance accounts for about US$6.3bn, followed by Bitget (US$387m) and Liquid Network (US$320m). Year-to-date losses total about US$8.6bn. المصدر: TechFlow / PeckShield
2026-10-30 — Peru police arrest two from "Cyber Fake del Oriente" ring that received proceeds of foreign fraud · US$ 232 mil. The case began with US$10k stolen from a Moldovan via Apple Pay; a business account received US$232k from abroad, withdrawn and converted into crypto. المصدر: El Comercio
2026-10-30 — Brothers get 15+ years for holding Minnesota family hostage and stealing US$8m in crypto · US$ 8 mi. The Texans held a father, mother and son hostage for hours in 2025, forcing transfers of about US$8m in crypto. Sentences are 15 and 15.5 years. المصدر: MPR News
2026-10-29 — Binance hit by ~US$6.3bn crypto theft attributed to North Korea · ~US$ 6,3 bi. Early report: a DevOps engineer's laptop was compromised by TraderTraitor; ~US$3bn frozen. Possibly the largest crypto theft ever. المصدر: The Record; Help Net Security
2026-10-28 — Goiás police serve 14 arrest warrants over fake crypto investment scam · R$ 477 mil. Criminals hijacked friends' social profiles, pitched crypto and had the victim install a remote-access app; R$477k was moved in 24 hours. Warrants were served in São Paulo and Piauí. المصدر: Portal Notícias Goiás
2026-10-28 — São Paulo police arrest alleged leader of nationwide fake bank call scam. In the city's north zone, 6 search and 3 arrest warrants were served; in Goiás, Operation Cripto-Quimera served 33 warrants against fake crypto investments. المصدر: Região Noroeste
2026-10-28 — RS police dismantle fake-bank gang that laundered a R$300k scam through crypto · R$ 300 mil. A Canoas probe served warrants in São Paulo; the victim was pressured for 14 days and R$46k was turned into BTC and ETH in non-custodial wallets. المصدر: Polícia Civil RS
2026-10-28 — OFAC sanctions Russians who laundered crypto for North Korean IT workers · US$ 3,5 mi. 10 individuals and 1 entity were designated; Ilya Boykov allegedly converted US$3.5m in crypto and Vitold Obertas nearly US$2m. Eight Ethereum and Tron addresses were listed. المصدر: FinanceFeeds

PayPal - What are invoice scams and money request scams on PayPal?