About scam emails

We’ve previously covered several examples of email scams on the site. In many cases, you can spot them by checking the sender, the link domain, and the writing style. Of course, if something feels off, contacting customer service to confirm is also a good idea.

Over the past few days, I received another PayPal invoice scam email, so I want to explain what it was and how to deal with it.

PayPal Invoice scam email

It started when I checked my inbox and found an email that appeared to be from PayPal, saying I had bought something from mistergun. My first reaction was curiosity: with how aggressively email providers now filter spam, messages from sketchy-looking merchants like this would usually get blocked automatically. So what was going on?

Of course, I wasn’t going to fall for it that easily. I first used the method I mentioned before and checked the sender’s email domain. Surprisingly, it really was sent by PayPal. That made me wonder: had my PayPal account been compromised and used to buy something?

Then I checked the invoice link, and it really did use a PayPal domain. It wasn’t some phishing site.

I also checked the footer at the bottom of the email, and it looked like standard official PayPal formatting too.

So I decided to open the invoice and take a look. As long as I didn’t enter any information and didn’t click random links, just viewing content under a PayPal domain should be relatively safe. So I copied the invoice URL into the address bar myself to make sure it was really a PayPal domain.

When I opened it, it really was an invoice, complete with a payment button on the side. Was my PayPal account actually compromised, and had someone bought something on this site?

So what was actually happening?

This is actually a very common PayPal invoice scam email. If you call the phone number in the email or pay the invoice, then you’ve fallen for it. The key point is that this is just a money request sent to you by a scammer through PayPal. In other words, it’s meant to make you think you placed an order and still need to pay for it through that link. But in reality, you never bought the item, never placed an order, and never received anything, so naturally there is nothing you need to pay. To be safe, you can always log in to your PayPal account directly and check whether there is any related transaction history.

In fact, anyone can generate an invoice through PayPal and send it to someone else. It’s simply a feature provided by PayPal.

You can type in basically anything you want there—even AMEX Black Card for sale.

And because the invoice email you receive is still officially sent by PayPal, it can look very convincing at first glance.

Summary

I’ve actually received this kind of email many times before—fake invoices for antivirus software, random websites, and all sorts of other things. For this type of pure phishing email, the best move is simply to ignore it. So don’t assume that just because an email comes from PayPal, it must be legitimate; scammers can also use PayPal as a tool in their scheme.