Cybercriminals are getting smarter at making their scams look authentic, and this week’s scheme is a perfect example. Victims are receiving emails that appear to come directly from a legitimate PayPal address, complete with an invoice for a large purchase they never made. To dispute the charge, the email conveniently provides a phone number—but that number doesn’t connect to PayPal at all.
Here’s how it works: scammers create a PayPal account and send fraudulent invoices through the platform. While the email itself is genuine in the sense that it comes from PayPal’s system, the invoice is completely fake. If you call the number listed, you won’t reach PayPal support. Instead, you’ll be speaking to a cybercriminal posing as a representative. Their goal is to pressure you into handing over sensitive details, such as your credit card information for a “refund,” or trick you into paying unnecessary fees to “secure” your account.
How to Protect Yourself
To stay safe from this type of phishing attack, keep these precautions in mind:
Verify through PayPal directly: If you receive an unexpected invoice, don’t rely on the email. Log in to your PayPal account via the official website or app to check if the charge is real.
Stay skeptical of urgent requests: Even emails from legitimate-looking addresses can be part of a scam. Treat any unexpected bill, payment request, or warning message with caution.
Use only official contact channels: Never call the phone number listed in a suspicious email. If you need help, go straight to PayPal’s official website and use their published support options.
Phishing attacks are designed to exploit urgency and fear. By slowing down, verifying information, and using only trusted channels, you can avoid becoming the next victim of this increasingly convincing scam.