PayPal Scam Email: How to Spot Fake PayPal Emails in 2025

PayPal is one of the most impersonated brands in the world of phishing — and for good reason. It is used by more than 400 million people globally, it processes real financial transactions, and a convincing PayPal security alert triggers immediate concern from almost anyone who receives it. That combination of ubiquity and financial significance makes PayPal the #1 brand impersonation target in email phishing campaigns.

—

What Fake PayPal Emails Look Like

PayPal phishing emails follow a small number of templates, repeated and varied across millions of campaigns. Knowing these templates makes them instantly recognizable.

The Invoice Scam (Most Common)

You receive an email with a dollar amount — often $199, $299, $399, or $499 — claiming your PayPal account has been used to make a payment, process an invoice, or renew a subscription. The email says you have 24-48 hours to cancel by calling a phone number. The number connects to a scammer, not PayPal.

“Your PayPal invoice for $299.99 has been processed. To cancel or dispute this charge, call 1-888-XXX-XXXX within 24 hours.”

The Account Limitation Email

Your account has been “temporarily limited” due to “unusual activity” or a “policy violation.” You must verify your identity within a deadline or your account will be permanently closed. A link leads to a fake PayPal login page.

The Unauthorized Transaction Alert

“A payment of $487.32 to [Merchant Name] was attempted from a new device. If this was not you, click here to dispute this charge.” The link leads to a credential-harvesting site.

The “You’ve Received Money” Notification

“Jane Smith sent you $1,500.00. Click here to accept.” A link leads to a fake PayPal page asking for your credentials or bank details to “release” the funds.

—

How to Tell If a PayPal Email Is Real or Fake

Check 1: The sender’s email address.

Real PayPal emails come from @paypal.com only. Any other domain — @paypal-billing.com, @paypal-secure.net, @service-paypal.com — is fraudulent. This is the most reliable single check.

Check 2: Does it address you by name?

Real PayPal emails always use your full name, exactly as it appears in your PayPal account. “Dear Customer” or “Dear PayPal User” is always fake.

Check 3: Log in directly to PayPal — not through the email.

If there’s a genuine issue with your PayPal account, it will be visible when you log in at paypal.com directly (type the address — don’t click the link). If nothing is wrong in your actual account, the email is fraudulent.

Check 4: Hover over links before clicking.

The visible link text may say “paypal.com” but the actual URL behind it goes somewhere else entirely. Check before you click.

Check 5: Never call a number provided in an email.

Real PayPal does not include a phone number to call for billing disputes in their automated emails. A phone number in a PayPal billing email is the clearest sign it’s a scam.

—

What to Do If You Received a Fake PayPal Email

Do not call the phone number. Do not click any links. Do not reply to the email.

If you only received it and didn’t interact: Report it to phishing@paypal.com (forward the email as an attachment or copy). Mark it as phishing in your email client. Delete it.

If you clicked a link and entered your PayPal credentials: Log into your real PayPal account immediately (at paypal.com, typing the address directly) and change your password. Enable two-factor authentication if you haven’t already. Check your recent transactions and linked bank accounts. Contact PayPal’s real customer service at paypal.com/selfhelp.

If you called the phone number and provided information: Contact PayPal directly at their official support number (available at paypal.com). If you provided bank account or card information, contact those institutions immediately.

If a charge was actually made on your PayPal account: Log in to PayPal and open a dispute. PayPal’s Resolution Center handles unauthorized transaction disputes.

—

How to Report a PayPal Phishing Email

Forward the email to: phishing@paypal.com

This is PayPal’s official phishing reporting address. They actively investigate and work with law enforcement and hosting companies to take down fraudulent sites.

Also report to: spam@uce.gov (FTC)

And to your email provider using the built-in “Report Phishing” function.

—

Frequently Asked Questions

Q: If I receive a PayPal invoice email for something I didn’t buy, do I owe the money?

A: No. The invoice scam works by creating fear that you owe money when you don’t. Check your actual PayPal account — if there’s no corresponding transaction, no money was charged or will be charged. The email is purely designed to get you to call the fraudulent number.

Q: Can PayPal scam emails look identical to real PayPal emails?

A: Yes. Sophisticated phishing emails use PayPal’s actual email templates, logos, and formatting. The sender address is the most reliable distinguishing factor — always check it.

Q: PayPal said my email address was used for a transaction but I’m not a PayPal customer. What does that mean?

A: It almost certainly means the email is phishing. Someone is mass-blasting emails and they happened to send one to your address. You have no PayPal account associated with their record.

→ Back to Pillar: https://www.scammed.org/phishing/