PayPal Scam Emails: 7 Fakes Making the Rounds Right Now

PayPal is one of the most trusted names in online payments, which is exactly why scammers love impersonating it. With over 400 million active users worldwide, a well-crafted fake PayPal email can feel completely legitimate, the logo looks right, the sender address almost matches, and the message triggers just enough urgency to make you click before you think.

The hard truth? Some of these emails now arrive from real PayPal infrastructure, meaning traditional spam filters won't catch them. The FTC reported Americans lost more than $10 billion to fraud in 2023, with email the most common way scammers made contact.

Below are the 7 PayPal scam emails circulating right now, how each works, the red flags to watch for, and exactly what to do if one lands in your inbox.

Why PayPal is a prime target for scammers

PayPal sits at the intersection of personal identity and money, making it irresistible to fraudsters. A successful phishing attack doesn't just steal your password, it can expose your linked bank account, credit cards, home address, and Social Security number in one shot.

What makes the threat especially tricky in 2025:

• Scammers are abusing PayPal's own tools. Criminals send fake invoices and money requests directly through PayPal's platform, so the email genuinely comes from service@paypal.com and passes every authentication check.
• AI-generated copy is nearly perfect. Gone are the days of obvious typos and broken English.
• Urgency is weaponized. Most PayPal scam emails create a 24-48-hour deadline meant to bypass your critical thinking.

The 7 PayPal scam emails you need to know

1. The fake invoice scam (a.k.a. the "Geek Squad" or "Norton" email)

What it looks like: A PayPal payment confirmation for a software subscription renewal (Geek Squad, Norton, or a crypto platform) ranging from $300-$1,000 you never authorized, with a phone number to "call immediately to dispute."

How the scam works: There's no real charge, yet. Calling the number connects you to a fake agent who tries to gain remote access to your computer, trick you into buying gift cards as a "refund," or harvest your banking credentials. The most insidious version uses PayPal's actual invoice system, so the email genuinely comes from service@paypal.com. The weapon is the phone number in the notes field, not a phishing link.

Red flags:

• You don't recognize the subscription
• A phone number is prominently displayed to "dispute the charge"
• Business name like "Geek Squad Renewal" or "Crypto Desk Support"
• Oddly specific amount (e.g., $349.99, $899.00)

What to do: Log in to PayPal directly. If no charge appears, delete the email. If a charge does appear, report it to PayPal, do not call the number in the email.

2. The "your account is suspended" phishing email

What it looks like: An urgent warning that your account has been "limited," "suspended," or "locked" due to suspicious activity, with a big "Verify Now" button and a 24-48-hour deadline.

How the scam works: The button leads to a fake PayPal login page that captures your email, password, and sometimes a 2FA code in real time. Scammers then drain your balance and linked accounts before you notice.

Red flags:

• Extreme urgency ("your account will be permanently closed in 24 hours")
• Generic greeting: "Dear Customer" or "Dear PayPal User"
• Sender address like paypa1.com, paypal-support@helpdesk.net, or paypal-secure-login.com
• Hovering over the button reveals a URL that doesn't start with https://www.paypal.com

What to do: Never click the button. Go to paypal.com directly, real account restrictions appear in your dashboard, not via panicked emails.

3. The "you've received a payment" fake notification

What it looks like: A convincing email saying someone sent you $200-$500, prompting you to "confirm your account" or "accept the payment" via a link.

How the scam works: No money was sent. The goal is to lure you to a fake login page or extract personal details to "verify your identity before funds are released." Sellers are also targeted: a fake payment confirmation tricks them into shipping goods before checking their actual balance.

Red flags:

• You weren't expecting a payment
• The email asks you to click a link to "accept", real PayPal payments credit automatically
• Sellers are urged to ship immediately because payment is "pending release"
• Subject lines like: "You've received $340.00, confirm to claim"

What to do: Log in directly and check your balance. If the money isn't there, it's a scam. Sellers should never ship based on an email, only after confirming funds in-app.

4. The overpayment scam email

What it looks like: You're selling something online and a buyer sends a PayPal confirmation showing they overpaid (say, $800 for a $500 item) and asks you to ship the item and wire back the $300 difference.

How the scam works: The confirmation is fake; no money was sent. If you wire the "difference," you lose that cash with no recourse. Even when a scammer does send money first, it often comes from a stolen account, PayPal reverses it weeks later, leaving you out both the item and the refund.

Red flags:

• Buyer wants the refund via wire transfer, Zelle, or gift card, not back through PayPal
• Urgency to ship before the overpayment is "sorted"
• Confirmation email doesn't match your actual PayPal balance
• Buyer is unusually eager and unconcerned about item details

What to do: Always verify payments by logging into PayPal directly. Never refund via a different method than the original payment. If something feels off, cancel the transaction.

5. The prize and lottery winner email

What it looks like: Congratulations, PayPal selected you for a cash prize or loyalty reward. To claim your $500 (or $5,000), just pay a small "processing fee" or "release tax."

How the scam works: Classic advance-fee fraud in PayPal branding. The prize doesn't exist. Any fee you pay goes straight to the scammer. Sometimes they skip the fee and ask for your bank details to "deposit your winnings."

Red flags:

• You never entered a PayPal contest
• You must pay a fee to claim your prize
• The email requests your bank account or Social Security number
• Sent from a personal address or non-PayPal domain

What to do: Delete immediately. PayPal does not run random cash giveaways, and no legitimate prize requires an upfront payment.

6. The cryptocurrency purchase confirmation email

What it looks like: A PayPal email confirming you just bought Bitcoin or Ethereum, sometimes thousands of dollars' worth, that you never purchased, with a phone number or link to "cancel immediately."

How the scam works: A variant of the fake invoice scam updated for crypto. The goal is to get you on the phone with a fake agent who steals credentials, installs remote-access software, or tricks you into sending "verification funds" in crypto that can't be recovered.

Red flags:

• You have no crypto holdings or interest
• A phone number is provided to "dispute", PayPal disputes are handled in-app, not by phone
• Amount is large enough to cause panic (typically $500-$2,500)
• Sender name says "PayPal Crypto Desk" or "PayPal Digital Assets"

What to do: Log in to PayPal. If no crypto purchase exists, delete the email and report it to phishing@paypal.com.

7. The money request scam email

What it looks like: A legitimate-looking PayPal money request (sometimes posing as a friend, landlord, seller, or charity) ranging from $20 to several thousand dollars. Because scammers use PayPal's actual money-request feature, the email looks completely authentic.

How the scam works: In February 2025, the Pennsylvania Attorney General warned about scammers sending payment requests through PayPal, sometimes several at once to create urgency, with a toll-free number in the note that connects victims to the scammer. The note might say "invoice for services rendered" or impersonate someone in your network. Victims who pay send real money to real scammer accounts with no way to reverse it.

Red flags:

• You don't recognize the requester
• The note contains a made-up invoice, charity appeal, or urgent story
• Multiple requests arrive rapidly to create pressure
• The amount doesn't correspond to any purchase you remember

What to do: Only accept requests from people you know and have confirmed with outside PayPal. Never pay an unexpected request. Report suspicious requests through PayPal's resolution center.

How to spot any fake PayPal email: a quick checklist

Whether or not the email matches one of the seven types above, run through this checklist before you click, call, or pay anything:

What to do if you've already clicked or shared information

If you've already interacted with a suspicious PayPal email, act fast:

1. Change your PayPal password immediately. Go directly to paypal.com, don't use any link from the suspicious email.
2. Enable two-factor authentication (2FA) on your PayPal account if you haven't already.
3. Check your linked accounts. Review linked bank and credit card statements for unauthorized transactions.
4. Contact your bank. If you shared financial information, alert your bank and ask about fraud holds.
5. Report the phishing email. Forward it to phishing@paypal.com and report it to the FTC at reportfraud.ftc.gov.
6. Scan your device. If you clicked a link or downloaded an attachment, run a full security scan. A browser security tool like Guardio can detect malicious pages and phishing attempts in real time.

How Guardio protects you from PayPal phishing scams

Even cautious users can be caught off guard by a convincing phishing email, especially one arriving from a real PayPal address. That's where an extra layer of protection makes all the difference.

Guardio's security protection, on your browser and your phone, monitors in real time for:

• Phishing pages. Guardio blocks fake PayPal login pages before you enter your credentials, even when the domain looks nearly identical to the real thing.
• Malicious links. Any link from a suspicious email is checked against Guardio's threat database the moment you click it.
• Identity breach monitoring. If your email or financial data surfaces in a breach, Guardio alerts you immediately so you can act before scammers do.
• Unwanted extensions and malware. If a phishing email installed anything on your browser, Guardio detects and removes it.

Staying ahead of PayPal scammers doesn't require being a cybersecurity expert, just the right tools working quietly in the background so you can pay, send, and shop with confidence.

Conclusion

PayPal scam emails are more sophisticated than ever, and some are nearly impossible to distinguish from the real thing by email alone. The safest habit you can build: treat every PayPal email as a notification, not an instruction. Never act on the email itself, always go directly to your account to verify.

Know the seven scam types, run the quick-check checklist, and add a real-time protection layer to catch what your eyes might miss.

Think a scam email landed in your inbox? Forward it to phishing@paypal.com and then delete it. When in doubt, don't click. Go direct.

Get a free security scan with Guardio today and stay protected from phishing emails and scam links.