Is that Zelle or PayPal invoice a scam?
If you didn't buy anything, yes. The invoice exists to make you call the 'dispute' number or click the 'cancel' link — that's where the actual theft happens.
Fake-invoice scams weaponize the platforms' own machinery. In the PayPal version, scammers send a genuine PayPal invoice or money request — generated through a real (throwaway) PayPal account — for something you never ordered: a Bitcoin purchase, an antivirus renewal, a 'GeekSquad' subscription for $300–$600. Because it comes through PayPal's real system, it lands in your inbox from a legitimate paypal.com address and passes every spam filter.
The invoice itself is harmless if ignored. The trap is the seller note: "If you did not authorize this charge, call our fraud department at 1-888-…" or a cancellation link. Call it and a fake agent walks you through 'reversing' the charge — which really means installing remote-access software, reading out bank codes, or 'accidentally refunding too much' so you have to send the difference back. The Zelle variant is a spoofed payment-pending or invoice email with a dispute link that leads to a phishing page harvesting your bank login.
How does the scam work?
- 01
A real invoice from a fake seller
Anyone can open a PayPal account and send invoices to any email address. The scammers send thousands, knowing the alarming amount will make a fraction of recipients react. Zelle versions skip the real platform and spoof the email entirely.
- 02
The 'dispute' channel is the scam
The phone number in the seller note doesn't reach PayPal or your bank — it reaches the scammers' call center. The 'cancel' link doesn't open zellepay.com — it opens a phishing copy that captures your bank username and password.
- 03
The 'refund' becomes remote access or a reverse transfer
On the call, the 'agent' has you install AnyDesk or TeamViewer to 'process the refund,' then shows a doctored screen where they 'accidentally' refunded $4,799 instead of $479 — and pleads with you to wire back the difference. The overage never existed; your wire is real.
What are the red flags to check?
An invoice for something you never bought
That's the whole tell. Real merchants don't invoice strangers. An unexpected invoice — however legitimate the email headers look — is bait, and the only wrong move is engaging with it.
A phone number in the invoice or seller note
PayPal doesn't put fraud-department phone numbers in seller notes, and banks don't handle Zelle disputes through numbers embedded in emails. Any 'call us to cancel' number belongs to the scammers.
The dispute link's domain isn't the platform's
Hover before you click. zelle-dispute-center.com, paypal-billing-support.net, or any hyphenated lookalike is a phishing page. Real disputes happen inside your account at paypal.com or your own bank's app — nowhere else.
Pressure to act within hours
"Your account will be charged in 24 hours unless you call" is manufactured urgency. An unpaid invoice charges you nothing, ever — PayPal invoices only move money if you actively pay them.
Anyone asking you to install software or read out codes
No genuine refund requires remote-access software, your online-banking password, or a code texted to your phone. Each of those hands the scammers your actual accounts.
Unsure even after checking these? That’s exactly what the $2 Instant URL Check is for — paste the link and get a researched verdict with evidence, instead of guessing.
What should you do right now?
- Don't pay it, don't call the number, don't click the link. An ignored invoice costs you nothing.
- Check your account directly: log in at paypal.com or your bank's app by typing the address yourself. If no charge exists there, no charge exists.
- In PayPal, cancel the invoice and report it (there's a 'report this invoice' option). Forward phishing emails to [email protected] or [email protected], then delete.
- If you already called and installed software or shared codes, disconnect the computer, run a malware scan, change your bank passwords from a different device, and call your bank's real fraud line now.
What the check does: a one-time, researched risk report on the URL you paste. What it doesn’t do: continuous monitoring, takedowns, fund recovery, or legal advice — and we’ll never pretend otherwise.