Fake PayPal Payment Email Script
This email mimics a payment confirmation or invoice from a PayPal-style service, showing a large unexpected charge and a "customer support" phone number to dispute it. The scammer isn't after the fake charge itself — they want you to panic and either call the number, where they'll push you toward remote-access software or gift cards, or click through to a fake login page that steals your username and password. The lever is the shock of an unauthorized-looking payment triggering an immediate, unthinking reaction. The most important step is to check your actual account balance and transaction history by logging in directly through the official app or website, never through the email.
Last reviewed: 1 June 2026
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
You sent [amount] to [unknown recipient]. If you didn't authorise this, call [phone number] immediately.
Invoice [number]: [amount] is due. To dispute, log in here: [fake link]
Your account is limited until you confirm your details: [fake link]
What the scammer wants
To make you panic and call a fake 'support' number (leading to a refund/remote-access scam) or log in on a phishing page that steals your credentials.
Red flags in the message
- Alarming 'you paid someone' or 'account limited' message
- A phone number to call to 'cancel' a payment
- Login links to non-official domains
- Requests for password, card details, or codes
A safe response
Don't click links or call numbers in the email. Log in to your account by typing the official address yourself, and check directly. Report the email as phishing.
What not to send
- Login credentials
- Card details
- One-time codes
What to do if you already replied
- Change your password and enable strong 2FA
- If you called and gave access or details, disconnect and contact your bank
- Report the phishing email
Evidence to preserve
- Screenshot the full message or call details
- Note the sender number, email, or profile
- Save any links (without clicking) and payment details
- Record dates and times
Frequently asked questions
I already called the number in the email — is my account compromised?
If you only spoke to them without installing anything or sharing codes, your account is likely still safe, but stay alert for follow-up contact. If you installed suggested software or shared a login code, treat your account and device as compromised and act immediately.
I let them remotely access my computer — what should I do now?
Disconnect from the internet, then uninstall the remote-access software; get help from a trusted person or legitimate repair service if unsure how. Change your important passwords from a different, uncompromised device, and contact your bank if you shared payment details.
The email had the right logo and formatting — how can it be fake?
Scammers routinely copy logos, colours, and layout from real company emails, so visual polish tells you nothing about authenticity. Check the sender's actual email address, not just the display name, and log into your account independently rather than trusting the email's content.
How do I report this email as a scam?
Use your email provider's 'report phishing' or 'report spam' button, which helps filter similar messages in future, and forward it to the real company's official abuse or phishing-report address listed on their website. Don't reply to the email itself.