untrappable

PayPal email scam: is that invoice or alert real?

Editorially reviewed · Last updated June 16, 2026

Yes — this is a scam. PayPal never sends invoices from “paypa1-billing.com.”

Invoice #INV‑4471 — payment of $649.99 confirmed
P
PayPal Service
service@paypa1-billing.com
9:14 AM
We've charged your account $649.99 for a Norton 360 subscription renewal. If you did not authorize this, cancel within 24 hours to avoid the charge: paypa1-secure.com/cancel
Cancel this payment
The Email, as received

Other versions you might get: A fake “you sent a payment” receipt, a money-request from a stranger, or an invoice for crypto or gift cards. The goal is always to get you to call a number or click a link in a panic.

What to do right now

  1. Don't click the link or button, and don't call any number in it.
  2. Check your real account — open the PayPal app or type paypal.com yourself. The “charge” won't be there.
  3. Report it. Forward the email to phishing@paypal.com, then file at reportfraud.ftc.gov.
  4. Delete it, and mark it as phishing so future ones get filtered.

How to make sure it never bites you

Phishing lands because your address is on breached lists. Reduce the blast radius — see how to lock down your accounts.

Frequently asked

Does PayPal send invoices or charge alerts from paypa1-billing.com?
No. PayPal only emails from @paypal.com, and real activity always shows when you log in at paypal.com or in the app. A sender like paypa1-billing.com swaps the letter “l” for the number “1” — a classic look-alike. Treat any surprise invoice or charge email as phishing until you check your real account.
There's a $649.99 charge in the email — is it real?
Almost certainly not. Don't use any link or “cancel” button in the email — open the PayPal app or type paypal.com yourself, and the charge won't be there. Fake invoices for Norton, crypto, or gift cards exist only to make you click or call a number in a panic.
I clicked the link and entered my PayPal login — what now?
Change your PayPal password immediately at paypal.com, turn on two-factor authentication, and review your linked cards and recent activity. Call your bank if you entered card details. Then forward the original email to phishing@paypal.com and report it at reportfraud.ftc.gov.
How can I tell a real PayPal email from a fake one?
Check the full sender address, not the display name — real ones end in @paypal.com exactly. Genuine PayPal emails greet you by your full name and never threaten you with a deadline. When in doubt, ignore the email and log in at paypal.com to check.

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.