untrappable

PayPal email scam: is that invoice or alert real?

Editorially reviewed · Last updated June 16, 2026

Yes — this is a scam. PayPal never sends invoices from “paypa1-billing.com.”

Invoice #INV‑4471 — payment of $649.99 confirmed
P
PayPal Service
service@paypa1-billing.com
9:14 AM
We've charged your account $649.99 for a Norton 360 subscription renewal. If you did not authorize this, cancel within 24 hours to avoid the charge: paypa1-secure.com/cancel
Cancel this payment
The Email, as received

Other versions you might get: A fake “you sent a payment” receipt, a money-request from a stranger, or an invoice for crypto or gift cards. The goal is always to get you to call a number or click a link in a panic.

What to do right now

  1. Don't click the link or button, and don't call any number in it.
  2. Check your real account — open the PayPal app or type paypal.com yourself. The “charge” won't be there.
  3. Report it. Forward the email to phishing@paypal.com, then file at reportfraud.ftc.gov.
  4. Delete it, and mark it as phishing so future ones get filtered.

How to make sure it never bites you

Phishing lands because your address is on breached lists. Reduce the blast radius — see how to lock down your accounts.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

Does PayPal send invoices or charge alerts from paypa1-billing.com?
No. PayPal only emails from @paypal.com, and real activity always shows when you log in at paypal.com or in the app. A sender like paypa1-billing.com swaps the letter “l” for the number “1” — a classic look-alike. Treat any surprise invoice or charge email as phishing until you check your real account.
There's a $649.99 charge in the email — is it real?
Almost certainly not. Don't use any link or “cancel” button in the email — open the PayPal app or type paypal.com yourself, and the charge won't be there. Fake invoices for Norton, crypto, or gift cards exist only to make you click or call a number in a panic.
I clicked the link and entered my PayPal login — what now?
Change your PayPal password immediately at paypal.com, turn on two-factor authentication, and review your linked cards and recent activity. Call your bank if you entered card details. Then forward the original email to phishing@paypal.com and report it at reportfraud.ftc.gov.
How can I tell a real PayPal email from a fake one?
Check the full sender address, not the display name — real ones end in @paypal.com exactly. Genuine PayPal emails greet you by your full name and never threaten you with a deadline. When in doubt, ignore the email and log in at paypal.com to check.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.