Unexpected invoice? Start before you call, click, or pay.
Fake invoice scams use receipts, renewal notices, PayPal requests, antivirus charges, subscription emails, and callback numbers to make you act fast. The risk depends on whether you only received it, clicked a link, called the number, shared information, installed software, or paid.
By ScamClarity Editorial Team
Reviewed by ScamClarity Safety Review
Published May 21, 2026 ยท Updated May 21, 2026
A fake invoice scam usually tries to make you believe you were charged for something, renewed a subscription, or now owe money. The invoice may look like a PayPal request, a receipt, an antivirus renewal, a Geek Squad or Microsoft charge, an Apple or Amazon order, or a vendor bill for a business.
The safest first move is to pause before using anything inside the invoice. Do not call the phone number in the message, do not click a cancellation link, and do not pay just to make the charge stop. Open the real account, app, card statement, or company website yourself and check whether anything actually happened.
The risk depends on what changed. Receiving the invoice is usually different from calling the number, sharing card or bank details, installing remote-access software, entering a password, or paying.
Start with what happened
Use the closest match. If more than one applies, start with the situation involving payment, passwords, bank details, remote access, or a business account.
I only received the invoice or receipt
Lower risk
A fake invoice by itself is usually an attempt to make you call, click, or pay. It does not prove that money left your account.
Check your real bank, card, PayPal, Apple, Microsoft, Amazon, Norton, McAfee, or Best Buy account by opening the app or typing the site address yourself.
Look for an actual transaction in the real account, not just an amount printed in the email.
Save the email before deleting or reporting it.
Do not: Do not call the number, click the cancellation link, reply to the email, or pay the invoice to make it go away.
I got a PayPal invoice or money request
Check closely
A PayPal invoice or request can be real as a PayPal message and still be unwanted or abusive. The invoice does not prove that you bought anything.
Log in to PayPal through the real website or app. Review Activity there. If the invoice or request is unfamiliar, do not pay it and use PayPal's reporting or decline options.
Ignore phone numbers written inside invoice notes or seller messages.
Forward suspicious PayPal-looking emails or sites to PayPal if they came outside the app.
Do not: Do not send money, crypto, or a refund because the invoice note says there is an urgent account issue.
I clicked a link but entered nothing
Check closely
A link click is a reason to stop and check, but the bigger risk usually comes from entering information, downloading a file, approving a login, or paying.
Close the page. Do not continue through forms. If a file downloaded, do not open it. If you entered login, card, or bank details, treat that as shared information.
Review browser downloads and recent sign-in alerts.
If the page asked for a password or payment details, assume the form was the point of the scam.
Do not: Do not return to the invoice link to see if it was real. Use the real company site or app separately.
I opened or downloaded an attachment
Check closely
Many fake invoices use PDFs or Office files to look routine. Opening a PDF is different from enabling macros, running a file, or typing information into a document.
Do not reopen the attachment. Check whether anything downloaded or ran. If an Office file asked you to enable content, do not enable it.
Run trusted security software if a file ran or the device began acting differently.
Save the attachment name and sender details for reporting.
Do not: Do not edit a document, enable active content, or send the file back with your information.
I called the number
Check closely
The call is usually where the scam shifts from a fake bill to fake support, fake cancellation, or a fake refund.
Hang up if you are still on the call. Write down what you shared, what they asked you to install, and whether you opened bank, card, PayPal, email, or password pages while talking.
Think through whether you shared a password, one-time code, card number, bank detail, SSN, address, or date of birth.
If they asked for Quick Assist, AnyDesk, TeamViewer, UltraViewer, ScreenConnect, LogMeIn, or another remote tool, treat it as remote-access risk.
Do not: Do not call back because they promised to cancel, reverse, refund, or finish a security check.
I shared card, bank, login, account, or code information
Act quickly
The risk is tied to the information shared. A card number, bank login, account password, or one-time code can require quick provider-specific action.
Contact the card issuer, bank, payment provider, or account provider using the official app, website, statement number, or number on the back of the card.
Change any password you typed into a fake page, and change reused passwords on other accounts.
Do not: Do not share another verification code with someone who says it is needed to cancel or refund the invoice.
I installed remote-access software
Urgent
Remote access changes the situation because the person may have seen your screen, controlled the device, opened files, or watched you sign in.
Disconnect the session, remove the remote-access tool, and use a different trusted device for important password and payment-account changes.
List what was open on screen: bank, card, email, PayPal, password manager, tax files, work systems, cloud storage, or private documents.
Contact work or school IT if a managed device or managed account was involved.
Do not: Do not reconnect for a refund, cancellation, cleanup, or account verification.
I paid the invoice or sent money for a refund
Urgent
Money movement is time-sensitive. The payment provider controls dispute, reversal, chargeback, replacement, or transaction-review options.
Contact the bank, card issuer, PayPal, payment app, wire company, gift card issuer, or crypto platform through official support. Save the invoice and payment receipt first.
Ask what can be blocked, disputed, reversed, replaced, or monitored.
Watch for follow-up refund or recovery messages after you report the payment.
Do not: Do not send more money because someone says a refund, cancellation, or overpayment correction requires it.
My business received a vendor invoice
Check closely
Fake business invoices often rely on routine payment habits. They may claim to be for supplies, ads, domains, software, support, subscriptions, or a vendor your company recognizes.
Pause payment and verify the invoice through your internal purchase process and a known vendor contact already on file.
Compare sender address, invoice history, purchase order, bank details, payment instructions, and the person who approved the purchase.
Be extra careful with changed bank details or urgent payment instructions.
Do not: Do not pay from email pressure alone, even if the invoice looks familiar or says past due.
Why fake invoices work
A fake invoice creates confusion around money. It makes you wonder whether a charge already happened, whether a subscription renewed, whether a business bill is overdue, or whether you need to act before a deadline. That confusion is the opening.
Many fake invoice messages avoid a traditional phishing link and push a phone number instead. Once you call, the person can steer the conversation toward remote access, card details, bank screens, gift cards, crypto, or a fake refund.
Common invoice pressure points
What you see
What it is trying to make you do
Safer check
Large unexpected charge
React quickly before checking your real account
Open the real bank, card, PayPal, or company account yourself
Call to cancel within 24 hours
Move you from email into a controlled phone call
Use a known company contact or the official website
PayPal invoice or money request
Make a request look like a completed purchase
Check PayPal Activity in the real app or website
PDF or invoice attachment
Make the message look routine or hide the phone number
Do not open unexpected files again; save the file name for reporting
Refund or overpayment story
Get you to share bank access or send money back
Do not send money to receive a refund
Vendor or past-due invoice
Exploit normal business payment routines
Verify purchase order, vendor contact, and payment details internally
The same invoice can use more than one pressure point.
PayPal invoices and money requests need a separate check
PayPal invoice scams are confusing because the message may involve PayPal's real invoice or money request system. That means the email or account notification can look more convincing than a simple spoofed email. It still does not mean you ordered the item, owe the money, or need to call the number written in the invoice note.
If you receive a PayPal invoice or payment request for something you did not order, open PayPal yourself through the real app or by typing paypal.com. Check Activity there. If the request is unfamiliar, do not pay it. Use PayPal's built-in decline, cancel, or report options when available, and forward suspicious PayPal-looking emails or websites to PayPal's phishing address.
Do not call a phone number in the invoice note, seller note, memo, or PDF.
Do not pay the invoice just to see what happens.
Do not send money to a crypto wallet mentioned in an invoice or request.
Do not issue a refund unless you can verify a real payment came into your account and the real platform process says a refund is needed.
If PayPal shows no completed payment or charge, treat the invoice as an unwanted request, not proof that money left.
Antivirus, tech support, and subscription renewal invoices
Fake Norton, McAfee, Geek Squad, Microsoft, antivirus, and computer-support invoices often say you were charged hundreds of dollars for an annual renewal. The message may say to call quickly if you want to cancel, dispute, or receive a refund. This overlaps with fake tech support scams because the next step may be a call where the person asks for remote access or payment details.
If you think the renewal might be real, check the real account or the card statement. Use the company's official website or app, not the invoice number. If there is no matching transaction, the message was likely designed to make you call.
A fake renewal may use familiar names like Norton, McAfee, Geek Squad, Microsoft, Apple, Amazon, or a generic antivirus brand.
The amount is often high enough to create panic but ordinary enough to look like a software subscription.
The caller may say a refund requires you to open your bank account or install Quick Assist, AnyDesk, TeamViewer, UltraViewer, ScreenConnect, LogMeIn, or a similar tool.
A refund that requires you to buy gift cards, send crypto, wire money, use a payment app, or move money between accounts is not a real refund process.
If you called the number
End the call first. You do not need to keep talking to be polite, to finish cancellation, or to prove the charge is fake. Once the call is over, write down what happened while it is still fresh.
What number you called and what company name they used.
Whether you shared your name, address, phone number, email, date of birth, card number, bank details, password, one-time code, SSN, or ID information.
Whether you installed software, allowed remote access, opened a bank page, opened email, opened a password manager, or showed files.
Whether they asked you to buy gift cards, send crypto, wire money, use a payment app, or transfer money for a refund.
Whether they threatened you, told you not to talk to anyone, or called back from other numbers.
If you shared nothing sensitive and did not install anything, the main risk may be follow-up contact. If you shared information, opened financial accounts, or gave remote access, treat those as separate problems and act on them directly.
If you clicked, downloaded, or opened an attachment
Close the page or file. Do not continue through forms, do not reopen the attachment, and do not use a link from the invoice to sign in. If the invoice mainly involved an email link, fake login page, or suspicious attachment, the broader phishing page may also help.
A click alone is not the same as giving away a password or payment details. The important questions are whether you entered information, approved a login, downloaded and ran a file, enabled content in an Office file, installed an app, or gave permissions.
If you entered a password, change it from the real site or app, preferably on a trusted device.
If you entered card or bank details, contact the card issuer or bank using a known number.
If an attachment ran, run trusted security software and review recent downloads and installed apps.
If you gave a one-time code, review the account that code belonged to because it may have approved a login, reset, or payment.
If you paid or shared information
Contact the provider connected to the money or exposed account. A bank, card issuer, PayPal, payment app, wire company, gift card issuer, or crypto platform is the party that can tell you what can be blocked, disputed, reversed, replaced, or documented.
Credit or debit card: call the number on the back of the card or use the official app. Ask about dispute options, card replacement, recurring charges, and account monitoring.
Bank details or online banking access: contact the bank, review recent and pending activity, and ask what account protections are appropriate.
PayPal or payment app: use the official app or website, report the invoice or transaction, and save transaction IDs.
Gift cards: keep the cards and receipts, contact the gift card issuer quickly, and do not send card photos or PINs to anyone else.
Wire, crypto, or money transfer: contact the platform or transfer company quickly, save wallet addresses or transfer IDs, and watch for recovery offers.
Login information: change the password and review recovery email, recovery phone, sessions, connected apps, and security alerts.
If personal details, card data, bank information, identity documents, or account access were shared, see what to do when a scammer has your information for a more detailed information-exposure checklist.
If remote access was involved or the device/account now seems different, see the phone and account access page for account, browser, app, and device checks.
If a business received a vendor invoice
A fake business invoice can be simple, like a bill for supplies, ads, domains, search listings, software, tech support, or a subscription nobody ordered. It can also be more targeted, like a known vendor invoice with changed payment instructions.
Small businesses are vulnerable because paying bills is routine. The safer move is to slow the process down enough to verify the invoice outside the email thread.
Match the invoice to a purchase order, contract, shipment, service record, or internal approval.
Verify the sender domain, invoice history, dollar amount, account number, and payment instructions.
Use a vendor contact already in your system, not the phone number or email in the new invoice.
Be cautious with urgent past-due notices, new bank details, changed routing numbers, or pressure from someone claiming to be an executive.
If a payment was sent to new instructions, contact the financial institution immediately and consider filing with IC3.
What not to do now
Avoid these fake invoice traps
These actions are the points where a fake invoice usually becomes a money, account, device, or identity problem.
Do not call the number in the invoice
Use a known phone number, official app, real website, statement, or account page instead.
Do not click invoice links to cancel
Open the real account yourself and check there.
Do not pay to stop a charge until you verify it
An invoice, request, or receipt is not the same as a completed charge.
Do not install remote-access software
Remote access can let the caller view or control the device.
Do not send gift cards, crypto, wire transfers, or payment-app transfers for a refund
A real refund should not require sending more money first.
Do not share one-time codes or passwords
Codes can approve logins, resets, account changes, and payments.
Do not delete everything before saving evidence
Keep enough to report, dispute, and explain what happened.
What to save
Save enough evidence to explain the invoice
Keep private details out of public posts, but save the facts that a provider, platform, employer, or agency may ask for.
The full email or message
Include sender address, display name, date, subject line, headers if available, and screenshots.
Invoice details
Invoice number, order number, brand or company name used, amount, due date, attachment name, and any memo text.
Phone and call details
Phone number listed, number you called, callback numbers, caller names, call date and time, and what they asked you to do.
Links and files
URLs, downloaded file names, attachment names, and whether anything ran or asked for permissions.
Payment proof
Receipts, transaction IDs, gift card numbers and receipts, wire details, wallet addresses, PayPal activity, and bank or card case numbers.
Remote-access details
Tool name, session ID if visible, what was open on screen, and any new apps, extensions, or account alerts.
Do not post full card numbers, SSNs, passwords, private account screenshots, gift card PINs, or ID images in public forums.
Where to report or act
ScamClarity is not an official reporting destination and cannot cancel invoices, recover money, or verify accounts. Use the official destination that matches what happened.
Company or platform being impersonated: report through the real app, real account, official website, or official abuse channel.
PayPal invoice or request: log in to PayPal through the real website or app and report or decline the suspicious invoice or request there.
Bank, card issuer, or payment provider: contact them quickly if money moved, card or bank details were shared, or a charge appears.
FTC ReportFraud: report consumer fake invoice, phishing, tech support, business impersonation, and refund scams.
FBI IC3: report internet-enabled fraud, especially business invoice fraud, business email compromise, wire transfers, crypto, remote access, or significant losses.
Work, business, or finance team: escalate internally if the invoice involved a company mailbox, vendor, employee account, purchase order, payment instructions, or managed device.
Local law enforcement or emergency services: use this for threats, immediate danger, local pickup demands, or someone trying to collect cash, cards, gold, or devices in person.
Official sources used
These sources support the article's action steps, reporting options, PayPal nuance, brand-specific checks, payment guidance, and small-business invoice advice.
Best Buy and Geek Squad impersonation warnings, trusted contact advice, personal-information warnings, and brand reporting.
FAQ
What should I do if I got an invoice for something I did not buy?
Do not call, click, reply, or pay from the invoice. Check the real account, card statement, or company site separately. If there is no matching transaction, save and report the message, then delete it.
Is a PayPal invoice always real?
No. A PayPal invoice or money request can be sent through PayPal and still be unwanted or abusive. Check PayPal Activity in the real app or website. Do not call phone numbers written in invoice notes and do not pay unfamiliar requests.
Should I call the phone number on the invoice?
No. The phone number is often the point of the scam. Use a known number, official app, statement, or official website if you need to contact the company.
What if I already called the fake invoice number?
End contact and write down what happened. If you only talked and shared nothing sensitive, watch for follow-up pressure. If you shared information, opened financial accounts, installed software, or paid, act on those specific risks.
What if I installed remote-access software?
Disconnect the session, remove the tool, and use a trusted device for important password and payment-account changes. Review what was open on screen and contact your bank, card issuer, employer, or school if financial or managed systems were involved.
What if I paid the fake invoice?
Contact the payment provider quickly through official support. Save the invoice, receipt, transaction IDs, phone numbers, and messages. Ask what can be blocked, disputed, reversed, replaced, or monitored. Do not pay anyone promising guaranteed recovery.
What if the invoice is for Norton, McAfee, Geek Squad, Microsoft, Apple, Amazon, or antivirus software?
Check the real account or card statement first. Fake renewal invoices often use familiar brands and a high dollar amount to make you call. If you need support, use the official site or app, not the invoice phone number.
How do I report a fake invoice scam?
Report it to the company or platform being impersonated, the payment provider if money or payment details were involved, FTC ReportFraud for consumer fraud, and IC3 for internet-enabled fraud or business invoice losses.
Is a fake invoice the same as phishing?
Often, but not always. Some fake invoices are phishing messages meant to steal login, card, bank, or business data. Others are callback scams that push you to call a fake support number. Some are payment requests meant to make you pay directly.