Phishing Alert: PayPal Invoice Scam (subjects may vary)

Some U-M community members reported receiving this email. It is fraudulent or malicious. Do not respond, click any link in it, or provide personal information or money. See Phishing & Scams for more tips. If you need help, contact the ITS Service Center.

Date Sent: 
Wednesday, May 11, 2022

Phishing Scam Summary

Subject lines for this scam follow the form of Invoice from Name (#####) where the sender's name and invoice number will vary.

This scam begins with phishing email that contains a PayPal invoice for a fake purchase. The invoices for this scam may be generated in PayPal by the scammers, so while the purchase is fake, clicking on the links in the scam invoice may actually transfer payment via PayPal. The invoice claims that the recipient has successfully made a purchase through PayPal for $219. Note that in some cases the amount and supposed purchase could vary. This scam is being seen widely and has been reported by other institutions and in the media.

What to watch for:

  • Invoices for purchases you have not made.
  • Requests to act immediately to make payment or reverse payment.

What to do if you receive this:

  • If you receive an invoice you suspect to be fake or for a purchase you don't recall making, do not pay and do not respond using links or phone numbers in the email.
  • Go to your PayPal account (do not use links in the email!) and look at your purchase history to verify you haven't been fraudulently billed.
  • If you have been fraudulently billed go to PayPal’s Resolution Center at and report the fraud immediately.

Phishing Email Text

(Please note that some details such as links and phone numbers have been removed for safety.)

------------------------------------------------------------------------------------------------, here are your invoice details

Here's your invoice

Timothy Lee Cotterill sent you an invoice for $219.00 USD

Due on receipt
View and Pay Invoice

Buy now. Pay over time.

Simply select PayPal Credit at checkout and enjoy No Interest if paid in full in 6 months. Subject to credit approval. See terms. US customers only.

Note from Timothy Lee Cotterill

Thank you for your Successful Purchase using PayPal for Amazon Prime 1yr Subscription. You paid $219. 00 USD which will be shown in your account within the next 24-48hrs. If you haven't made this transaction and do not Authorize it. Call or Reach us immediately at +1-888-xxx-xxxx
Help & Contact | Security | Apps
Twitter    Instagram    Facebook    LinkedIn    

PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing

Please don't reply to this email. To get in touch with us, click Help & Contact.

Not sure why you received this email? Learn more

Copyright © 1999-2022 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

PayPal RT000XXX:en_US(en-US):1.1.0:f1XXXXXfaXXde

Phishing Email or Site Screenshot: 
Screen shot shows a fake invoice that uses PayPal branding and information. The information in the invoice is the same as in the email text above.