PayPal has found itself at the center of a major scam alert, just days after announcing a partnership with OpenAI to bring payments directly into ChatGPT by 2026.
Cybercriminals are reportedly using fake invoices to trick PayPal users into sharing sensitive information. The attack was first flagged by security researchers at KnowBe4 and reported by Forbes.
According to experts, the attackers are using a method known as a TOAD (Telephone-Oriented Attack Delivery) scam.
The trick is simple but dangerous: users receive what looks like a legitimate PayPal email containing an invoice for something they never bought. The message usually includes a phone number to call if they want to “dispute” the charge.
It looks real. The email comes from a genuine PayPal address, but the invoice itself is fake.
“If you call the number, you won’t be speaking to PayPal,” KnowBe4’s analysts warned. “You’ll be talking to fraudsters who want your credit card details, PayPal login, or even a direct payment.”
How the scam works
The fake invoices often claim that “your account has been billed $823.00” or that payment will be processed in 24 hours, language meant to cause panic and urgency.
Victims are then encouraged to call a fake support number, where scammers try to extract personal information.
Some of these emails don’t even come from PayPal accounts. Pieter Arntz, a researcher at Malwarebytes, said he received one himself, sent from a random Gmail address to a large blind-copy list. “PayPal would never send an invoice like that,” he said.
Experts say a few warning signs can help users spot the scam:
- An invoice for something you didn’t order.
- A blank email body with only an invoice attachment.
- Requests to call a phone number or click a suspicious link.
Read Also: MTN partners with Microsoft to unveil EVA 3.0 in South Africa
PayPal responds
In response, PayPal issued a public warning this week, urging customers not to pay or respond to any unexpected invoices or payment requests.
“Do not pay. Do not call,” the company said in a statement.
PayPal added that it’s constantly improving its security systems to detect and block fraudulent accounts and transactions. “We do not tolerate fraudulent activity on our platform,” the company said. “Our teams work tirelessly to protect customers and encourage people to stay vigilant online.”
Users who receive a suspicious invoice or email are advised to report it by forwarding the message to phishing@paypal.com and then deleting it.
Staying safe
PayPal also shared a few simple tips to avoid falling for scams:
- Never pay for something you didn’t order.
- Don’t call any phone numbers or click on links in a suspicious email.
- Always access PayPal by typing paypal.com directly into your browser or using the official app.
- If you’re unsure, report and delete the message.
Scams like this are becoming more common as online payments grow. It’s a reminder that even the most trusted platforms can be used by fraudsters, and that staying cautious is often the best defense.
Leave a comment and follow us on social media for more tips:
- Facebook: Today Africa
- Instagram: Today Africa
- Twitter: Today Africa
- LinkedIn: Today Africa
- YouTube: Today Africa Studio
