PayPal "Hacker" Invoices for Bitcoin

If you have a PayPal account, you may have opened your email recently and felt your stomach drop. The subject line reads something like “Invoice from [Name]” or “Payment Request – Action Required.” The amount is often a shocking sum—hundreds or even thousands of dollars for a fake Norton antivirus subscription, a bogus cryptocurrency wallet upgrade, or a supposed Bitcoin mining contract you never signed. Alongside the invoice, a menacing message threatens that if you don’t call a certain phone number immediately, your account will be debited, or worse, your computer will be hacked and your personal files held for ransom.

This is not a legitimate business transaction. It is a growing form of online extortion known as the PayPal “hacker” invoice scam. The scammer has not actually gained access to your PayPal account. Instead, they are exploiting PayPal’s own legitimate feature that allows any user to send an invoice or money request to any email address. They type in your email, create a fake invoice for a service or product, and include a threatening note in the description field. They are banking on the fact that the shock of seeing a large “owed” amount, combined with the intimidation about hacking or Bitcoin demands, will make you panic and call the number they provide. Once you call, a fake “tech support” or “billing representative” will instruct you to install remote access software like AnyDesk or TeamViewer so they can “fix” the problem. In reality, this gives them direct control over your computer. They will then pretend to refund money, but instead steal banking information, empty accounts, or install ransomware demanding Bitcoin payment.

For middle-class Americans aged 45 to 64, this scam is particularly dangerous. Many in this age group grew up trusting official-looking emails and still use PayPal for online purchases or small business transactions. The threat of having a credit card compromised or a computer locked with ransomware feels real and urgent. But the mechanics are purely psychological. The scammer has zero technical access to your device or your PayPal password. They have simply sent a fake invoice. PayPal itself warns users that these invoices come from strangers, not the company. If you look closely at the email, the sender address is often a odd string of letters and numbers, not an official PayPal domain like @paypal.com. The invoice itself will show a “Seller” name that is suspicious, often something like “Bitcoin Security,” “Digital Shield,” or a random person’s name with no reputable brand connection.

The scammers do not want you to log into your PayPal account to check the invoice directly because you would see it has no real authorization. They want you to call the phone number they provide in the invoice note, where they can bypass PayPal’s own dispute system and deal with you one-on-one. That phone number is often a burner line or a spoofed number that appears local to your area code. When you call, the person on the other end will have a script. They will confirm the fake amount, express urgency, and then guide you through steps that end with you either providing your PayPal password, your bank routing number, or installing that remote access software.

What should you do if you receive one of these invoices? First, do not call any number listed in the invoice description. Do not reply to the email. Do not click any links within the email, even if they look like PayPal links. Instead, go directly to your PayPal account by typing the URL into your browser or using the official PayPal app. Log in and check your Activity or Invoices page. If you see an invoice from a stranger, you will see a button that says “Report” or “Flag as Fraudulent.” Use it. You can also open the invoice and click the option to “Cancel” or “Decline” it. This does not charge you anything—it simply refuses the request. PayPal will then often block that sender from sending you further invoices. If the invoice has already been paid, which is rare but possible if someone acted in panic, you need to immediately contact PayPal’s customer service through the official website—not through any number from the invoice—and file a dispute for an unauthorized transaction.

This scam has been running since at least 2020 and has evolved to include fake Bitcoin invoices claiming you purchased cryptocurrency mining packages or wallet upgrades. The goal is always the same: scare you into making a phone call so extortion can begin. Some versions even claim that failure to pay the invoice will result in a hacker remotely deleting your files or posting embarrassing information online. This is pure bluff. The scammers have no such power unless you give it to them by calling and following their instructions. Once you understand that the invoice itself is meaningless—like a piece of junk mail demanding money with a threatening note—the fear evaporates. You simply delete the email and report the sender through PayPal’s official tools.

Protect yourself by enabling two-factor authentication on your PayPal account so that even if a scammer somehow obtained your password later, they cannot log in. Also, be cautious about clicking any “Pay Now” button in an email that you did not personally initiate. Legitimate PayPal invoices from real companies will contain a clear description of goods you actually ordered, with a company name you recognize, and will never include threats of hacking or demands to call a random phone number. If you ever feel pressured or frightened by an email, slow down. Do the opposite of what the email demands. Go directly to your account, verify the facts, and report the fraud. You will almost always find that nothing is actually wrong—just a criminal trying to make you believe otherwise.