PayPal Payment Alert Email – Fake or Real? Scam Investigation

An email announcing that a $398.99 subscription was paid through PayPal can create instant panic. It says the transaction came from an unknown seller or device and provides a customer-service number for disputing it.

The number does not lead to PayPal. It connects the recipient with a scammer who can request passwords, payment details, security codes, or remote access under the pretense of canceling the purchase.

Overview

The PayPal Payment Alert scam is an invoice and callback scheme. The message may look like a payment receipt, subscription confirmation, money request, or security warning. Its central instruction is to call a number if the transaction is unfamiliar.

One circulating template uses $398.99 and says a subscription was paid from an unknown seller IP. It may be delivered through an unrelated notification service or display wording such as “Pay_Pal” to avoid automated filters.

The merchant, amount, sender, and telephone number change. Some versions mention a Nikon camera, cryptocurrency, antivirus subscription, or electronics purchase. Searching a single number cannot reliably settle the question because operators rotate numbers continuously.

PayPal warns that scammers can send fake invoices and money requests containing alarmist notes and fraudulent customer-service numbers. The company advises users to forward suspicious emails to phishing@paypal.com.

A real-looking PayPal email can still contain user-supplied invoice text. Verify the transaction in the PayPal app or by typing PayPal’s address yourself. Do not use the phone number, link, or attachment that came with the claim.

What the fake alert may say

Subject: Payment Alert: Your $398.99 Subscription Has Been Paid

Your $398.99 subscription has been paid using your PayPal account from an unknown seller IP.

If you do not recognize this seller, contact account support immediately using the number below.

Note: Your PayPal account may have been used fraudulently.

The email may contain no link at all. That can make it seem safer than ordinary phishing. In reality, the telephone call is the malicious link because it transfers the victim into a controlled social-engineering conversation.

Common variations of the email

• “Your $398.99 Subscription Has Been Paid”
• “You Sent a Payment to an Unknown Seller”
• “PayPal Invoice for Antivirus Protection”
• “Nikon Camera Purchase Confirmed”
• “Bitcoin Order Paid Through PayPal”
• “Unauthorized Transaction From an Unknown IP”
• “Call Customer Service to Cancel This Payment”
• “Your Account Will Be Charged Within 24 Hours”
• “Money Request Includes a Fraud Warning”
• “Subscription Renewal Receipt Attached”
• “PayPal Account Limited After Suspicious Purchase”

Some messages are completely fabricated outside PayPal. Others abuse PayPal’s legitimate invoice or money-request feature so the notification can come through a real PayPal system. A genuine delivery path does not make the invoice note or telephone number trustworthy.

Warning signs in the message

• The phone number is the main action. PayPal account disputes should be opened from the app or official Resolution Center.
• The alert uses fear before facts. It emphasizes an unknown IP and account fraud but provides little verifiable transaction information.
• The greeting is generic. Fake messages may avoid the recipient’s full name or use an email address instead.
• The sender is unrelated. A display name can say PayPal while the underlying address belongs to a different platform or domain.
• The actual PayPal account shows no completed payment. Email text cannot move money by itself.
• The caller asks for a one-time code. Codes authorize access and should never be read to support staff.
• A refund requires remote access or payment. PayPal does not need control of a personal computer to reverse a valid transaction.

How The Operation Works

1. The attacker creates an alarming payment story

A charge near $400 is large enough to worry most recipients but plausible for electronics or a yearly subscription. The unknown-seller language suggests the account is actively compromised.

The attacker relies on the victim’s desire to stop the charge immediately. The message is not intended to withstand careful review.

2. The alert is distributed through email or an invoice feature

Ordinary phishing emails can spoof PayPal branding and come from unrelated servers. In another branch, the scammer creates a money request or invoice and places the fraudulent callback text in a note field.

The resulting notification may pass technical email checks because PayPal sent the notice, yet the person requesting money and writing the note remains untrusted.

3. The recipient calls the supplied number

A fake support agent answers as PayPal security, billing, fraud prevention, or the merchant dispute center. They ask the caller to read the invoice number, which is already known because the scammer created it.

The agent confirms that the account is at risk and offers to cancel the payment. This reassurance establishes authority before sensitive requests begin.

4. Account details and security codes are requested

The caller may be asked for an email address, password, card details, bank name, date of birth, or code sent by text. The operator can use those details to attempt a real account takeover.

A legitimate representative does not need the customer’s password or one-time login code. A code entered or read aloud can approve the scammer’s sign-in.

5. Remote software is presented as a cancellation tool

If direct credential theft is not enough, the agent sends the victim to AnyDesk, TeamViewer, Zoho Assist, or another remote-control service. The download is described as a secure refund form.

Once connected, the scammer can see notifications, documents, saved passwords, and financial accounts. They may black out the victim’s screen while performing actions.

6. The victim is moved from PayPal to online banking

The agent says a refund must be deposited or verified through the bank. They may ask the victim to sign in while remote access is active, allowing the operator to observe credentials and balances.

This step makes little sense for an ordinary PayPal dispute, which can be managed within PayPal and the funding institution through official channels.

7. A fake refund or overpayment is displayed

The scammer edits the visible banking page or transfers money between the victim’s own accounts. A balance appears to increase, and the agent claims too much was refunded.

The caller is pressured to return the difference with gift cards, cryptocurrency, wire transfer, cash, or a payment app. The victim sends real money in response to a visual illusion.

8. Account takeover can continue quietly

If the operator captured PayPal or email credentials, they may add devices, change recovery settings, send new invoices, or target contacts. Remote software may be configured for unattended access.

The initial fake $398.99 charge can therefore lead to much larger losses if the victim only checks for that specific amount.

How to verify a PayPal transaction

Open the official PayPal app or type paypal.com. Review Activity, notifications, automatic payments, invoices, and the Resolution Center. A transaction absent from the account should not be treated as completed because an email says it is.

If an unfamiliar invoice exists, do not call a number written in its note. Report or cancel it from within PayPal and contact official support through the app or website.

Two delivery paths, one callback operation

In the first path, the entire message is forged. The sender domain is unrelated, the logo is copied, and the payment never existed anywhere in PayPal. The operator needs only an email template and a working telephone line.

In the second path, a scammer uses a legitimate invoice or money-request feature. PayPal may send a real notification because someone genuinely requested money. The invoice note then tells the recipient to call a fake support number.

This distinction explains why checking only whether the notification passed email authentication is insufficient. PayPal can authenticate delivery of a request without endorsing the person who created it or the text that person entered.

In both paths, the recipient should open PayPal independently. A money request is not a completed payment, and an invoice is not proof that the recipient owes the sender.

Why the caller wants remote access

A password or card number can be stolen by a form, but remote control gives the operator a view into the victim’s entire digital life. The agent can see balances, saved documents, email notifications, contacts, and security prompts.

Remote access also lets the scammer control what the victim sees. Browser source can be temporarily edited so a fake refund appears, windows can be hidden, and transfers between the victim’s own accounts can be disguised as outside deposits.

No PayPal support process requires the customer to install an unrelated screen-sharing application and open online banking. Treat that request as an immediate signal to disconnect.

Why replying to the invoice is not useful

The scammer may control the invoice email or monitor responses. Replying can confirm the address is active and begin the same social-engineering conversation in writing.

Use PayPal’s built-in report and dispute options instead. If an email itself looks suspicious, forward it to PayPal’s official phishing address, then delete it after evidence is saved.

Secondary risks after an account takeover

An intruder may send money requests to contacts, change automatic payments, add an address, or use stored payment methods. Email access can help hide alerts and reset other accounts.

Reviewing one $398.99 line is therefore not enough. Check the full PayPal profile, email security, devices, linked cards and banks, recent activity, and any new authorizations.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

What To Do If You Called or Shared Details

1. Hang up and stop responding. Do not let the caller transfer you to another department or recovery agent.
2. Open PayPal independently. Change the password, review activity, remove unknown devices, and check automatic payments and recovery details.
3. Secure the email account. PayPal recovery depends on email. Change the email password, remove forwarding rules, and sign out unfamiliar sessions.
4. Contact PayPal through its official app or site. Report the invoice, money request, or account activity and ask for appropriate restrictions.
5. Contact the bank or card issuer. Report exposed card or banking details and any transfer made under false pretenses.
6. Remove remote-access software. Revoke unattended permissions, uninstall tools used by the caller, and disconnect the device if access appears active.
7. Change passwords entered or viewed during the session. Use a separate trusted device and prioritize financial, email, and password-manager accounts.
8. Run a full security scan. Check for new software, extensions, startup items, and changes made while the screen was controlled.
9. Preserve evidence. Save the email, invoice ID, phone number, remote-session code, transaction records, and gift card receipts.
10. Report the message. Forward suspicious email to phishing@paypal.com and report financial fraud to the appropriate authority.

If you only opened a genuine PayPal invoice notification, that does not mean the scammer accessed your account. Do not pay it or call its number. Review it in PayPal and report the request.

If a one-time code was disclosed, treat the account as compromised even if the caller says the cancellation failed. Codes expire, but they may already have authorized a login or settings change. Review PayPal and email recovery information immediately.

If money was sent by bank transfer, cryptocurrency, gift card, or payment app, contact that provider quickly and describe the callback scam. Recovery is not guaranteed, but delay reduces the chance that funds can be stopped or recipient accounts flagged.

Tell contacts to ignore unusual invoices or money requests if the attacker accessed email or PayPal. A warning from the real account owner can prevent the compromise from spreading through trusted relationships.

Continue checking statements for several billing cycles because stolen payment details may be tested later.

Review saved addresses and linked funding sources as well as the visible transaction list.

The Bottom Line

The PayPal $398.99 Payment Alert is built to make a telephone number look like an emergency exit. The number actually leads deeper into credential theft, remote access, and refund fraud.

Use the PayPal app, Activity page, and official Resolution Center to verify every claim. Never share a password or code with a caller, and never send money to correct an alleged refund error shown during a remote session.