I recently came across a PayPal invoice that looked alarming at first glance: $800 for Ethereum (ETH) supposedly sent to Coinbase Corporation. According to the invoice, the payment had already been initiated and would supposedly be automatically deducted from the recipient’s account within 12 hours. If you didn’t recognise the transaction, there was supposedly only one thing to do… call the PayPal customer-care number printed directly on the invoice.
That is where this gets interesting. The invoice looks convincing enough to make someone panic, particularly if they don’t regularly use cryptocurrency and suddenly see an $800 payment attached to their PayPal account. But this isn’t a legitimate warning about an Ethereum purchase. It is a callback phishing scam, where the supposed unauthorized transaction is used as bait to get you on the phone with the scammer.
And PayPal itself warns users about this exact type of scheme: scammers can send invoices or payment requests for products, services or cryptocurrency that the recipient never ordered, then include an alarming message telling them to call a fake customer-service number.
What Is the PayPal $800 Ethereum Invoice Scam?
The scam arrives in the form of a PayPal-branded invoice claiming that you have ordered one unit of Ethereum for $800. The invoice shown in this scam says:
“THANKS FOR ORDERING ETHEREUM (ETH).”
It then claims:
“You have sent a payment of $800.00 USD to COINBASE CORPORATION.”
That alone would be enough to make most people stop what they’re doing. But the message doesn’t stop there. It claims that the invoice will be automatically paid from your account within 12 hours under PayPal’s supposed “auto-deduction policy.”
If you don’t recognise the purchase, you’re told to contact customer care at +1 (213) 283-6991. The same number is repeated at the bottom beside the instruction to contact PayPal for a “Dispute / Claim.” The problem is that the phone number is part of the scam.
The $800 Charge Is the Bait
This scam works because the supposed transaction creates an immediate problem that you feel you need to solve. You didn’t buy Ethereum. You certainly didn’t intend to send $800 to Coinbase. And now you’re being told that the money is going to be automatically deducted in less than 12 hours.
That creates exactly the kind of urgency scammers want. Instead of calmly opening PayPal yourself and checking your account, you’re encouraged to react to the information in the message and call the number provided.
PayPal specifically warns that scammers use invoices and money requests to create this situation. According to PayPal, a fraudulent invoice may contain an alarmist note telling the recipient to call a fake customer-service number, with the goal of obtaining personal or financial information over the phone. citeturn0search0
So the $800 isn’t necessarily the thing the scammer wants from you. The phone call is.
Why Does the Invoice Look So Convincing?
The scammer has clearly understood one important thing: people trust documents more than random messages. Instead of sending something that simply says, “Your PayPal account has been hacked,” the scam uses the appearance of an invoice.
There is a PayPal logo at the top, a large INVOICE heading, a description of the supposed purchase, a quantity, a unit price, a total amount, an amount due and even a copyright notice at the bottom.
It looks like paperwork. And paperwork feels official. The invoice also uses cryptocurrency as the supposed purchase, which makes the situation even easier to believe. Cryptocurrency transactions can be unfamiliar and confusing to many people, so a recipient may not immediately know whether an unfamiliar Ethereum transaction could somehow have been initiated through their PayPal account.
That uncertainty works in the scammer’s favor.
Then There’s the 12-Hour Deadline
One of the most important details in the invoice is the claim that the payment will automatically be deducted within 12 hours. This is not there because the scammer is particularly concerned about payment-processing timelines. It’s there because you are less likely to investigate carefully when you think you have a deadline.
If the message simply said, “You have an $800 invoice,” you might ignore it. But “You have an $800 invoice and it will automatically come out of your account within 12 hours” creates a completely different reaction.
Suddenly, you feel as though you need to call somebody immediately.
PayPal warns that urgency is a common tactic used by fraudsters to push people into calling a number, sharing personal information or installing software.
And that brings us to the most suspicious part of this invoice.
Why Is There a Phone Number on the Invoice?
If PayPal has supposedly detected an unauthorized $800 transaction, why does the invoice need to give you a random customer service number? Because the scammer wants to control where you go for help.
The invoice doesn’t simply tell you to open PayPal and check your account. It doesn’t tell you to use the official PayPal Help Center. Instead, it gives you a number and tells you to call it.
That is an enormous red flag. PayPal explicitly tells users not to call phone numbers contained in suspicious invoices or money requests. Instead, users should log into PayPal independently and check whether the invoice or transaction actually exists.
PayPal also warns that customer service impersonators may ask for passwords, two-factor authentication codes, personal information, payments or remote access to your device. Those requests are not legitimate ways for PayPal customer service to assist you.
What Happens If You Call +1 (213) 283-6991?
This is where the scam can escalate. The person who answers can simply pretend to be a PayPal representative investigating the supposed Ethereum transaction. They already know why you’re calling because they created the reason for the call.
They might tell you that your PayPal account has been compromised and that they need to verify your identity. They could ask for information such as your email address, account details, card information or other personal data.
They may then try to obtain a verification code sent to your phone or email. In more aggressive versions of callback scams, the supposed representative may tell you that they need to “secure” your computer, process a refund or help you remove the transaction, and then instruct you to install remote-access software or perform actions that give them greater access to your device.
At that point, the fake $800 transaction has served its purpose. The scammer now has a live conversation with someone who is already convinced that there is a serious problem with their PayPal account.
And No, You Don’t Need to “Cancel” the $800 Through That Number
This is an important distinction. If the email says you’ve been charged $800, don’t assume the charge is real just because the invoice says it is.
Open PayPal yourself. Don’t click a link in the email. Don’t use the phone number in the invoice. Don’t reply to the message. Instead, open the PayPal app or manually enter PayPal’s website address yourself and check your Activity.
PayPal specifically recommends independently logging into your account to verify whether any action is actually required. If the supposed $800 Ethereum purchase isn’t there, you have your answer.
There is nothing to cancel.
What If the Invoice Actually Appears in Your PayPal Account?
This is where people can understandably get confused. PayPal explains that scammers can sometimes abuse legitimate invoice and money-request features, meaning a fraudulent request may actually appear through PayPal rather than simply being a completely fabricated email.
That doesn’t make the transaction legitimate. If someone sends you an invoice for cryptocurrency you never ordered, you still shouldn’t pay it or call the number included in its notes. PayPal specifically lists unwanted invoices for products, services or crypto as a type of invoice scam.
In other words, “It appeared in PayPal” does not automatically mean “I owe this person money.”
The Invoice Has Some Telling Details
There are several things about this particular invoice that should make you suspicious even before you know about PayPal’s warnings.
For starters, it says:
“You have sent a payment of $800.00 USD…”
but then says:
“This invoice will be automatically paid from your account within 12hours…”
Those two ideas don’t sit particularly comfortably together. If you have already “sent a payment,” why is the invoice still showing an amount due and threatening a future automatic deduction?
The invoice also repeatedly directs the recipient toward the same telephone number rather than toward independently verifiable PayPal support.
Then there is the footer, which displays:
“Copyright ? 1999-2023 PayPal Inc. All Rights Reserved.”
The strange copyright symbol and outdated-looking year don’t exactly inspire confidence either.
None of these details, by themselves, is what makes the scam dangerous. The biggest issue is the overall setup: an unexpected cryptocurrency invoice + a large amount + an artificial deadline + a phone number controlled by whoever sent the message.
That combination is precisely what PayPal warns users to watch for.
What Are the Scammers Really Trying to Get?
The answer depends on how the conversation goes.
They may want your PayPal login information, card details or other financial information. They may try to obtain a one-time security code that can help them access an account. They may attempt to convince you to send money yourself, perhaps under the guise of processing a refund or securing your account. They could also try to get remote access to your computer.
PayPal warns that legitimate customer service will not ask you to provide sensitive information such as passwords or authentication codes, and that customer service impersonation scams may use these requests to take control of accounts.
So even if the scammer starts with an innocent-sounding question like, “Can you confirm the email address on your PayPal account?”, the conversation can quickly become much more serious.
What If You Never Called the Number?
If you simply received the invoice and haven’t interacted with the scammer, you’re in the easiest position. Don’t pay it. Don’t call the number. Don’t reply. Don’t click suspicious links or download anything attached to the message.
Instead, check your PayPal account independently. If the invoice is actually present in your PayPal Activity, PayPal allows users to decline or report suspicious invoices and money requests from their account.
If the message itself is a phishing email, PayPal says you can forward it to [email protected] and then delete it.
What If You Already Called?
If you called the number but didn’t provide any information, simply end the interaction and block the number. If you gave the caller your PayPal password, change it immediately through PayPal using the official app or website. If you reused that password elsewhere, change those accounts too.
If you provided card or banking information, contact the financial institution using the number on the back of your card or another independently verified contact method.
If you provided a two-factor authentication code, treat the account as potentially compromised and secure it immediately.
And if the caller convinced you to install remote-access software, that’s a bigger problem. Disconnect the affected device from the internet and take steps to secure your accounts from a separate, trusted device.
PayPal recommends reporting suspected unauthorised activity promptly and reviewing your accounts for changes or transactions you don’t recognise.
How to Spot This Scam Before It Gets You
The easiest way to remember this scam is to ignore the story and look at the behaviour. An unexpected PayPal invoice for cryptocurrency should immediately make you cautious. An $800 charge that you supposedly authorised is even more suspicious. Add a 12-hour deadline and a telephone number you’re instructed to call, and there is very little reason to treat the message as legitimate.
The safest response is remarkably boring: Don’t call. Don’t pay. Check PayPal yourself.
PayPal’s own advice is essentially the same: don’t pay unfamiliar invoices, don’t call numbers included in suspicious invoice notes, and verify activity by logging into your PayPal account independently. citeturn0search0turn0search4
Conclusion
The PayPal $800 Ethereum invoice scam is a clever example of how scammers can manufacture a financial emergency without necessarily making an unauthorized charge in the first place.
The invoice tells you that you’ve ordered Ethereum. It says $800 has supposedly been sent to Coinbase. It warns that the payment will be automatically deducted within 12 hours. Then, conveniently, it gives you a phone number to call if you want to dispute the transaction.
Everything about the message is designed to make that phone call feel like the obvious solution. It isn’t. The safest thing you can do is open PayPal independently and check your account. If the transaction isn’t there, don’t call the number printed on the invoice to ask where the transaction went. The number is the scam.
And even if the invoice really does appear inside PayPal, don’t assume that means you owe the money. PayPal itself warns that scammers can use legitimate invoice and payment-request features to send fraudulent requests, including requests involving cryptocurrency.
So, that scary $800 Ethereum purchase? You don’t need to cancel it. You need to ignore it.
Also read my similar review on the IRS Document Available Scam