Back to PayPal Invoice Refund Scam

This is a version of PayPal Invoice Refund Scam.

PayPal Fake Invoice via 'Booking Confirmation' with attached PDF

An email pretends to confirm a “booking,” but the attachment is a fake PayPal invoice claiming you bought a Springfield Armory firearm. This mix of messages is meant to confuse and worry you so you open the PDF and react quickly. Scammers often want you to call a number in the invoice or reply, so they can pressure you into paying or sharing personal details. Red flags include a random Gmail sender, long fake “confirmation” numbers, a strange tech-looking string, and an address that has nothing to do with you.

PayPal Fake Invoice via 'Booking Confirmation' with attached PDF | Primary Image

What’s different in this version

These traits set this message apart from the usual pattern.

  1. Uses a fake “booking confirmation” to distract from the true aim- the attached PayPal-style invoice.

  2. Sender is a random Gmail address using a fake recipients name as the display name.

  3. Subject and body include long, meaningless ID numbers to look official.

  4. Lists a physical address unrelated to the recipient to make the message seem legitimate.

  5. Arrives as a PDF attachment instead of a normal PayPal in-account notification.

How this scam works

  1. 1

    You receive a fake invoice email 'from PayPal' for a product you never bought, featuring a prominent support number.

  2. 2

    When you call, the scammer claims they can fix it but needs remote access to your computer 'for verification'.

  3. 3

    They ask you to log into your bank, then black out your screen and use developer tools to fake a large refund.

  4. 4

    They pressure you to 'return' the overpayment via gift cards, crypto, or wire. The refund never happened.

✓ Do this

  • Close the email and log in to PayPal directly (don’t use links in the message).
  • Verify invoices inside your PayPal account only.
  • Report the email to abuse@paypal.com.

✗ Avoid this

  • Don’t call numbers in unsolicited emails.
  • Don’t install remote-access tools for strangers.
  • Don’t send money, gift cards, or crypto to 'return' funds.

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    Subject: Confirmation of Your Request 04318788697815
  2. 2 Excerpt 2
    From: "Janice Petrozzi" <julyscarce124@gmail.com>
  3. 3 Excerpt 3
    Dear Janice Petrozzi, Your booking has been successfully confirmed. Booking ID: 74064811347415 Date: 22 Sep 25 Location: 502 E Main St, Douglasville, GA, 30134 We look forward to serving you. CK2DFWMW9RU4.1280PH103FAF3@ec2amaz-jmggeia
  4. 4 Excerpt 4
    Attachment: A PDF that looks like a PayPal invoice, claiming purchase of a Springfield Armory gun.

Screenshots & Examples