Scammers are increasingly using authentic PayPal invoicing features to dupe victims into false debts and steer them toward dangerous phone calls, prompting security experts to advise vigilance and cautious verification.
A PayPal message asking for payment on behalf of Kathleen Ryan may look routine at first glance, especially if it arrives through an address that appears to belong to the company. But the danger is not the email itself so much as the content inside it: a money request, an invented debt and a phone number that steers the recipient away from official channels and into a scammer’s script. PayPal says invoice and money-request frauds exploit its own legitimate tools, which can make the notification seem trustworthy even when the claim is not.
The confusion often begins with the name attached to the request. In this case, Kathleen Ryan is part of the deception, not proof of anything owed. PayPal’s guidance warns that fraudsters can add alarming notes to requests and invoices, including claims that a payment is overdue or that urgent action is needed. The company says recipients should not pay an unexpected request and should avoid calling any number listed in it, because that number may belong to the fraudster rather than support staff.
That call is usually where the real theft starts. According to PayPal’s own scam advice and security pages, criminals may pressure victims to share one-time codes, install remote-access software or move money to a so-called safe account. Security researchers and consumer warning sites have described the same pattern across PayPal-style invoice scams: a fake support agent confirms the fake emergency, then tries to take control of the victim’s accounts or device. Legitimate customer service does not require gift cards, cryptocurrency, secrecy from the bank or remote control of a computer to cancel a request.
The safest response is to ignore the phone number in the email and open PayPal separately, either through the official app or by typing the address yourself. Check the Activity, invoices and money-request sections to see whether the request exists there and what its status is. A request may be real as a platform message but still fraudulent as a debt claim, which is why the note should be treated as an unverified assertion from the sender, not as evidence that money is owed. PayPal advises users to report suspicious messages through its own channels and to forward questionable emails to phishing@paypal.com.
Anyone who has already called the number or shared information should act quickly. End any remote session, change passwords from a clean device, review account recovery settings and contact PayPal, the bank and any card issuer using numbers from official sources only. The broader lesson is simple: a genuine payment platform can still carry a fraudulent request, and the real test is whether the transaction and every response stay inside verified accounts rather than a stranger’s instructions.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
