Scammers Are Using Small Business Names to Send Fake PayPal Bills

Scammers are sending fake PayPal invoices using real small business names. Victims are tricked into calling fake support numbers, while businesses suffer reputational damage. Learn how these scams work, how to spot them in under a minute, and what to do if your business is targeted.
  • Why criminals are using small business names in fake PayPal invoices
  • How the scam tricks both victims and business owners
  • Easy steps to check if an invoice is real or fake
  • What to do if you’ve already fallen for it
  • How business owners can protect their reputation
  • Simple prevention tips for small teams

Cybercriminals have found a new trick: sending fake PayPal invoices that use the names of real small businesses.

In one case, a local furniture shop’s name appeared on hundreds of invoices demanding about $1,000 each. The shop owner hadn’t sent any bills at all, yet her phone and email were flooded with complaints from people across the country asking why they owed money.

The invoices looked convincing, but instead of PayPal’s normal payment button, they listed a phone number to “fix the problem.” That number went straight to the scammers, not PayPal.

This kind of fraud not only confuses victims but also damages the reputation of the small businesses whose names are misused.

How the Scam Works

For the person who gets the invoice

  • You receive an email that looks like a PayPal bill.
  • The note says things like “Call now to cancel” or “Your account has a problem.”
  • If you call, the scammer pretends to be PayPal support and pressures you into giving payment details, installing software, or sending money.

The invoice itself might look real, but the instructions are fake. PayPal never asks you to call a random phone number.

For the small business being used

  • Sometimes criminals just copy your business name or logo to make their fake invoices look real.
  • Other times, they hack into an old PayPal or email account with weak security and send invoices directly from it.

Either way, customers and strangers start blaming your business—even though you had nothing to do with it.

Quick Way to Check an Invoice

Spend 60 seconds to confirm:

  • Do not call numbers or click links in the email.
  • Open a new browser tab and log in at paypal.com.
  • Go to Activity → Invoices.
  • If the invoice is there and looks fake, decline it and report it.
  • If it’s not there, it’s a spoof—delete and report it.

If You Already Fell for It

  • Change your PayPal and email passwords right away. Turn on two-step verification.
  • Contact your bank if you gave out card or bank information.
  • Remove any software you installed for the scammer and run a full security check.
  • Keep all evidence and report it to PayPal, your bank, and a scam tracker like the BBB Scam Tracker.

If Scammers Are Using Your Business Name

  • Let people know quickly. Post a clear warning on your website and social media.
  • Close or secure old PayPal accounts and make sure every login has a strong, unique password and two-step verification.
  • Share details with PayPal and, if needed, law enforcement.
  • Use tools to monitor your business name, website, and email addresses online so you catch impersonation attempts early.

Everyday Prevention for Teams

  • Treat “call now to avoid charges” as an instant red flag.
  • Train staff who check invoices to follow the 60-second rule above.
  • Keep invoice review and payment approval separate.
  • Use security software that blocks phishing and suspicious links before anyone clicks.

Sources:

More Posts

Inside Fantasy Hub: the Android RAT-for-rent that turns phones into full surveillance devices

Fantasy Hub is a new Android RAT sold as malware-as-a-service. It intercepts SMS, steals photos, streams camera/mic, and displays fake bank overlays — read how it spreads and what IT teams must do to detect and contain it.

Small Business Tips: Why Business Continuity Planning Isn’t Optional

Many small and mid-sized businesses think disaster recovery is something only large corporations need. But in today’s world, a single cyberattack, system failure, or natural disaster can bring operations to a stop. Business Continuity Planning (BCP) is no longer optional. It is a necessity to keep your business running when the unexpected happens.

Discord Users’ Data Compromised in Third-Party Customer Support Breach

Discord has confirmed a third-party breach that exposed sensitive data from users who contacted its support team. Hackers, claiming to be Scattered Lapsus$ Hunters, accessed customer details and limited billing information. The case highlights growing cybersecurity risks associated with third-party service providers and emphasizes the importance of vendor security reviews.

10 Ways to Prevent Ransomware in Your Office

Ransomware attacks can bring small and medium businesses to a complete stop. Here are 10 practical steps your office can take today to lower the risk and protect critical data.

The Real Cost of a Data Breach for Small Businesses

Small businesses often underestimate the devastating financial and reputational impact of a data breach. This blog reveals the true costs—both direct and hidden—supported by real-world examples and clear solutions for SMBs.

Why You Should Never Reuse Passwords — And What to Do Instead

Reusing passwords across multiple sites is one of the biggest cybersecurity mistakes you can make. Here’s why it’s risky—and what smart alternatives you should start using today.

GravityZone Endpoint Detection and Response (EDR)

LEARN MORE

GravityZone Business Security Enterprise

LEARN MORE

Bitdefender Small Business Security

Price range: $93.99 through $286.99

LEARN MORE

GravityZone Business Security

LEARN MORE

Discover more from Avadeja Cybersecurity

Subscribe now to keep reading and get access to the full archive.

Continue reading