{"id":102616,"date":"2024-12-18T00:55:41","date_gmt":"2024-12-18T08:55:41","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=102616"},"modified":"2025-02-27T13:03:48","modified_gmt":"2025-02-27T21:03:48","slug":"money-request-and-invoice-scams-via-paypal-venmo-and-docusign","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/money-request-and-invoice-scams-via-paypal-venmo-and-docusign\/","title":{"rendered":"Money request and invoice scams via PayPal, Venmo, and Docusign"},"content":{"rendered":"

\"\"<\/p>\n

Throughout the past couple of years, we’ve continued to see more and more scams that leverage fake invoices. Scammers often send them via legitimate services, such as Intuit QuickBooks or PayPal, to bypass e-mail spam filters.<\/p>\n

The latest round of scams uses “money requests,” invoices, or fake receipts sent either directly via PayPal, or via PayPal-owned Venmo. In some cases, scammers send these scams via Docusign, while pretending to be from PayPal.<\/p>\n

Here’s how you can recognize, avoid, and report these scams.<\/p>\n

Fake “You’ve got a money request” from PayPal<\/h3>\n

First, let’s take a look at what a fake invoice or money request sent via PayPal looks like.<\/p>\n

\"\"

A fake invoice that was actually sent through PayPal. Note that the supposed \u201cFraud Alert\u201d phone number was added by the scammer.<\/p><\/div>\n

If you get a money request or invoice via PayPal, the From address will be service@paypal.com and the subject will be “You’ve got a money request.” But that doesn’t mean that the invoice or money request is legitimate; scammers often leverage real services like PayPal to send scams.<\/p>\n

First of all, if you don’t have any business relationship with the person or organization who allegedly sent the invoice, that should be your first red flag. Second, the amount is sometimes (but not always) scarily high; the main point of this is to cause the recipient to panic and act rashly.<\/p>\n

And third, pay close attention to the “Note from seller” field. In the example above the note from the seller says “Fraud Alert: Didn’t make this order? Call at 1-863-[redacted].” The phone number belongs to the scammer who sent the message\u2014NOT to PayPal.<\/p>\n

Fake “Person’s Name requests $xxx.xx” from Venmo<\/h3>\n

Next, let’s take a look at a variation on this scam, sent via PayPal subsidiary Venmo:<\/p>\n

\"\"<\/p>\n

 <\/p>\n

In this case, the subject line follows the template “[Woman’s Name] requests [$xxx.xx]” requesting hundreds of dollars. The scammer may provide different justifications for this expense, such as one of the following:<\/p>\n

Subscription Confirmed: Your service is active with a monthly fee, debited from Venmo. For questions or to cancel, contact Venmo Customer Service at +1 (808) 808_[redacted] (Toll Free). This email confirms the charge.<\/p>\n

You paid $249.99 USD for Crypto Currency using Venmo. This amount will be auto deducted every month. If this is not authorized by you, Call Venmo Customer Service to cancel at 1 (808) 509_[redacted]. (Toll Free). Do not reply , Replying to this mail will confirm the order.<\/p><\/blockquote>\n

Like with the PayPal variation of the scam, neither of these phone numbers will actually go to Venmo customer support. Rather, the scammer operates these phone numbers.<\/p>\n

Fake “[Someone] sent you a document to review and sign” from Docusign<\/h3>\n

A third variation of this scam uses Docusign, but may still claim in the body of the e-mail to be related to PayPal.<\/p>\n

\"\"<\/p>\n

Scam messages sent via Docusign will have more variety in the subject line; they may say things like “We have completed your [$xx.xxx] payment successfully” or “Receipt of Your Firearm Purchase via PayPal.” The body may be similar to one of the following examples, or may say something else entirely:<\/p>\n

We are delighted to inform you that your Bitcoin purchase through PayPal has been completed successfully. A DocuSign document will be sent to you soon for your signature, confirming that the Bitcoin has been received. Please ensure the Bitcoin is credited to your account before proceeding with the signature. Your PayPal transaction has been processed.<\/p>\n

We are here to inform you that Consumer Financial Protection Bureau (CFPB) has found suspicious transaction from your PayPal account and has raised ticket on specific transaction processed by your PayPal for purchasing the firearm and misleading the agencies. In result , we are going to issue a summon against you and would like you to connect with PayPal support desk immediately.<\/p><\/blockquote>\n

Again, the body of the message will contain a phone number. And\u2014you guessed it\u2014the phone number belongs to the scammer, not to PayPal (or Docusign, or any other legitimate company).<\/a><\/p>\n

How can I report these scammers?<\/h3>\n

For fraudulent invoices that appear to come from PayPal<\/strong>, you can forward them to phishing@paypal.com<\/a>.<\/p>\n

Similarly, for fraudulent invoices that appear to come from Venmo<\/strong>, you can forward them to phishing@venmo.com<\/a>.<\/p>\n

Fake invoices that appear to have been sent through Docusign<\/strong> should be forwarded to security@docusign.com<\/a>.<\/p>\n

And, as a reminder, for fake invoices that appear to have been sent through Intuit QuickBooks<\/strong>, you can forward them to security@intuit.com<\/a>.<\/p>\n

It’s also a good idea to forward scam and phishing e-mails<\/strong> to the U.S. Federal Trade Commission (FTC<\/strong>) at spam@uce.gov<\/a>. Additionally, you can CC the Anti-Phishing Working Group at reportphishing@antiphishing.org<\/a>. The APWG<\/strong> is a coalition of international law enforcement agencies and tech companies that work together to take down identity thieves and fraudsters.<\/p>\n

If you believe you’ve fallen victim<\/strong> to one of these scams, inform the FTC; go to ReportFraud.ftc.gov<\/a> and fill out the form. You may also find it helpful to review Intego’s video about how to report scams<\/a> before submitting your report.<\/a><\/p>\n