The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the PayPal email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake PayPal email bills you for something you never bought and gives a number to call.
PayPal’s page on invoice and money request scams describes a bill for a product or service you never ordered, and a request with an alarmist note that urges you to call a fake customer service number. PayPal also says phishing emails are often alarmist, warning you to update your account immediately. The email below is invented, and each number is one of the signs.
Example
Hello customer,
You have an unpaid invoice for $489.00. The note on it says your payment was flagged.
Call our billing line on 1-800-555-0142 to cancel the charge before it posts.
Unpaid invoices are passed to collections after 12 hours.
The button says paypal.com/invoice
The sender's address is not at paypal.com.
The name says PayPal, but the part after the @ belongs to someone else. The next section shows how to read it.
A bill for something you never bought.
PayPal says that if an invoice or money request is for something you never ordered, you should not pay it.
A phone number to call.
PayPal says not to call any phone numbers in an invoice note, or in a suspicious email.
A deadline and a threat.
PayPal says phishing emails are often alarmist, warning you to update your account immediately.
A button that says paypal.com and goes somewhere else.
PayPal says legitimate PayPal pages always begin with https://www.paypal.com. Google says that if a link's address does not match its description, it might lead to a phishing site.
From PayPal Help: Avoid Invoice and Money Request Scams, read 7 November 2026.
From PayPal Help: Spot Fake PayPal Emails & Websites, read 7 November 2026.
From Gmail Help: Avoid & report phishing emails, read 7 November 2026.
Read the address from the right, because the last two parts say who owns it.
Anyone can put “PayPal” in front of an address. The part to read is the domain, the web name after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. PayPal says legitimate PayPal pages always begin with https://www.paypal.com, and the owner of that address is paypal.com. PayPal also says to be wary of slight misspellings or extra characters in the address.
Read the domain from the right
www.paypal.com
From PayPalOwned by paypal.com. PayPal says its legitimate pages always begin with https://www.paypal.com.
paypal.com.billing-review.example
Not from PayPalOwned by billing-review.example. paypal.com is only a label in front of it.
paypal-billing-alerts.example
Not from PayPalOwned by paypal-billing-alerts.example. The name has PayPal in it, but the owner is someone else.
From PayPal: What is Phishing or Spoofing?, read 7 November 2026.
PayPal says its real emails use your full name, carry no attachments and never ask for a password.
PayPal describes what its own emails look like, and a fake one usually breaks at least one of these. If you are unsure, PayPal says to log in to your account and check your notifications and transaction history rather than trust the message.
| Question | What PayPal says | What a fake PayPal email does |
|---|---|---|
| Does it use your full name? | What PayPal saysPayPal says its emails will always address you by your full name rather than generic greetings like “Dear Customer.” | What a fake PayPal email doesIt opens with “Hello customer,” or no name at all. |
| Does it carry an attachment? | What PayPal saysPayPal says its emails will never contain attachments or ask you to download files. | What a fake PayPal email doesIt attaches an invoice or asks you to open a file. |
| Does it ask for a password or bank details? | What PayPal saysPayPal says it will never ask for personal details like passwords, Social Security numbers, or bank account information via email. | What a fake PayPal email doesIt sends you to a page that asks for a password, a card number or bank details. |
| Does your account show it? | What PayPal saysPayPal says to verify every payment notification by logging in to your account and locating the corresponding transaction, and that it posts a secure message in your account when it needs to reach you. | What a fake PayPal email doesNothing in your PayPal activity or notifications matches the email. |
From PayPal: What is Phishing or Spoofing?, read 7 November 2026.
From PayPal Help: Spot Fake PayPal Emails & Websites, read 7 November 2026.
A real PayPal invoice can still be a scam, so the three kinds on PayPal's page are worth knowing.
Not every PayPal scam is a fake email. PayPal’s page on invoice and money request scams lists three kinds. The first two arrive through PayPal itself, so the message can look real because it is sent from a real account.
| Kind | What it looks like | What PayPal says to do |
|---|---|---|
| A bill for something you never bought | What it looks likeAn invoice or money request through PayPal for a product or service you never ordered. | What PayPal says to doDon't pay it. Sign in to PayPal on the website or app and report it. |
| An urgent note with a number | What it looks likeAn alarmist note in the invoice that urges you to call a fake customer service number. | What PayPal says to doDon't pay it, and don't call any phone numbers in the invoice note or open suspicious URLs. |
| A fake PayPal email | What it looks likeA bogus invoice or request by email, designed to look like a real PayPal email. | What PayPal says to doNever click any links or call any phone numbers in it. Forward it to phishing@paypal.com, then delete it. |
PayPal adds one more rule: never send money to a cryptocurrency wallet mentioned in an invoice or money request. To check any of them, PayPal says to log in to your account on the PayPal website or app and see whether any action is needed.
From PayPal Help: Avoid Invoice and Money Request Scams, read 7 November 2026.
Five steps tell you whether a PayPal email is real without clicking anything.
- Leave the button and every link alone, and do not call the number. PayPal says not to click any links, open any attachments, or respond in any way.
- Read the address from the right, as in the picture above. If the last two parts are not
paypal.com, do not rely on the email and check your account instead. - Open PayPal yourself: type
paypal.cominto your browser or open the app, and look for the transaction or the secure message. PayPal says to verify every payment notification this way. - Paste the email into the checker at the top of this page for a second read.
- Forward the email to
phishing@paypal.com, then delete it. PayPal says not to change the subject line or send it as an attachment. In Gmail you can also choose More next to Reply, then Report phishing.
From PayPal: How to Report Suspicious Emails & Messages, read 7 November 2026.
From PayPal: What is Phishing or Spoofing?, read 7 November 2026.
From PayPal Help: Avoid Invoice and Money Request Scams, read 7 November 2026.
If you clicked, called or paid, the FTC lists the steps that match what you did.
PayPal says to check by logging in to your account directly, not through the email. The FTC’s page for people who were scammed covers the rest. For a payment sent through a payment app such as PayPal, it says to report it to the app immediately and ask for a reversal. For a password you gave away, it says to create a new strong password and change it anywhere you reused it.
What to do depends on what you did
You only read it.
Forward it to phishing@paypal.com and delete it.
You clicked the link or opened an attachment.
Check your account by signing in to PayPal yourself. If something may have downloaded, update your computer's security software, run a scan and remove what it finds.
You called the number, paid, or entered a password or card details.
Follow the FTC’s steps for what to do if you were scammed, and the steps at IdentityTheft.gov for what you shared.
From FTC Consumer Advice: What To Do if You Were Scammed, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
The same checks work on other bills, renewals and order emails.
A bill with a number to call is a pattern, not one company’s scam. The guide to fake Geek Squad invoice emails covers a renewal charge with a deadline, and the guide to fake Amazon order emails covers an order you never placed. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
Can a PayPal invoice or money request be a scam?
Yes. PayPal's page on invoice and money request scams describes a billing request for something you never bought, and says not to pay it. It also describes a request whose note urges you to call a support number, and says not to pay suspicious requests, not to phone the numbers in them and never to send money to a cryptocurrency wallet named in one.
What does PayPal say it will never ask for in an email?
PayPal says it will never ask for personal details like passwords, Social Security numbers, or bank account information via email. It also says its emails will never contain attachments or ask you to download files, and that legitimate PayPal pages will always begin with https://www.paypal.com.
How can I check a PayPal payment notification?
PayPal says to verify every payment notification by logging in to your account and locating the corresponding transaction, and that if it needs to reach you about an issue, it will post a secure message within your PayPal account. It also says its emails will always address you by your full name rather than a generic greeting like "Dear Customer."
Where do I report a fake PayPal email?
PayPal says to forward the email to phishing@paypal.com without changing the subject line or sending it as an attachment, then delete it from your inbox. For an unwanted invoice or money request, PayPal says to sign in and report it from inside your account. In Gmail you can also open the message, choose More next to Reply, then Report phishing.
What should I do if I already clicked the link or called the number?
PayPal says not to click any links, open any attachments, or respond in any way, and to log in to your account on the PayPal website or app to check whether any action is needed. If something may have downloaded, the FTC says to update your computer's security software, run a scan and remove what it finds. For details you shared, IdentityTheft.gov lists the steps that match what you lost.
Does the checker know whether I owe PayPal anything?
No. It reads only the text you paste, so it cannot see your PayPal account. Your own PayPal activity is where a payment is confirmed. The checker is the second read on the email's sender, links, wording and ask.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- PayPal Help: Avoid Invoice and Money Request Scams
- PayPal: What is Phishing or Spoofing?
- PayPal Help: Spot Fake PayPal Emails & Websites
- PayPal: How to Report Suspicious Emails & Messages
- FTC Consumer Advice: What To Do if You Were Scammed
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails