The email says something like "Your account was charged $499.98" or "Your subscription is renewing tomorrow." It names a company you might actually use and gives you a phone number to call if the charge is a mistake. That number is the trap. Before you call, before you pay, and before you open the attachment, here is what you need to know about the fake invoice email scam.
Why this scam works so well
This scam runs on panic. A charge you never made feels like an emergency, so your first instinct is to act fast. The email is built to move you before you think. It might list a large dollar amount, a subscription you forgot about, or a well-known brand like your antivirus or cloud storage provider. The urgency is the tell — real billing departments do not demand that you call within hours.
The second reason it works is that the callback number is the whole game. When you dial it, a "support agent" confirms the charge was a mistake. Then the script takes over: they ask you to install remote access software so they can "fix" it, or they ask for a cancellation fee paid by gift card or wire transfer. You are no longer dealing with a billing question. You are dealing with a thief who wants access to your computer and your money.
Red flags to look for
Fake invoice emails reuse the same warning signs over and over. Check every suspicious message for these:
- An unexpected attachment. Real invoices from companies you use appear in your account, not as surprise PDFs in your inbox.
- A sender address that differs from the real company. The display name may say Adobe or Norton, but hover over it and the actual address is something like
[email protected]. That mismatch is the giveaway. - Urgency to call a toll-free number. Legitimate companies give you a support number on their website, not a panic-inducing callback request in an email.
- A request for remote access to your computer. No billing department ever needs this.
- A request to pay by gift card, wire, or cryptocurrency. These payment methods are near-universally used by scammers because they cannot be reversed.
- Typos, odd wording, or a generic greeting like "Dear customer."
Watch for fake payment emails that imitate well-known services too. The pattern is the same, just with a different logo.
How to verify before you call or pay
When an invoice email makes your stomach drop, do not act on it. Do this instead:
- Open a new browser tab and log in to the real company's billing portal. Never click a link from the email; go to the website yourself.
- Check your actual transaction history. If there is no charge in your real account, there is no problem to fix.
- Examine the sender address carefully, not just the display name.
- If you still want help, call the company's official number from its website.
- Delete the email. If the charge is real, it will already be visible in your account.
Never call the number in the email. Never open the attachment. Invoice PDFs are one of the most common ways to deliver malware, and that one click can give a stranger control of your device.
If you have already engaged with the scam, stop and report it rather than trying to fight the scammers yourself.
What to do if you already called or paid
Making the call does not mean the scam has won. Stop engaging immediately. If you gave them remote access, disconnect from the internet and run a security scan. Change your passwords from a trusted device, and enable two-factor authentication on your accounts.
If you paid by credit card or bank transfer, call your bank or card issuer right away and tell them it was a scam — they may be able to reverse the charge if you act quickly. If you paid with gift cards, keep the cards and the receipts and report them to the gift card issuer and the retailer, since some can recover funds when you move fast. Learn the broader patterns so you can spot and avoid online scams in the future.
How to report
Reporting takes a few minutes and helps protect the next person. Do all of these that apply:
- Report the scam to the FTC at ReportFraud.ftc.gov.
- If you lost money, file a report with the FBI Internet Crime Complaint Center at ic3.gov.
- Contact your bank or card issuer about any unauthorized transactions.
- Forward the email to your email provider as phishing so it can be filtered for others.
- If the email impersonates a real company, let that company know through its official channels.
To reduce how many of these reach you in the first place, tools like Scam Guard can screen suspicious messages before they land in your inbox.
Quick answers
Is it safe to call the number in an invoice email? No. That number usually belongs to the scammer, not to the company. Call the number on the company's official website instead.
What if I already opened the attachment? Close the file, disconnect from the internet, and run a full security scan.
Can I get my money back if I paid? It depends on how you paid. Contact your bank or card issuer immediately. Gift card payments are much harder to recover, so report them fast and keep the receipts.
Where do I report a fake invoice email scam? Report it to the FTC at ReportFraud.ftc.gov, and if you lost money, file a complaint with the FBI IC3 at ic3.gov.
Sources and further reading
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.