Overview
The victim receives a bill or renewal notice for an item they did not order, and wants to have the mistakenly-sent invoice or charge deleted or reversed.
How It Works
The scammer sends a fake invoice for a product or service, and includes a link or phone number or other contact method for the recipient to pay or dispute the charge.
Option 1: Victim pays the bogus charge. In this case, the scam may play out more like a standard phishing attempt (see 2.2.3 Spoofed Or Phishing Interaction Scam).
Subscription renewal scams and other small-dollar scams take this route.
In the telephone version of the scam, the scammer calls the victim and claims that an amount is owed for a service (insurance coverage, for example) that is about to lapse. The victim agrees to pay the amount, and the scammer extracts a fraudulent payment from the victim.
In the digital version of the scam, the scammer sends the victim a link to a renewal page, where the victim will either be charged for the bogus renewal or the scammer can steal the data inputted by the victim.
Option 2: Victim disputes the bogus charge. In this option, the scam plays out similar to a 2.2.1 Virus/Malware Tech Support Scam.
Sometimes the scammer only wants the victim to choose this route, so they will send an invoice for a very large amount, and a prominently displayed phone number for disputing the charge. The combination of a high dollar amount and a 24-hour helpline is more likely to prompt the victim to call to dispute the charge.
When the scammer and victim talk, the scammer claims that the payment already went through from their side, but with the victim's help they will be able to stop payment or reverse the charges.
As part of the ruse, the scammer convinces the victim to give the scammer remote access to the victim's computer through AnyDesk or similar software, at which point they exfiltrate cryptocurrency or banking data, or launch an overpayment scheme requiring payment in gift cards, cryptocurrency, and so on.
Related Articles
New PayPal Scam Sends Verified Invoices With Fake Support Numbers, Hackread, 2026-01-15
The Fraudulent Invoice Scam, Kent State University
The phone call that almost scammed me - Mumbai Mirror, version of the phone scam
Synthetic Examples
2.2.2 Sample Data 1 - count: 300. With fake URLs and random, fake phone numbers. No attachments.
2.2.2 Sample Data 2 - count: 363. With fake URLs and random, fake phone numbers. No attachments.
2.2.2 Sample Data 3 - count: 363. Same as Sample Data 2 but with [phone] and [url] placeholders. No attachments.
Related Scams
2.2.1 Virus/Malware Tech Support Scam - Both scams sometimes play out with a phone call to "tech support"
Related Crime Schemes
A particular instance of this scam may embed one or more of these related schemes.
Data Loss or Theft: Any scheme that results in victim losing data/scammer stealing data. Data in this context can mean login credentials, credit card details, or other personal or corporate information.
Extortion: Extortion refers to any scheme that uses a threat of additional damage to extract payment from the victim.
Overpayment scheme: In an overpayment scheme, victims are told they have been given a large amount of money as part of the scam and are asked to refund a smaller amount back to the scammer. In reality, the initial overpayment does not exist.
Victim Targeting Context
The scammer may use one or more of the following techniques to reach the victim.
Spray and Pray / Scattered: The scammer approaches many victims at once such as through bulk email or SMS.
Social Engineering: Psychological Manipulations
The scammer may use one or more of these psychological techniques to accomplish the scam.
Abuse of authority position: The scammer employs an abuse of a position of authority to convince the victim to go along with the scam.
Codes or Jargon: The scammer uses official-looking codes or technical jargon as part of the scam to increase appearance of legitimacy or to confuse the victim.
Complexity: The scammer has a complicated story to explain the scam, or leverages scientific/economic complexity in order to confuse the victim.
Threats/Fear/Extortion/Blackmail: The scammer employs threats to increase fear in the victim so that they will go along with the scam. Threats can include financial loss, legal action, arrest, account closure, extortion, blackmail.
Urgency: The scammer employs urgency to increase the likelihood that the victim will take action.
Social Engineering: Impersonation Techniques
The scammer may impersonate one or more of the following groups as part of the scam.
Business or NonProfit: The scammer impersonates a business or nonprofit.
Technical Support / Tech: The scammer impersonates a technical support worker or tech company.