A Legitimate Invoice From PayPal — That's Also a Scam

In late 2024, security researchers at Avanan documented a campaign where threat actors sent real PayPal invoices to victims — not spoofed emails, not lookalike domains, but actual invoices generated through PayPal's own platform. The emails passed every spam filter, every DKIM check, and every SPF validation. Around the same time, attackers began weaponizing DocuSign the same way. The result is a new breed of PayPal DocuSign phishing attack that's alarmingly effective because it abuses the very platforms your organization already trusts.

I've spent years watching phishing evolve, and this tactic represents a genuine inflection point. Traditional email security tools are nearly blind to it. If your employees can't spot these attacks, your technical controls won't save you.

How PayPal DocuSign Phishing Actually Works

Here's what makes this attack different from the crude "Your account has been suspended" emails your spam filter catches every day. Attackers don't spoof PayPal or DocuSign. They use them.

The PayPal Invoice Attack

A threat actor creates a PayPal business account — sometimes with a stolen identity, sometimes with a throwaway. They generate a real invoice through PayPal's invoicing feature, typically for $399 to $699, referencing a "Geek Squad renewal," "Norton subscription," or "crypto purchase." PayPal's own servers send the email. The sender address is [email protected]. The links point to paypal.com. Everything is technically legitimate.

The invoice includes a phone number or a note urging the recipient to "call immediately to dispute this charge." When the victim calls, they reach a social engineering operator who walks them through installing remote access software or handing over credentials and banking details.

The DocuSign Weaponization

The DocuSign variant works similarly. Attackers create trial or paid DocuSign accounts and send signing requests through the real platform. The email comes from [email protected] — DocuSign's actual notification address. Inside the document, the victim finds a fake contract, invoice, or settlement agreement with embedded links to credential harvesting pages or malware downloads.

Because the email originates from DocuSign's infrastructure, it sails through Microsoft Defender, Proofpoint, and Mimecast without a second glance.

Why Traditional Email Filters Can't Stop This

Your secure email gateway makes decisions based on sender reputation, domain authentication, and known malicious indicators. When PayPal sends an email from PayPal's servers with valid DKIM signatures, your gateway treats it as legitimate — because technically, it is.

The 2024 Verizon Data Breach Investigations Report found that 68% of confirmed data breaches involved a human element, including social engineering and credential theft. PayPal DocuSign phishing is designed to exploit exactly this gap. The technology says "safe." The human has to say "wait."

I've reviewed incident response cases where six-figure wire transfers started with a single DocuSign notification that no security tool flagged. The attacker didn't need malware. They needed patience and a $10/month DocuSign account.

What Does a PayPal DocuSign Phishing Email Look Like?

This is the question I get most often, and it deserves a direct answer for anyone trying to train their team.

A PayPal DocuSign phishing email typically has these characteristics:

  • Legitimate sender address: [email protected] or [email protected] — not a lookalike domain.
  • Unexpected invoice or signing request: You didn't buy anything, and you're not expecting a contract.
  • Urgency language in the body or notes: "Call within 24 hours to cancel" or "Your account will be charged automatically."
  • A phone number instead of a link: Especially in PayPal invoice scams, attackers route victims to call centers to bypass automated link scanning.
  • Embedded links inside documents: In DocuSign attacks, the malicious payload sits inside the attached document, not in the email itself.
  • Generic recipient targeting: The email doesn't reference your name, account details, or transaction history in a way that matches reality.

If any of these elements are present, treat the message as hostile until you can verify it independently — by logging into your PayPal or DocuSign account directly, never through links or phone numbers in the message.

The $4.88M Lesson in Human-Layer Security

IBM's 2024 Cost of a Data Breach Report pegged the global average breach cost at $4.88 million. Phishing was the top initial attack vector. And these numbers don't capture the full blast radius — regulatory fines, customer churn, legal costs, and the operational paralysis that follows a serious breach.

When I talk to CISOs about PayPal DocuSign phishing, the conversation always lands in the same place: you can't buy a product that solves this. You need people who can recognize it. That means ongoing cybersecurity awareness training that covers real-world attack patterns, not just checkbox compliance modules from 2019.

Multi-factor authentication helps. Zero trust architecture helps. But neither stops an employee from calling a fake support number and reading their bank account details to a stranger.

Building Defenses That Actually Work

1. Run Realistic Phishing Simulations

Your phishing simulation program needs to include scenarios that mirror these attacks — legitimate-looking invoices, DocuSign requests for documents your team didn't expect, and callback-based social engineering. Generic "click the link" tests don't prepare anyone for an email that actually came from PayPal. Enroll your team in phishing awareness training built for organizations that covers these evolving tactics.

2. Establish Verification Protocols

Create a simple, non-negotiable rule: no one acts on an unexpected invoice or signing request without independent verification. "Independent" means logging into the platform directly or calling a known contact — never using any phone number or link from the suspicious message itself.

3. Implement Invoice and Payment Controls

Require dual authorization for any payment over a set threshold. This single control has stopped more social engineering attacks in organizations I've worked with than any email security product.

4. Report and Analyze Every Attempt

Make reporting easy and consequence-free. Forward suspicious PayPal emails to [email protected]. Report DocuSign abuse through their official abuse reporting page. File complaints with the FBI's Internet Crime Complaint Center (IC3). Every report helps platforms shut down attacker accounts faster.

5. Layer Technical Controls Where You Can

While filters can't block these emails outright, you can configure alerting rules. Flag all incoming PayPal invoices that don't match known vendor relationships. Quarantine DocuSign requests sent to distribution lists instead of named individuals. These heuristics won't catch everything, but they reduce the volume your humans have to sort through.

The Bigger Picture: Platform Abuse Is the New Phishing

PayPal DocuSign phishing is part of a broader trend that CISA has been warning about: threat actors abusing legitimate cloud services to deliver attacks. We've seen the same playbook with Google Forms, Microsoft SharePoint, and Dropbox. The principle is always the same — hide behind a trusted brand's infrastructure so security tools wave you through.

The CISA cyber threats advisory page tracks these evolving techniques, and it's worth bookmarking if you're responsible for security at any level.

This trend isn't going to reverse. As email security gets better at catching spoofed domains and malicious attachments, attackers will keep moving to platforms that are inherently trusted. Your defense strategy has to account for a world where the email is "real" but the intent is hostile.

Your Next Move

If you walked away from this article with one takeaway, make it this: the most dangerous phishing emails in 2026 don't look dangerous. They look like Tuesday. A PayPal invoice, a DocuSign contract, a routine notification from a platform your team uses every week.

Start with your people. Get them trained on the specific mechanics of platform-abused phishing — not just the theory, but the exact scenarios they'll encounter. Pair that training with robust verification procedures and layered technical controls, and you've built a defense that can actually withstand what's coming.

Because the attackers aren't getting lazier. They're getting smarter about using your trust against you.