Bill Is Back—Twice: Apparently My Fake PayPal Account Had a Busy Morning
At this point, I think Bill needs an intervention.
If you've been following my continuing adventures with scam emails, you may remember Bill. Bill is the mysterious person who keeps appearing in these fake invoices and event invitations, supposedly using my PayPal account to buy things I never ordered.
Well, Bill is back.
And this time, he brought friends.
On October 1, I received two more suspicious event invitations. They arrived just one minute apart.
The first came from Ramadhan Riyanto at 9:52 a.m.
The second came from Anne Gomez at 9:53 a.m.
Apparently, scammers believe in efficiency.
First Invitation: $499.99
Ramadhan invited me to:
“Your Order confirmed: INV#445016. Amount:$499.99”
How thoughtful.
According to the invitation, Bill supposedly paid $499.99 for a subscription using my “Pay_Pal” account.
Yes, Pay_Pal.
Maybe PayPal's lesser-known cousin.
And, naturally, if I didn't recognize the purchase, there was a convenient telephone number for the “Resolution Center.”
Convenient for whom is another question.
The invitation even gave me the familiar choices:
Going. Maybe. Can't Go.
I'm going with Can't Go.
I have a scheduling conflict.
I'm busy not losing $499.99.
One Minute Later: Another Party!
Apparently, declining one imaginary purchase wasn't enough.
At 9:53 a.m.—just one minute later—Anne Gomez invited me to another event:
“Geek Squad Order confirmed: INV#445027. Amount:$399.99”
And guess who made the purchase?
BILL!
Bill allegedly spent another $399.99 using my imaginary Pay_Pal account.
So within one minute, Bill supposedly racked up $899.98 in fake charges.
Bill, buddy...
We need to talk about your spending habits.
The Similarities Are Almost Comical
Put these two messages side by side, and the pattern is hard to miss.
Different sender.
Different invoice number.
Different dollar amount.
Different supposed Resolution Center phone number.
But almost everything else follows the same formula.
Both arrived as event invitations.
Both claim Bill used my PayPal account.
Both mention an “unknown seller IP.”
Both provide a telephone number to dispute the transaction.
Both create a sense of urgency around a purchase I supposedly didn't make.
And both contain a warning right there in the email:
“This event invitation was not sent by Meta. Please be cautious when clicking on links or providing personal information.”
At this point, the warning may as well be flashing in neon.
Yesterday It Was Geek Squad. Today It's a Doubleheader.
What makes this even funnier is that these arrived right after another fake Geek Squad invitation I recently wrote about.
That one claimed Bill spent $399.99.
Now Bill supposedly spent another $499.99 and $399.99.
My fictional friend is having quite a shopping spree.
If this keeps up, I'll need to stage a fictional financial intervention.
Why Send Two So Close Together?
I obviously can't know who is behind these messages from the emails alone, and I can't say whether the two invitations were generated by the same person or operation.
But the nearly identical wording and timing are worth noticing.
That's part of why I keep documenting these messages.
One strange email might make someone stop and wonder whether there's really a problem with an account.
When several nearly identical versions appear, the formula becomes much easier to see.
The company name can change.
The amount can change.
The sender can change.
The telephone number can change.
But the basic objective appears to remain the same:
Get me worried enough to respond before I stop and think.
I'm Still Not Calling
If I received a legitimate-looking notice about a PayPal, Geek Squad, bank or credit-card transaction I didn't recognize, I wouldn't use the telephone number supplied in a suspicious email.
I'd go directly to the company's official app or website and check my account independently.
The email doesn't tell me how to verify it.
That's an important distinction.
And I'm definitely not calling a mystery “Resolution Center” because Bill supposedly went shopping again.
Going? Maybe? Can't Go?
I still love that these arrive as event invitations.
Imagine putting these on my calendar:
9:00 a.m. — Lose $399.99
10:00 p.m. — Lose another $499.99
Dress code: Business casual.
Refreshments: None.
Financial regret: Complimentary.
RSVP?
Can't Go.
Keep Sending Me Your Scam Stories
I'll keep documenting these because the more examples we see, the easier it becomes to recognize the patterns.
If you've received a suspicious invoice, fake purchase notification, Facebook event scam, PayPal impersonation, Geek Squad message, or another creative attempt to separate you from your money, send me your story and screenshots at:
Just remove or cover any sensitive personal or financial information before sending it.
As for Bill?
If anyone sees him, please tell him his Pay_Pal privileges have officially been revoked.
Another Scam Invitation: Apparently I’m Invited to Give Away $399.99
My inbox has once again extended a very generous invitation.
This time, Maulana Utomo has invited me to an event called:
“Geek Squad Order confirmed: INV#88452. Amount: $399.99”
How thoughtful.
Some people get invited to weddings.
Some people get invited to birthday parties.
Apparently, I get invited to give scammers money or personal information.
I really need a better social life.
Going, Maybe, or Can’t Go?
This is my favorite part of these fake Facebook event invitations.
According to the message, I supposedly have a $399.99 Geek Squad order.
Naturally, The Facebook gives me three options:
Going
Maybe
Can’t Go
Let me check my calendar...
Nope.
Unfortunately, I'm busy that evening, not giving strangers $399.99.
I'm going with Can’t Go.
Bill Is Back!
Then I read the description, and an old friend has apparently returned.
Bill.
The invitation says:
“Bill has paid $399.99 for a subscription using your Pay_Pal account from an unknown seller IP.”
Bill!
We've talked about this.
In one of my previous mystery-subscription emails, Bill supposedly spent $450 using my PayPal account.
Now he's back for another $399.99.
At this point, Bill has more subscriptions than I do.
Someone needs to take away his imaginary credit card.
Geek Squad, PayPal and Facebook Walk Into a Scam...
This one throws several recognizable names into the blender.
The event title references Geek Squad.
The description references PayPal—although creatively written as “Pay_Pal.”
The email itself comes from a Facebook event invitation.
And then there's a phone number supposedly belonging to a “Resolution Center.”
That's a lot of recognizable branding packed into one message.
But there's also something else sitting prominently near the top of the email:
“Warning: This event invitation was not sent by Meta. Please be cautious when clicking on links or providing personal information.”
That's probably the most useful sentence in the entire email.
What Exactly Am I Being Invited To?
That's what makes these messages funny to me.
The email literally says:
“Tell them if you can make it.”
Make it to what?
My $399.99 unauthorized transaction?
Is there going to be cake?
Should I bring a gift?
Do I need to RSVP?
Because from where I'm sitting, this looks like an invitation to worry about a fake charge, call the number provided, and potentially hand over money, account information, personal information—or some combination of the three.
That's one party I'm happy to miss.
The Urgency Is the Point
The $399.99 isn't there because someone necessarily charged me $399.99.
It's there to get my attention.
The recognizable company names get my attention.
The “unknown seller” creates concern.
The telephone number gives me an immediate action to take.
Put everything together, and the hope seems pretty obvious:
React first. Investigate later.
I'm doing the opposite.
If I ever receive a suspicious message claiming I've been charged by a company, I can check the account independently through the company's legitimate app or website rather than using the contact information in the suspicious message.
I don't need Bill's help.
Thanks for the Invitation
So, Maulana, thank you for thinking of me.
Unfortunately, I must respectfully decline your invitation to potentially hand over $399.99 and my personal information.
I already have plans.
I'm going to hit Delete.
And Bill?
Please stop shopping.
Have a Scam Story? Send It My Way
These messages keep coming, and I'll keep documenting them.
If you've received a strange scam email, fake invoice, suspicious Facebook invitation, mystery purchase, phishing text, or another creative attempt to get your money or information, send it to:
Send a screenshot and tell me what happened. Be sure to remove or cover any sensitive personal or financial information first.
Maybe your scammer can meet Bill.
They apparently have similar interests.
The PayPal Scam That Apparently Scheduled Its Own Reminder on My Phone
The scammers are getting ambitious.
Lately, I’ve been getting mystery order emails with almost no information. Apparently, somebody decided those weren't convincing enough.
This time, I received what looks like a much more complete invoice.
And then something happened that made this one especially interesting:
I also got a reminder on my phone telling me to pay it.
That will get my attention.
Apparently, I Have a $428.81 “PayPal Service” Membership
The subject line reads:
“Invoice Generated | $428.81 | Ref: I-SSVPYBLLKONG98”
Right away, the email gives me something the previous mystery emails didn't: a specific dollar amount.
$428.81.
The sender's display name says “PayPal Service.”
Sounds official.
Except the actual email address shown next to it is:
There's my first rather large red flag.
If someone is going to impersonate a major financial company, using a random Gmail account while displaying “PayPal Service” isn't exactly subtle.
Happy Anniversary to Me!
According to the email, I'm approaching my one-year anniversary with “PayPal Service.”
How thoughtful.
It thanks me for being a “valued member” and tells me about my upcoming membership renewal.
The supposed details include:
Renewal Date: September 29, 2026
Plan: Annual Membership
Member Name: niel.flamm
Amount: $428.81 USD
The message claims the membership will automatically renew using my saved payment method.
There's just one little problem:
What PayPal annual membership?
That question matters more to me than the email's professional appearance.
🚩 Then Comes the Phone Number
The message tells me that if I want to update my billing information, change my plan, or ask questions, I should call:
1 (816) 372-4805
And there it is.
The email creates the problem:
You're about to be charged $428.81!
Then it conveniently provides the solution:
Call us!
That's exactly when I don't call the number in the email.
If I were concerned about an actual PayPal transaction, I'd open PayPal independently—not use contact information supplied by the message that created the emergency.
But This One Had an Extra Trick
What really got my attention wasn't just the email.
I also got a reminder on my phone to pay it.
That makes the experience considerably more convincing.
Now I'm not simply looking at an unsolicited email.
My phone is also reminding me about the supposed payment.
For a moment, that can create an entirely different psychological reaction:
Wait. Did I actually schedule this?
Did I forget about something?
Did my phone pull this from somewhere legitimate?
That's precisely why I found this one worth documenting.
A reminder appearing on my phone doesn't independently authenticate the underlying invoice. Depending on the phone, email, calendar, assistant, and account settings involved, information from messages can sometimes surface elsewhere automatically.
The reminder made the claim feel more legitimate.
It didn't make the sender's Gmail address disappear.
This Is Why I Look at the Actual Sender
A familiar logo can be copied.
A company name can be typed into an email.
“PayPal Service” can appear as a display name.
A professional-looking invoice number can be invented.
An amount like $428.81 feels specific enough to seem real.
Even a reminder appearing on my phone can make the situation feel more urgent.
But I keep coming back to the basics.
Who actually sent this?
In this case, the screenshot shows:
PayPal Service balaisac334@gmail.com
That's enough for me to stop interacting with the message and verify everything independently.
The Weird Details Keep Coming
Other things make me skeptical.
The email refers repeatedly to “PayPal Service” as though I'm paying for an annual membership.
There's also some mangled text:
“we’re here to help.”
Then the signature lists:
PayPal Service
12014 Copernicus Ave
Bakersfield Ca 93312 Usa
Again, you don't need to investigate those details through the email itself.
That's an important distinction.
I don't have to prove every element is fake before deciding not to trust an unsolicited message.
I can independently verify the account that is said to owe the money.
Don't Let a $428.81 Charge Create Panic
This type of message depends on urgency.
Four hundred twenty-eight dollars and eighty-one cents isn't pocket change.
Someone sees that amount and thinks:
Please stop this charge now.
That's when judgment can disappear.
Instead, I'd do the boring thing.
Open PayPal independently.
Check my activity.
Check automatic payments and subscriptions.
Check the payment methods attached to the account.
If necessary, contact PayPal using contact information obtained independently from PayPal—not the telephone number in the suspicious email.
If the $428.81 transaction isn't there, I'm certainly not going to call a stranger and give them account information so they can “cancel” it.
The Phone Reminder Is the Best Part of This One
Not because it's funny—although something is amusing about a suspicious invoice apparently getting promoted to my personal to-do list.
It matters because it shows how context can influence trust.
An email alone?
Suspicious.
An email plus a phone reminder?
Suddenly my brain gets another signal suggesting that maybe this is something I previously knew about.
That's when I have to separate familiarity from verification.
My phone displaying information doesn't prove it’s legitimate.
A professional-looking invoice doesn't prove it's legitimate.
The exact amount doesn't prove it's legitimate.
The reference number doesn't prove it's legitimate.
And putting “PayPal Service” next to a Gmail address certainly doesn't prove it's PayPal.
Be a Good Neighbor
This is another one worth showing to someone who isn't as comfortable spotting suspicious messages.
Don't just tell them:
“That's obviously fake.”
Show them why you're suspicious.
Point to the sender address.
Ask whether they actually have the membership being described.
Show them how to open the real company's app or website on their own.
Explain why they shouldn't call the telephone number supplied by the same message claiming there's a problem.
And if their phone generates a reminder from the message, explain something else:
A reminder is a reminder. It isn't authentication.
The scammers don't need everybody to believe their story.
They need one person to see $428.81, panic, and make that phone call.
As for my alleged PayPal Service anniversary?
I don't think I'll be celebrating.
I won’t be sending a card.
They’re Back! Apparently I Paid $450 for Another Mystery Subscription
It’s been a little while, but apparently my scam social calendar is back in action.
For those who haven’t been following along, I’ve received some interesting emails over the past few months. According to my inbox, I’ve bought Bitcoin, renewed Geek Squad protection—more than once—and even had a watch repaired that I never sent anywhere.
Today, we return to an old favorite:
The Facebook Event Invitation Scam.
This time, “Brooke Alexandra” has invited me to an exciting event called:
“Your Subscription Payment of $450 was Paid. Your Order ID#663028”
Well, Brooke, thank you for the invitation.
Unfortunately, I have absolutely no idea what I supposedly subscribed to.
Going, Maybe, or Can’t Go?
My favorite part of these scams is still Facebook’s event format.
I’ve supposedly just discovered an unauthorized $450 PayPal transaction, and immediately underneath this alarming news, I’m asked:
Tell them if you can make it.
My choices?
Going.
Maybe.
Can’t Go.
Decisions, decisions.
I’m going with Can’t Go.
Not because I have another commitment. I try not to attend celebrations for fraudulent purchases.
Meet Bill, My Apparently Very Generous Alter Ego
The description gets even better.
It says:
“Bill has paid $450 for a subscription using your Pay_Pal account from an unknown seller IP.”
Who is Bill?
I have no idea.
Bill, please stop spending my imaginary money.
The message then provides a phone number and tells me to call if I don’t recognize the seller.
And then comes my favorite instruction:
“Please do not copy the number, type it manually to call.”
Oh, absolutely.
I'm not comfortable trusting a financial alert that asks me to type a phone number manually.
That’s practically the international symbol for:
“Nothing suspicious happening here!”
Meta Is Literally Warning Me
As with the previous versions, there’s an important message sitting prominently near the top:
“Warning: This event invitation was not sent by Meta. Please be cautious when clicking on links or providing personal information.”
That deserves more attention than the scary $450 headline.
The formula hasn’t changed much:
Create an alarming transaction.
Use a recognizable brand name like PayPal.
Please let me know if my account may have been compromised.
Give me a telephone number.
Please create urgency so I call before I stop to think.
And package everything inside a Facebook event invitation so the resulting notification looks more familiar.
The Scam Has One Big Problem
If my PayPal account really has a mysterious $450 transaction, I don’t need Brooke Alexandra—or Bill—to help me investigate it.
I can go directly to PayPal through its official app or website and check my account.
The same rule applies to suspicious emails claiming to come from a bank, credit card company, retailer, Geek Squad, or practically anyone else.
Don’t let the suspicious message tell you how to verify the suspicious message.
Verify it independently.
And don’t call a mystery number just because someone put “PayPal” next to it.
My Imaginary Spending Spree Continues
So let’s add another purchase to the growing list.
Bitcoin? ✔️
Mystery subscriptions? ✔️
Geek Squad? ✔️
Watch repair? ✔️
Another mystery $450 subscription? ✔️
At this point, the person living inside my spam folder has a considerably more exciting financial life than I do.
I’m just disappointed that after all this imaginary spending, nobody has emailed me to say I’ve purchased a beachfront condo in Thailand.
Scammers, if you’re reading this, at least make the next fake purchase interesting.
Have a Scam Story? Send It My Way
Now I want to hear what’s landing in your inbox.
If you’ve received a scam email, suspicious text, social media message, fake invoice, questionable refund notice, or something that made you think, “There is no way this is legitimate,” send it to me.
Please send me your screenshots and let me know what happened. I may feature some of them in future posts as we look at the creative—and sometimes hilariously bad—ways scammers try to separate people from their money.
Please remove or cover passwords, account numbers, addresses, phone numbers, or other sensitive personal information before sending screenshots.
Maybe it’s time to turn my scam collection into our scam collection.
And until then, Brooke...
Can’t Go.
Another $399.99 Subscription? Apparently Geek Squad Is Throwing a Facebook Event
I have another expensive subscription I didn’t know about.
And once again, the scammers were thoughtful enough to invite me to a Facebook event to celebrate it.
This email arrived with the subject:
“Jordan Ramirez invited you to Geek Squad Order confirmed: INV#445016.Amount:$399.99”
According to the invitation, I supposedly paid $399.99 for a Geek Squad PC Protection Plan.
There's just one minor problem.
I didn't.
And if this looks familiar, it should.
🚩 Haven't We Seen This Movie Before?
Just recently, I received another Facebook event invitation claiming that $498.99 had been paid for a subscription through my PayPal account.
That one came from “Agnes V. Burden.”
This time we have Jordan Ramirez, Geek Squad, and $399.99.
Different person.
Different company.
Different dollar amount.
But remarkably similar script.
The invitation claims:
“Bill has paid $399.99 for a subscription using your PayPal account from an unknown seller IP.”
Wait.
Bill is back?!
Apparently Bill has access to my imaginary PayPal account and is having quite a shopping spree.
It would be helpful to sit Bill down and discuss boundaries.
🚩 Facebook Is Literally Warning Me
One of my favorite parts is that the warning is sitting right there at the top of the message:
“Meta did not send this event invitation. Please be cautious when clicking on links or providing personal information.”
Thank you, Meta.
Message received.
That's an important distinction because the sender shown in the email is:
Jordan Ramirez <notification@facebookmail.com>
Someone might see the Facebook-related email address and assume the underlying message must be trustworthy.
But the screenshot itself explains what's happening.
Jordan Ramirez invited me to an event.
The suspicious content is contained inside that event invitation.
A legitimate platform delivering a notification doesn't automatically make the content created by another user legitimate.
🎉 What Time Does My Geek Squad Party Start?
The invitation gives me the traditional Facebook choices:
Going
Maybe
Can't Go
Let's see.
Am I going to my imaginary $399.99 Geek Squad subscription celebration?
I'm leaning toward:
Can't Go.
I have plans that evening.
Specifically, not calling the phone number in this message.
🚩 And There It Is: The Phone Number
The message says that if I don't recognize the purchase, I should contact a:
“Resolution Center”
and conveniently provides a phone number.
That's the part that deserves attention.
The scary $399.99 charge gets your attention.
Geek Squad provides a recognizable brand.
PayPal adds a financial component.
And the phone number provides an immediate way to “fix” the problem.
That's exactly when I'd stop.
If I genuinely thought Geek Squad charged me $399.99, I wouldn't call the number supplied in a suspicious Facebook event.
I'd check my PayPal, credit card, and bank accounts independently.
Then, if necessary, I'd independently find the legitimate contact information for Geek Squad or the financial institution involved.
The suspicious message doesn't provide both the problem and the solution.
🚩 “Pay_Pal” Makes Another Appearance
This is another detail I noticed in both messages.
Not PayPal.
Pay_Pal.
The previous $498.99 subscription invitation used essentially the same wording.
Now this one does too.
So let's compare.
Previous message:
$498.99 subscription.
Facebook event invitation.
Claim involving “Pay_Pal.”
Unknown seller IP.
Phone number to call.
Current message:
$399.99 Geek Squad subscription.
Facebook event invitation.
Claim involving “PayPal.”
Unknown seller IP.
Phone number to call.
That's quite a coincidence.
Or perhaps we're looking at variations of the same social-engineering template.
🧠 The Scam Isn't Really About Geek Squad
That's an important point.
The recognizable company name makes the story believable.
Today it's Geek Squad.
Another day it could be PayPal, Norton, McAfee, Amazon, Microsoft, or another familiar brand.
The psychology is what matters.
You see:
$399.99
Your immediate reaction might be:
WHAT DID I BUY?!
Then you see:
“If you do not recognize this purchase, please contact...”
Perfect!
There's a phone number!
And before you've checked whether the transaction actually exists, you're talking to whoever is on the other end.
That's why urgency is so effective.
The message doesn't necessarily need to survive careful analysis.
It just needs to get you to act before you do careful analysis.
🚩 Don't Call the Number to Find Out Whether the Number Is Legitimate
This seems obvious when you say it out loud, but it's worth repeating.
If a suspicious message tells you that something terrible happened and then provides a phone number to fix it:
Don't use the suspicious message to verify the suspicious message.
Go around it.
Open your actual PayPal app.
Check your bank.
Check your credit card.
Go independently to the company's official website.
If there's no $399.99 transaction anywhere, that's important information.
And if there is an unauthorized transaction, contact the financial institution using independently verified information—not the number supplied in the questionable message.
🏡 Don't Be Passive. Be a Good Neighbor.
This is why I keep sharing these.
I recognize the pattern because I've been documenting them.
Someone else might not.
Someone might see Geek Squad, recognize the name, and panic.
Someone might think their spouse or child bought something.
Someone might worry that their PayPal account has been hacked.
And someone might immediately call.
If you see one of these, don't just delete it and move on.
Warn somebody.
Show your parents.
Show your neighbors.
Show the person who always calls you when something weird appears on their computer.
Report suspicious content through the appropriate platform.
Sometimes being a good neighbor is simply saying:
“Don't call that number. Let's check your actual account first.”
Jordan, I'm Going to Have to Decline
So thank you, Jordan Ramirez, for inviting me to the celebration of my imaginary $399.99 Geek Squad subscription.
Unfortunately:
Going? Nope.
Maybe? Still nope.
Can't Go? That's the one.
And apparently I need to have a serious conversation with Bill, because he keeps buying subscriptions with my imaginary PayPal account.
Follow along at NielFlamm.com/blog for more scam emails, suspicious recruiters, questionable vehicle offers, and whatever strange invitation lands in my inbox next.