We found this fake-invoice campaign while scammers were still building it

A live 'phantom invoice' refund scam campaign is being staged that sends convincing fake receipts impersonating brands (PayPal, Amazon, Geek Squad) to coerce victims into calling attacker-controlled phone numbers; the phone call is used to obtain remote access, payment details, or fraudulent 'refund' payments. The report includes detected template placeholders showing the campaign was intercepted during rollout, and it lists malicious domains and callback numbers as indicators, plus guidance for spotting and responding to these scams.