On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.
It can, however, be useful to get invoices for purchases that were discounted down to $0.00. At the startup I'm with we often give new customers a $0.00 trial rate, but they still want invoices so their billing department can keep track. Of course, this billing system isn't using PayPal, but just a thought.
Not invoices per se, but if you buy something on eBay using only eBay gift cards, it processes as a PayPal "transaction" of $0.00. I've got a bunch of those in my email, always interesting to see "You sent a payment of $0.00 USD to X".
Actually a simpler fix is to hold $10 in the user's paypal account for each $0 invoice they send, and if the invoice is reported back as spam they keep the $10, otherwise after 90 days they release it back to the (potential) spammer. Doing this with funds in the account, rather than with a (likely) stolen credit card, works very well.
For accounts which keep an average balance > $minimum you could wave the $10 hold and just confiscate $10 every time someone reported their $0 invoice as spam.
Yeah, as much as I hate it, I always find myself appreciating the ingenuity that goes into these things.
Another similar spam hack (that unless I'm mistaken is also legal) is the recent plague of Google Analytics referrer spam targeting people who pay attention to their GA referral reports.[1] It has actually caused some issues given that the volume can be quite significant and can easily skew your overall numbers by quite a bit if left unfiltered.
