Fake PayPal messages commonly use account suspension, unexpected payments, invoices or urgent security warnings. Verify the claim inside PayPal rather than through the message.
Use the checks below to slow the situation down, verify the claim through a separate route and avoid giving a suspicious contact more information or control.
Check inside PayPal
Do not sign in through an unexpected email or text. Open the PayPal app or type the official PayPal address yourself and check your activity, notifications or Resolution Centre for the claimed issue.
Look for phishing signs
PayPal warns about generic greetings, unexpected attachments, false urgency, suspicious links and requests for sensitive information. A polished message is not proof that it is genuine.
Do not trust payment emails alone
If a message says you have received a payment, verify the transaction in your PayPal activity before sending goods, refunds, tracking information or money. A convincing payment email can be spoofed.
Report suspicious messages
PayPal currently asks users to forward suspicious emails and texts to phishing@paypal.com and then delete the message. Use PayPal’s current Security Centre for the latest reporting instructions.
If your account may be exposed
If you entered your PayPal password on a suspicious page or receive login codes you did not request, change your password through PayPal directly and review account activity and security settings. Contact PayPal through its official Help Centre if necessary.
Practical checklist
Quick checklist
- Do not sign in through an unexpected PayPal message
- Check the claimed payment or alert inside PayPal
- Do not ship goods based only on an email notification
- Do not open unexpected attachments
- Forward suspicious PayPal messages to its current phishing address
- Change your password if you entered it on a suspicious site
Official and primary guidance
Scam techniques, platform features and reporting routes change. These sources were checked when this guide was updated: