ScamGuard+ guide

PayPal Scam Emails and Texts: How to Check Them

Fake PayPal messages commonly use account suspension, unexpected payments, invoices or urgent security warnings. Verify the claim inside PayPal rather than through the message.

Fake PayPal messages commonly use account suspension, unexpected payments, invoices or urgent security warnings. Verify the claim inside PayPal rather than through the message.

Use the checks below to slow the situation down, verify the claim through a separate route and avoid giving a suspicious contact more information or control.

Check inside PayPal

Do not sign in through an unexpected email or text. Open the PayPal app or type the official PayPal address yourself and check your activity, notifications or Resolution Centre for the claimed issue.

Look for phishing signs

PayPal warns about generic greetings, unexpected attachments, false urgency, suspicious links and requests for sensitive information. A polished message is not proof that it is genuine.

Do not trust payment emails alone

If a message says you have received a payment, verify the transaction in your PayPal activity before sending goods, refunds, tracking information or money. A convincing payment email can be spoofed.

Report suspicious messages

PayPal currently asks users to forward suspicious emails and texts to phishing@paypal.com and then delete the message. Use PayPal’s current Security Centre for the latest reporting instructions.

If your account may be exposed

If you entered your PayPal password on a suspicious page or receive login codes you did not request, change your password through PayPal directly and review account activity and security settings. Contact PayPal through its official Help Centre if necessary.

Practical checklist

Quick checklist

  • Do not sign in through an unexpected PayPal message
  • Check the claimed payment or alert inside PayPal
  • Do not ship goods based only on an email notification
  • Do not open unexpected attachments
  • Forward suspicious PayPal messages to its current phishing address
  • Change your password if you entered it on a suspicious site

Official and primary guidance

Scam techniques, platform features and reporting routes change. These sources were checked when this guide was updated: