PayPal phishing emails: how to spot a fake and what to do
Quick answer
A PayPal email that threatens to suspend your account, greets you with "Dear user" or sends you to log in through a link is phishing. Don't click. Log in to PayPal by typing the address yourself and check the Resolution Center.
- Comes by
- Email, Text, Phone call, Website
- Pretends to be
- PayPal
- Last updated
How it works
PayPal's help center explains how its customers get phished. A spoofed email, text or call says something is wrong with your account and pushes you to a fake website that copies PayPal's login page. Anything you type there goes to the scammer.
PayPal lists the giveaways: an impersonal greeting such as "Dear user" (it says its emails use your first and last name or business name), a link to a fake website, unknown attachments and a false sense of urgency. Common stories include "your account is about to be suspended", "you've received a payment" and "you've been paid too much".
PayPal also warns that a link can look safe, for example a real-looking address followed by a path, so hover over it (don't click) to see the true destination. Some phishing messages also include a phone number to call to "fix" the problem.
Red flags
- A greeting like "Dear user" instead of your name
- A threat to suspend your account unless you act now
- A link or attachment you didn't expect
- A request to log in on a page you reached through the message
- A phone number to call to resolve an account "issue"
- A claimed payment you can't see when you log in directly
Example message
Dear user, we've limited your PayPal account because of unusual activity. Confirm your identity within 24 hours at [link] or call [phone number] to avoid permanent suspension.
What to do
- 1
Don't click, open or call
Don't reply, open links, download attachments or call numbers in the message, as PayPal's help center advises.
- 2
Check your account the safe way
Open a new browser tab, type the PayPal address yourself or use the app, and check your notifications and Resolution Center.
- 3
Forward it to PayPal, then delete it
PayPal's help center says to forward a suspicious email or website to the address it publishes there, and delete the message from your inbox.
- 4
If you entered your password
Change your PayPal password and any other account that shares it, turn on two-step verification and check recent activity. Tell PayPal and your bank if money moved.
- 5
If you gave more details
If you gave card or identity details, see what to do after a data breach for the freeze and monitoring steps.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Phishing emails are cheaper to send and likelier to work when they have your real name and email. Both turn up on people-search sites and in breached data. Serus finds the people-search and data broker listings that show your phone number and address and removes them, and alerts you when your details turn up in a breach, so fewer scammers can build a believable story about you.
More PayPal scams
Frequently asked
How does PayPal address me in real emails?
PayPal says it addresses you by your first and last name or business name, and never uses greetings like "Dear user".
Does PayPal ask for my password by email?
PayPal says it only asks you to enter your password on its own login page, and tells you to log in and check the Resolution Center for notifications.
A link looks like paypal.com. Is it safe?
Not necessarily. PayPal says a link can look secure while pointing elsewhere, so hover over it to see the real destination, or don't click at all.
What if I already clicked?
Don't enter anything. If you did, change your password right away and review your account activity.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
