PayPal fraud in the UK: fake payment emails and how to spot them
Quick answer
A fake PayPal email saying a buyer has paid is a scam. Fraudsters push sellers to post the item before checking. Log in to PayPal yourself, check the payment, and forward suspicious emails to report@phishing.gov.uk.
- Pretends to be
- PayPal
- Last updated
How it works
Fraudsters email people who sell items online, pretending to be PayPal. Action Fraud describes emails that suggest a buyer has paid and then ask for a tracking number, which pushes the seller to post the goods before checking the payment.
Other versions are a fake 'overpayment', where the buyer asks the seller to send the difference to another account. Action Fraud reported over 21,000 reports in the first nine months of 2020 alone, which shows how common it is. Genuine PayPal messages use your first and last name or business name.
Red flags
- An email saying you've been paid that you can't match to your PayPal account
- A request for a tracking number before the money is confirmed
- A buyer who overpays and asks for a refund of the difference
- A greeting like 'Dear customer' instead of your name
- A link that asks you to log in from the email
Example message
PayPal: You've received a payment of £250 which is on hold. Send the tracking number to release the funds to your account.
What to do
- 1
Don't post the item yet
Log in to PayPal by typing the address yourself and check the payment is really there.
- 2
Don't click links or enter your password
PayPal's advice is to avoid links in a suspicious email and to check activity by logging in directly.
- 3
Don't refund an overpayment
If a buyer says they paid too much, check your account first.
- 4
If you've entered details or sent goods, act
Contact PayPal and your bank, change your password and turn on two-step verification. Our guide on what to do after a data breach covers the steps.
- 5
Report it
Forward the email to report@phishing.gov.uk and report fraud to Action Fraud.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers don't pick numbers and addresses at random. Names, phone numbers, home addresses and email addresses are easy to buy from people-search sites and data brokers, and they leak in breaches, which lets a caller or sender sound like they know you. Sellers on marketplaces are targeted because their names and contact details are public. Serus finds where your details are listed and removes them from the sites that hold them, and alerts you when your data shows up in a breach, so fewer scammers can reach you.
More PayPal scams
Frequently asked
How can I tell a real PayPal email?
A genuine PayPal email uses your first and last name or business name. When in doubt, log in to PayPal directly and check.
Where do I forward fake PayPal emails?
Forward them to report@phishing.gov.uk.
What is the overpayment trick?
A fake buyer claims to pay too much and asks you to send the difference elsewhere, before the first payment is real.
Is PayPal to blame for these emails?
No. PayPal is a real payment service. Scammers copy its emails to trick sellers.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
