Fraud Cleanup

Is That PayPal Email a Scam? What to Do Right Now

An email that looks like PayPal is easy to fake. Here is how to check it, what to skip, and where to report it.

The email says you bought something you never bought. Or your account is on hold. Or you must confirm a payment right away. It looks like it came from PayPal. Before you click anything, slow down. An email scam that spoofs PayPal is built to make you act fast, and the next ten minutes are for checking, not clicking.

What a PayPal email scam is

The FBI says phishing means emails designed to get your personal information or your financial credentials. The FBI says scammers typically pose as a creditor, bank, or state benefits agency. The FTC says they use email or text messages to trick you into giving up passwords, account numbers, or your Social Security number. Once they are inside, your email, your bank, and your other accounts are all at risk. What they take can also be passed along and sold to other scammers.

The versions you are most likely to see

The FTC lists the stories phishing emails tell, and the fake PayPal email follows them closely.

  • The invoice you never got. The email includes an invoice you do not recognize. The FTC says it is fake.
  • The billing problem. The email says your account is on hold because of a billing problem. The FTC lists this exact line as a sign of a scam.
  • The unusual activity alert. The email says there was suspicious activity or a log-in attempt on your account. The FTC says a scammer will say this even when nothing happened.
  • The confirm your info request. The email says you need to confirm personal or financial details. The FTC says scammers use this when there is no reason to confirm anything.
  • The update your payment link. The email invites you to click a link to update your payment details. The FTC says legitimate companies will not email or text you a link to update your payment information.

How to tell a real PayPal email from a fake one

PayPal's own guidance gives you a few things to check.

  • Your full account name. PayPal says real messages always use the full name listed in your PayPal account. A greeting like "Dear Customer" is a bad sign.
  • The logo and checkmark. PayPal says an authentic email shows the company logo and a checkmark in your inbox view. PayPal says many email providers, like Apple, Gmail, and Yahoo, support companies using their logo to help people identify real messages.
  • Typos and grammar. PayPal says misspellings and bad grammar are common in phishing messages.

One warning before you lean on the logo. The FTC says a scam email may use a company's real logo in the header and still be fake. A logo proves nothing on its own.

Tricks that make fakes look real

The FBI says phishing schemes use spoofing to lure you in. Scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. A lookalike address can be off by one letter, and a quick glance will miss it.

The FBI says the fake websites behind these links are made solely to steal your information. And PayPal warns about two things people trust too much. The letter s in https does not always mean a site is real, because hackers can build encrypted sites too. Many fake sites also show a padlock in the address bar, so do not rely on it.

The same goes for phone calls. PayPal says scammers can easily fake a Caller ID, so a call that says PayPal is not necessarily from PayPal. Scammers also use automated voice calls, and you should not call back a number an automated call gives you.

What to do right now

If a suspicious email just landed, here is the order to work in.

  1. Click nothing inside it. The FBI says to avoid clicking on anything in an unsolicited email or text message. The FTC says links and attachments can install harmful malware.

  2. Leave the attachment alone. The FBI says never to open an email attachment from someone you don't know. PayPal says the same, because attachments can contain malware.

  3. Run one quick check. The FTC says to ask yourself whether you have an account with the company or know the person who contacted you. A no to either one means it could be a phishing scam.

  4. Check your account the safe way. Do not use the link in the email. PayPal says the only safe routes are the Contact page in the Help Center and PayPal Customer Service. That is the number PayPal publishes, not the one in the email.

  5. Report it, then delete it. The FTC says if you see signs of a phishing scam, report the message and then delete it. Reporting steps are below.

If you already clicked or entered your info

Do not panic. Move fast instead.

  • Turn on multi-factor authentication. The FTC says to protect your accounts with multi-factor authentication. It makes it harder for scammers to log in even if they got your username and password. The FBI says to set it up on any account that allows it and never disable it.
  • Back up your data. The FTC says to protect your data by backing it up.
  • If money left your account, dispute the charge. Our guide to the first hour after you pay a scammer covers what to do next.

The FTC says phishing emails can lead to identity theft for people who hand over their information. If you gave up a password or card details, treat your accounts as exposed and lock them down.

How to report the fake email

The FTC, the FBI and PayPal each name a place to report it.

  • Forward it to the Anti-Phishing Working Group. The FTC says to forward phishing emails to reportphishing@apwg.org.
  • Report it to the FTC. The FTC says to report the phishing attempt at ReportFraud.ftc.gov.
  • Report it to the FBI. The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.

PayPal's page also directs readers to an FTC page listing more ways to report phishing and help fight scammers. PayPal sums up its advice as detect, avoid, and report.

Make the next one easier to spot

You will get more phishing emails. The FTC says scammers are always trying to outsmart spam filters, so extra layers of protection help.

  • Security software. The FTC says to use security software set to update automatically.

  • Phone updates. The FTC says to protect your cell phone by setting its software to update automatically.

  • Spam filters. The FTC says your email spam filters might keep many phishing emails out of your inbox. Keep them on.

  • Multi-factor authentication. The FTC says it makes it harder for scammers to log in to your accounts if they do get your username and password.

    See our pages on the venmo scam, the wider PayPal scam, and whether zelle a scam is real.

Sources