How to Spot a PayPal Scam Before You Click Anything
A message that says it is from PayPal may not be. Here is how to check it, what the common scams look like, and what to do in the next few minutes.
A message lands in your inbox or on your phone. It says it is from PayPal. It might warn you about a charge, or say money arrived, or ask you to confirm something. Some are not. A PayPal scam works by making you click, call, or hand over details before you have time to think. Here is how to slow down and check.
How to tell a real PayPal message from a fake one
PayPal names the signs itself. Check the message against this list before you do anything else.
PayPal says a genuine message will always address you by the full name on file in your account. A greeting like "Dear customer" or a name you never put in your account is a warning sign. Typos, misspellings, and incorrect grammar are common in phishing messages, PayPal says, so read slowly.
PayPal also says an authentic email from them shows the company logo and a checkmark in your email inbox view. Many email providers like Apple, Gmail, and Yahoo support companies using their logo to help consumers identify real messages. If your inbox shows no logo and no checkmark, treat the message with care.
Attachments are a strong warning sign. PayPal says attachments can contain malware, so you should never open them unless you are completely sure they are legitimate.
One more thing to unlearn. PayPal warns that the s in https is no proof a site is real, since hackers can build encrypted sites too. PayPal says plenty of fake sites display a padlock in the address bar, so that icon is not something to trust. That icon only shows the connection is secure. It does not prove who runs the site.
The most common PayPal scams and what they look like
The FTC says scammers use email or text messages to trick you into giving them your personal and financial information. They want your passwords, account numbers, or Social Security number. A phishing message tells a story to get you to click a link or open an attachment. Here are the stories you are most likely to run into.
A problem with your account. A phishing scammer might claim there is a problem with your account or your payment information when there is not. The FTC says one sign of a scam email is that it says your account is on hold because of a billing problem.
Suspicious activity. A scammer might say they noticed suspicious activity or log-in attempts when they have not. The goal is to scare you into clicking fast.
A request to confirm information. The FTC says a scammer might say you need to confirm some personal or financial information when you do not. The FTC also says legitimate companies will not email or text you a link to update your payment information. That one rule catches a lot of fakes.
A fake invoice. A scammer might include an invoice you do not recognize. The FTC says it is fake. The message may use a company's real logo in the header and still be fake.
A payment link. The FTC says a scammer might want you to click on a link to make a payment, but the link has malware.
The FBI adds that scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. An address that is one letter off from the real one is not a typo on your screen. It is the trick. If you want more detail on fake emails in particular, see email scam PayPal.
PayPal scam calls and spoofed phone numbers
Maybe the scam comes by phone instead. Your caller ID says PayPal. Can you trust it?
No. PayPal says scammers can easily fake a Caller ID, so a call that says PayPal is not necessarily from PayPal. The FBI calls these vishing scams, and says they happen over the phone, voice email, or VoIP calls. The FBI also says scammers typically pose as a creditor, bank, or state benefits agency.
PayPal says scammers use automated systems to make voice calls, and you should not call back a number an automated call gives you. The FBI says companies generally do not contact you to ask for your username or password. So be wary of any caller who asks for your password, no matter what the screen says.
PayPal says to contact PayPal only through the Contact page in the Help Center or by calling PayPal Customer Service. Look that up yourself. Never dial the number in the message.
What to do right now: verify, don't click
Here is the short version of the next few minutes.
First, do not click anything in an unsolicited email or text message. The FBI says that plainly. Attachments and links might install harmful malware, the FTC says.
Second, ask yourself whether you have an account with the company or know the person who contacted you. The FTC says if the answer is no, it could be a phishing scam.
Third, if you think the message might be real, do not use the link or the number in it. The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. With PayPal, that means the Help Center Contact page or the customer service number above.
Fourth, PayPal says you should never give personal, credit card, or account info through email, text, or phone. That rule has no exceptions.
If you already clicked a link, do not panic, but act. If you typed your password into a fake page, change it on the real site right away. The FTC says anyone who hands over details may find scammers breaking into their email, bank, or other accounts. Your details might also end up sold to other scammers, the FTC says. Phishing can lead to identity theft. If that worries you, see our page on the experian fraud alert.
How to report a PayPal scam
PayPal says the best plan to stay secure is to detect, avoid, and report.
The FTC says to send in a report when a message looks like phishing, then get rid of it. Here is where reports go.
If you got a phishing email, the FTC says to forward it to the Anti-Phishing Working Group at reportphishing@apwg.org. If you got a phishing text message, forward it to SPAM by sending it to 7726. The FTC also says to report the phishing attempt to the FTC at ReportFraud.ftc.gov. The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov.
PayPal notes that an FTC page provides additional ways to report phishing and help fight scammers. For a wider picture of where reports go, see how can I report a scam.
How to make your account harder to break into
The FTC says scammers who get your information could get access to your email, bank, or other accounts. The FTC says to protect your accounts by using multi-factor authentication. It makes it harder for scammers to log in to your accounts if they do get your username and password. The FBI says to set up two-factor or multi-factor authentication on any account that allows it and never disable it.
The last habit is the simplest. Treat every unexpected message as a question, not an instruction. Check it in the app or on the site you opened yourself. Click nothing. Call no number from the message.