PayPal account hacked, what to do

Your PayPal account is hacked when someone else can sign in, send money, or change the email. If you can still sign in, change the password on paypal.com. Then report any payment you did not make in the Resolution Center. If you cannot sign in, or the email on the account is no longer yours, call PayPal. They can freeze the account while they look.

The longer checklist is PayPal account hacked. These clicks are from PayPal’s US help and the US user agreement. Menus in other countries differ. Where a UK page uses another label or deadline, we name the country.

Open PayPal yourself

Type paypal.com, or open the app you already installed. A link or a phone number inside an email can be fake. PayPal’s account security page says to type the address yourself.

A real PayPal email uses your full name, or your business name. “Dear user” and “Hello PayPal member” are fakes. Forward the message to [email protected], then delete it. PayPal lists that address on its phishing page.

PayPal will not ask for your password or a 2-step code by phone, email, or text. Hang up if the caller wants the code, remote software, or a transfer to a “safe” account. Money you approve on that call counts as your payment. The section below covers that case.

Change the password if you can sign in

The password change is on the website. PayPal says the app cannot change the password or the security questions. Follow change your password:

1. Go to Settings.
2. Click the Security tab above your name.
3. Click Update next to Password.
4. Confirm the current password, enter the new one twice, and click Change Password.

Pick a password this account has never used. PayPal asks for at least 12 characters, or a passphrase of three or more words. Use it only here. Their security page says a reused password opens every account that shares it.

On that same Security tab, click Update under Security questions. Choose new questions, type new answers, and click Save.

Change this password everywhere else you used it. Include email, and accounts that still look fine. PayPal says that on its report fraud page.

Alerts and reset codes go to the inbox on the account. If someone else can read it, they can take PayPal back. Secure that mailbox first. The playbook is Personal email account hacked.

If you cannot sign in

Use reset your password:

1. Go to the PayPal login.
2. Click Forgot password?
3. Choose how you want to complete the security check, and click Next.
4. Create a new password, or keep the current one if PayPal offers that.

The check uses the email or phone still on the account. When that inbox belongs to someone else, the reset will not come back to you.

Call PayPal if the reset fails, or if you no longer have that email or phone. Their locked-out article shows where the number lives:

1. Go to Contact Us.
2. Choose Call Us near the bottom of the page.
3. Click call us as a guest to see the phone details.

Have your phone number, a statement for the linked card or bank, and the email you registered with.

In the United States, the user agreement lists (888) 221-1161 for a lost or stolen login and for a transfer you did not make. You can also write PayPal, Attn: Error Resolution Department, P.O. Box 45950, Omaha, NE 68145-0950. Other countries show a number on their own Contact Us page.

Tell them if someone else has your data. PayPal’s unauthorized access article says they can temporarily freeze the account while they investigate.

Check the email, phone, and address

PayPal’s fraud page says to look for a phone, email, or mailing address you did not add.

Email, from PayPal’s email article:

1. Go to Settings.
2. In Emails, click +Add, enter an address you control, and click Confirm.
3. Open the confirmation PayPal sends.
4. Set that address as primary. Then use the three dots beside the old address and select Delete. PayPal will not delete the primary email until another one is primary.

Phone, from PayPal’s phone article:

1. Go to Settings.
2. In Phone Numbers, click + Add New, enter your number, and click Add phone number.
3. Enter the text code. It expires in 15 minutes.
4. Click Change beside a number you do not recognize, or Remove. Remove works only when the account has two numbers.

Address, from PayPal’s address article:

1. Go to Settings, then Addresses.
2. Click Edit, fix the address, and click Update. Or click Remove.
3. Keep one address on the account. Add yours and make it the home address first. An address used as a card’s billing address stays until that card changes.

Report a payment you did not make

Open the Resolution Center. In the United States, report an unauthorized transaction is five clicks:

1. Go to the Resolution Center.
2. Click Report a problem.
3. Choose the payment and click Continue.
4. Choose “I want to report unauthorized activity.”
5. Follow the steps.

PayPal investigates and says you will get an email within 10 days. Keep the case. Answer any follow-up there.

Check two ordinary causes before you file. A family member may have used the login. A subscription may have renewed. PayPal lists both as payments that look new and were still authorized.

The UK uses the same five clicks, under Resolution Centre. The UK report page also says the email comes within 10 days.

The deadline depends on the country

In the United States, the dispute timeframes say to tell PayPal at once. That is for transfers on your statement that you did not make.

The US user agreement adds 60 days from the statement. After that, PayPal may not return money taken later, if they can show a faster report would have stopped it. A long trip or a hospital stay can extend the time. When the protection applies and you follow their steps, the agreement says they cover the full amount.

In the UK, the dispute timeframes give you 13 months from the payment. Other countries publish their own window. Open your country’s page on the day you file.

The US agreement calls a payment unauthorized when you did not allow it and it did not benefit you. Their example is a stolen password. If you gave someone the login and they went further than you allowed, the loss stays yours, unless you had already told PayPal to block that person.

Cancel subscriptions you do not want

On the US site, the same report page shows automatic payments:

1. Go to Settings.
2. Click Payments.
3. Select Subscriptions and saved businesses, or Automatic Payments.
4. Select the merchant.

Cancel there, or change the backup payment method. In the UK the path is Settings, Payments, Automatic payments, then the merchant, then Cancel.

A completed payment you did authorize gets refunded by the seller. Use the seller for that, and leave the unauthorized form for payments you never made.

Tell the bank, and check PayPal cards

If money left a linked bank or card, call the number on the card. A statement you already have works too. PayPal’s fraud page says to ask for the fraud department and explain what happened. The refund rules depend on your country and the card. Use Scammed or fraudulent bank charge.

Remove a bank you did not link, from remove a bank:

1. Go to Wallet.
2. Click the bank.
3. Click Remove bank.

A pending transfer, or a limitation on the account, can block this. Wait for the transfer, or clear the limitation, and try again.

Remove a card you did not link, from remove a card:

1. Go to Wallet.
2. Click the card.
3. Click Remove card.

A pending payment can block it. So can recent use as a backup payment method. PayPal says to wait a few days and try again.

PayPal Credit, the PayPal Debit Card, and the PayPal Cashback Mastercard are separate from the balance. In the United States, the fraud page lists their own contacts:

• PayPal Credit: (844) 373-4961.
• PayPal Debit Card: lock it in the app, then report it lost or stolen in the app or on the website.
• PayPal Cashback Mastercard: the number on the card, or (855) 520-0991.
• PayPal Business Debit Mastercard: (866) 888-6080.

A limit can follow a takeover, a bank report, or a card alert. Open the Resolution Center, or the bell on the Dashboard. PayPal’s limitation article says support usually cannot lift it by phone, so wait for them to write. Forward a limit email that is missing from the Resolution Center to [email protected]. If you already clicked it, sign in yourself, check payments, and change the password.

If you approved the payment

PayPal’s scam page uses “scam” for a payment you authorized when the goods never came, or came wrong. Purchase Protection is that claim. An unauthorized claim is the one for a payment you never made.

Item Not Received must be opened within 180 days of the payment. Significantly Not as Described must be opened within 30 days of delivery. It must also be inside 180 days of the payment. Use whichever date comes first.

Friends and Family sits outside Purchase Protection. Goods and Services is the type that program can cover, and PayPal says the buyer pays no fee for it. A seller pushing Friends and Family is a warning on that page.

In the UK, the dispute page tells you to report a scam payment right away. An unexpected billing-agreement payment there has 8 weeks.

If someone talked you into sending the money, say that when you contact PayPal. The bank side is in Scammed or fraudulent bank charge.

Turn on 2-step verification

Once the password is yours, turn on 2-step verification in the browser. PayPal’s 2-step article uses an authenticator app, such as Google Authenticator or Microsoft Authenticator.

1. Click the Settings icon next to Log out.
2. Click Security near the top of the page.
3. Click Set Up to the right of 2-step verification.
4. Choose Use an authenticator app.
5. Click Set it Up and follow the screen.

PayPal will not ask for that code by phone, email, or text.

What to check before you stop

You can sign in, and the email, phone, and address are yours. The payment you did not make has a case. 2-step verification is on. PayPal mail arrives in an inbox you control.

Do the prepare list on PayPal account hacked. If the bank or card was charged, call from Scammed or fraudulent bank charge. If resets still go to an inbox you do not control, finish Personal email account hacked.

Related playbooks

• PayPal account hacked. A PayPal payment, a new email, or a linked bank showed up that you did not authorise, or you cannot sign in.
• Scammed or fraudulent bank charge. Money left your account that you did not authorise, or you were talked into sending it and have just realised.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.