Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
PlaybooksPayPal account hacked
Moneycritical15 minutes to prepare

PayPal account hacked

A PayPal payment, a new email, or a linked bank showed up that you did not authorise, or you cannot sign in.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist

What this means

A PayPal account can send money, and it can pull from a linked bank or card. An unauthorised payment is the urgent part. A changed email or phone number is how they keep the account after you notice.

PayPal’s US help says that if you think someone accessed your data, call them and they can temporarily freeze the account while they look. If you see a payment you did not authorise, report it in the Resolution Center. They investigate and say you will get an email within 10 days. They also say to read their dispute filing timeframes, because the window to report is limited. Those clicks are documented for PayPal in the United States. In other countries the labels differ. The job is the same: tell PayPal, report the payment, and make sure the email on the account is yours.

This sits next to Scammed or fraudulent bank charge. If you sent the money yourself because someone convinced you, say that plainly. PayPal treats an unauthorised payment differently from one you approved. If they opened other accounts in your name, use Someone is using your identity.

Warning signs

  • A payment you do not recognise, including a small one.
  • PayPal asks you to confirm a device, a bank, or an email change you did not make.
  • You cannot sign in, or the password reset goes to an address that is not yours.
  • A subscription or an automatic payment appears for a seller you do not know.
  • Someone phones you, claims to be PayPal, and asks you to install software or move the balance to a “safe” account.

Recover now

First 15 minutes

  1. Open PayPal from the app you installed, or type the address. Do not use a link in a text, and do not call a number from the message. PayPal’s fraud page tells you to review accounts yourself and to change the logins.
  2. If you can sign in, change the password, and check the email, phone, and mailing address. PayPal says scammers change those. Remove anything you did not add.
  3. Report a payment you did not authorise in the Resolution Center. On the web, PayPal’s US steps are: go to the Resolution Center, click Report a problem, choose the payment, click Continue, choose I want to report unauthorized activity, and follow the steps. Before you file, check it is not a family member or a subscription. PayPal lists those as payments that look unfamiliar and are still authorised.
  4. If you cannot sign in, or you believe someone has your data, call PayPal using the contact path on their own site. Their US article on unauthorised access says they can temporarily freeze the account while they investigate. We are not listing a phone number here, because the right number depends on the country and the product.
  5. Tell the bank that is linked, on the number on your card or statement, if money left that account. Ask them to watch or block further pulls. PayPal’s fraud page says to ask for the fraud department and to be clear about what happened.

Today

  1. Change the password on the email address that receives PayPal mail, from a device you trust. If that inbox is already compromised, do Personal email account hacked before you trust any PayPal reset.
  2. Review automatic payments. In the US help, that is Settings, then Payments, then subscriptions or automatic payments. Cancel the ones you do not want. A completed payment you did authorise is refunded by the seller, not by filing it as unauthorised.
  3. If you have PayPal Credit, a PayPal Debit Card, or a PayPal Cashback Mastercard, use the number on that card or the product page. PayPal’s fraud page lists those as separate from the main account. A debit card can be locked in the app.
  4. Change passwords on any other site where you reused this one. PayPal says to include accounts that do not look compromised yet.
  5. Keep the case email. They said you should receive one within 10 days of filing an unauthorised transaction. If the deadline in their dispute timeframes is close, file before you finish the rest of the tidy-up.

Verify recovery

  • You can sign in, and the email and phone on the profile are yours.
  • The unauthorised payment has a case number, and you know the date they said they would write back.
  • Linked banks and cards are ones you opened.
  • Automatic payments you do not recognise are cancelled.
  • Your email account has no forwarding rule you did not create.

After recovery

Save the Resolution Center messages until the case is closed. If PayPal asks for more detail, answer in that case. Do not move the conversation to a chat app because someone claiming to be an investigator got in touch.

If a seller shipped goods on a payment you did not make, leave that to the case. You do not need to intercept a package in person.

Prepare now

The login

  • PayPal has its own password, not the one you use for email.
  • A second factor is on, using whatever method PayPal offers in your country that is not only an SMS code you cannot control.
  • The email on the account is one you check, and that mailbox has its own second factor.

Money movement

  • You have looked at automatic payments once, so a new subscription is obvious.
  • The bank linked to PayPal will notify you on a push or a text you already receive.

Practice

  • You know how to open the Resolution Center without searching for “PayPal support phone.”
  • A family member who sometimes uses your login knows that their purchase will look like fraud if they do not tell you.

Common mistakes

  • Filing a subscription you forgot as unauthorised. PayPal asks you to check automatic payments first. A false report wastes the case you might need.
  • Approving a “safe account” transfer while you are on the phone. That is you authorising the payment. Say so if it already happened. Pretending you never approved it makes the report weaker.
  • Changing PayPal’s password while the attacker still reads the reset email. Fix the mailbox, or they take it back tonight.
  • Waiting out the dispute window. PayPal tells you the timeframes exist and that you should look them up. The page you want is theirs, in your country, on the day you file.
  • Paying a caller who will “refund the unauthorised payment” after you buy gift cards. Hang up and open the Resolution Center yourself.

Sources

Last reviewed October 31, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.