Do it yourself · free Remove PayPal phishing scam yourself 4 steps, 12 minutes, no software needed.
Facts checked on 24 October 2026 against the FTC's phishing advice, and against summaries of PayPal's help pages, a Which? report and a GridinSoft article. No site was tested and no message was opened: this guide covers a scam pattern, not one address.
What a PayPal phishing scam is
A PayPal phishing scam is any attempt to make you believe PayPal contacted you, so that you hand over a login, a card number, a one time code or control of your computer. The message may be an email, a text, a phone call, or an invoice sent through PayPal itself.
The word phishing means fishing for information. The sender throws out the same bait to thousands of people and waits for a few to bite. PayPal is a favourite bait because so many people have an account, because money moves quickly through it, and because a message a payment problem makes people act before they think.
This page covers the whole family under one name, since readers for it that way and the tricks overlap. It does not describe one program or one web address. When we say scam here, we mean messages that fail the tests below; we do not accuse any named business or person.
The Federal Trade Commission describes the pattern in general terms: an unexpected email or text that seems to come from a company you know, claims a problem with an account or a payment, and asks you to confirm personal or financial information or to follow a link to update payment details. A real company, the FTC notes, does not ask for this by email or text.
There are five common forms: the account warning email, the fake receipt or payment email, the real invoice with a scam note, the text message, and the phone call. All five try to move you away from PayPal's own website and app.
The account warning says your account is limited or to be suspended and asks you to log in through a link. Which?, the UK consumer organisation, reported lures of exactly this kind, and noted that scammers can mask the sender address so that the email appears genuine. This masking is called spoofing, and it means a familiar looking sender name proves nothing.
The fake receipt or payment email says you paid a large sum to someone you do not know and gives a number to call to cancel it. There is no real payment; the aim is to start a conversation with a person who then asks for your details.
The real invoice trick is the one that surprises people. PayPal's help centre describes invoice and payment request scams: you receive an invoice or a request for a product or service you never ordered. Because it is sent through PayPal's real system, it can reach you as a genuine PayPal notification. PayPal says the note inside may be alarmist and may ask you to call a fake customer service number.
Warning: Do not pay it and do not call.
How to tell the PayPal phishing scam message is fake
How to stay safe from the one
Open PayPal yourself, in the app or by typing the address, whenever a message mentions your account.
Check Activity before believing that a payment was made, and treat unpaid invoices as unpaid.
Use a password for PayPal that you use nowhere else, and turn on the extra sign in check PayPal offers.
companies only through numbers and sites you know are real.
Report and delete messages you did not expect.
Tap a link or open an attachment in an unexpected PayPal message.
Call a number given in an invoice note or a payment warning.
Read a verification code out to anyone who contacts you.
Install a remote access program because a caller asked.
Send money to a crypto wallet named in an invoice or request.
What is known and what is not
Known: the patterns above are described by the FTC, by PayPal's help centre and by independent reports. Not known to us: how many people are hit now, which sender addresses or pages are active this week, and whether a given message is part of a bigger campaign.
Scam messages change within days, so any list of current fake addresses would be stale as soon as we published it. The tests on this page do not depend on a list: they depend on what the message asks of you.
If you want us to look at a specific web address, use the check tool on this site, and we will report what our server sees from a plain request, which cannot clear a site for every visitor.
Is PayPal phishing scam dangerous? What the senders want
How to tell a real PayPal message from a fake one
The safest test needs no skill: ignore the message and open PayPal yourself, in the app or by typing the address in your browser. If something truly needs your attention, it will also be waiting there.
Which? quotes PayPal's own guidance that PayPal will only ask you to enter your password on its login page, and that if you are worried you should log in and look in the Resolution Center for any notifications.
PayPal's help article on invoice scams gives a second rule: open PayPal yourself and check Activity for a completed payment, which is separate from unpaid invoices and requests that merely sit in your account.
The FTC gives the same question to ask first: do I have an account with this company, or know the person who contacted me? If not, the message is not for you, and you should report it and delete it. If you do have an account, the company using a phone number or website you know is real, never the details in the message.
Looks can mislead in both directions. A message with good spelling and PayPal's colours can be fake, and a clumsy one can occasionally be real. Judge by what the message asks you to do, not by how it looks.
1 Do not use anything in the message Do not tap the link, open the attachment, call the number or . Links and attachments in a phishing message can lead to a fake page or install harmful software, as the FTC warns.
Do not use anything in the message
Do not tap the link, open the attachment, call the number or . Links and attachments in a phishing message can lead to a fake page or install harmful software, as the FTC warns.
2 Open PayPal yourself Use the app you already installed, or type the PayPal address into your browser. Look at your Activity and any notifications or Resolution Center messages there.
Use the app you already installed, or type the PayPal address into your browser. Look at your Activity and any notifications or Resolution Center messages there.
3 Check whether a payment really completed An invoice or request that is only waiting in your account has not taken any money. A completed payment shows in Activity. If you see a payment you did not make, use the help paths inside PayPal to dispute it.
Check whether a payment really completed
An invoice or request that is only waiting in your account has not taken any money. A completed payment shows in Activity. If you see a payment you did not make, use the help paths inside PayPal to dispute it.
4 Use a number you know If you need to speak to someone, find the details inside the PayPal app or website, not in the message.
Use a number you know
If you need to speak to someone, find the details inside the PayPal app or website, not in the message.
The invoice and payment request trick
If PayPal sends you an invoice or a payment request for something you did not buy, do not pay it and do not call any number in its note. Check your Activity yourself and report the request from inside PayPal.
This version is hard because the scammer does not need to fake PayPal at all. They use a real PayPal account, create a real invoice or money request, and put the bait in the note field or in the item description.
PayPal describes the note as alarmist, often with a number to call. A security blog from GridinSoft describes the same pattern and warns that the danger usually lies in that note.
People who call the number reach a person who says the payment must be cancelled or a refund processed. That person may ask for a PayPal verification code, a card number, or ask you to install a remote access program so they can help.
A code sent to your phone by PayPal is meant only for you; anyone who asks you to read it out is trying to enter your account. GridinSoft advises hanging up on such a request, and notes that a fake support call can lead to a malicious download.
PayPal also says never to send a payment to a cryptocurrency wallet that an invoice or payment request names. We do not print any wallet or phone number from such messages here, because they change from case to case and printing them helps nobody.
What we checked for this guide, and what we could not
This guide is a pattern, not one address, so we ran no site test and our server made no request. We read the FTC's phishing advice and used the summaries of PayPal's own help pages and two outside reports.
PayPal phishing scam · desk check · 24 October 2026
FTC phishing advice Read in full on 24 October 2026: signs, what to do after a , and where to report.
PayPal help pages PayPal's pages were not opened directly by us; we relied on the summary of its invoice scam article and its fake email reporting article.
Reporting address for forwarded emails A summary named [email protected]. We could not confirm this on PayPal's own page, so check PayPal's reporting article before you forward anything.
Scale and current campaigns We have no verified count of how many people are hit today and no URLhaus entries for this topic. Do not read the absence as a sign that the scam is rare.
Your message We cannot see it. The tests on this page let you judge it yourself.
A common scam pattern; judge your message by what it asks Any unexpected message that uses PayPal's name to ask for a login, a code, a payment or a call should be treated as a scam until you have checked in PayPal yourself.
When a PayPal phishing message carries malware
Most PayPal phishing only steals what you type, but the FTC warns that a link or an attachment in a phishing message may also install harmful software. If you opened a file or installed something a caller gave you, treat the device as affected.
The common cases are an attached invoice file that you open, a download link on a fake page, and a caller who asks you to install a remote access tool. A remote access tool lets the other person see and control the screen.
It is a normal program in honest hands, which is why a scan may not call it a threat. Check the list of installed apps for anything you did not choose to install.
We name no malware family here, because we found no verified link between this topic and one family. If a scan reports a name, that name on its own and read the vendor's page before you act on a third party's advice.
On Windows the check is in Settings, then Apps, then Installed apps, and in Windows Security under Virus and threat protection. On a phone, remove apps you did not install from the store you trust, and check what has Accessibility or device administrator access.
If you clicked the link or replied
Act in this order: stop, change passwords from a clean device, check PayPal and your bank yourself, scan the device if a file was opened, then report. Speed matters most for the money, so start with the account and the card.
1 You only read it Nothing happened. Delete the message after you report it. Opening a message that you did not act on does not take your money.
Nothing happened. Delete the message after you report it. Opening a message that you did not act on does not take your money.
2 You clicked a link but entered nothing Close the page. Update your security software and run a scan, as the FTC advises for a clicked link, and remove anything it flags.
You clicked a link but entered nothing
Close the page. Update your security software and run a scan, as the FTC advises for a clicked link, and remove anything it flags.
3 You typed your PayPal password Open PayPal yourself, change the password at once, and look at recent Activity and the devices and settings tied to the account. If you reused the password on other sites, change those too, starting with your email.
You typed your PayPal password
Open PayPal yourself, change the password at once, and look at recent Activity and the devices and settings tied to the account. If you reused the password on other sites, change those too, starting with your email.
4 You gave a card or bank number Call your bank or card issuer using the number on the card, tell them what happened and ask them to block or replace the card. The FTC points to IdentityTheft.gov for steps matched to what you lost.
You gave a card or bank number
Call your bank or card issuer using the number on the card, tell them what happened and ask them to block or replace the card. The FTC points to IdentityTheft.gov for steps matched to what you lost.
5 You read out a code or paid PayPal through its app or website straight away, and your bank. A payment you sent voluntarily can be harder to reverse than one taken without your consent, so do not wait.
You read out a code or paid
PayPal through its app or website straight away, and your bank. A payment you sent voluntarily can be harder to reverse than one taken without your consent, so do not wait.
6 You let someone control your computer Disconnect from the internet, remove the remote tool in Settings > Apps > Installed apps, run a full Microsoft Defender scan, and change passwords from another device. If the person saw your banking, warn the bank.
You let someone control your computer
Disconnect from the internet, remove the remote tool in Settings > Apps > Installed apps, run a full Microsoft Defender scan, and change passwords from another device. If the person saw your banking, warn the bank.
What to do after the PayPal phishing scam e-mail
If you only received the message and clicked nothing, step 3 is all you need.
If you clicked the link or typed anything on the page it opened, do every step, starting with the password.
1 Step 1 : Change the password you typed on the fake page If you entered a password after clicking the link in the PayPal phishing scam message, treat that account as known to the sender. Open the provider's real site by typing its address yourself, not through any link in the e-mail, and change the password there. Choose a new one you have never used before, and change it on every other account that shared the old one. Then use the option to sign out of all other sessions or devices, if the provider has one. This works the same in any browser on Windows 11 and Windows 10. Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 1 : Change the password you typed on the fake page
If you entered a password after clicking the link in the PayPal phishing scam message, treat that account as known to the sender.
Open the provider's real site by typing its address yourself, not through any link in the e-mail, and change the password there. Choose a new one you have never used before, and change it on every other account that shared the old one.
Then use the option to sign out of all other sessions or devices, if the provider has one. This works the same in any browser on Windows 11 and Windows 10.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
2 Step 2 : Turn on two-step verification Two-step verification asks for a code from your phone or an authenticator app whenever someone signs in from a new device. A stolen password alone is then not enough to open the mailbox. Turn it on in the security settings of the e-mail account first, then for the bank, shop and social accounts that send their reset links to that address. While you are there, check the recovery e-mail and phone number and the forwarding rules, which attackers sometimes change to keep access. The settings pages look the same on Windows 11 and Windows 10. Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 2 : Turn on two-step verification
Two-step verification asks for a code from your phone or an authenticator app whenever someone signs in from a new device. A stolen password alone is then not enough to open the mailbox.
Turn it on in the security settings of the e-mail account first, then for the bank, shop and social accounts that send their reset links to that address.
While you are there, check the recovery e-mail and phone number and the forwarding rules, which attackers sometimes change to keep access. The settings pages look the same on Windows 11 and Windows 10.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
3 Step 3 : Report the e-mail and delete it Report the message instead of only deleting it. In Outlook choose Report > Report phishing , in Gmail the three-dot > Report phishing ; the provider then blocks the same message for other people. Do not and do not click anything else in it. On a work account, forward it to your IT team as an attachment first. Web mail and the mail apps on Windows 11 and Windows 10 offer the same options. Full procedure with screenshots: Report a phishing e-mail
Step 3 : Report the e-mail and delete it
Report the message instead of only deleting it. In Outlook choose Report > Report phishing , in Gmail the three-dot > Report phishing ; the provider then blocks the same message for other people.
Do not and do not click anything else in it. On a work account, forward it to your IT team as an attachment first. Web mail and the mail apps on Windows 11 and Windows 10 offer the same options.
Full procedure with screenshots: Report a phishing e-mail
4 Step 4 : Scan the PC if you opened a file from the message A page that only asked for a password installs nothing, so most readers can skip this step. If the PayPal phishing scam e-mail or the page it opened made you download or open a file, delete it and run a full scan, then a Microsoft Defender Offline scan. In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options , select Microsoft Defender Antivirus (offline scan) and click Scan now . The PC restarts and the scan takes 15 minutes, so save your work first. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 4 : Scan the PC if you opened a file from the message
A page that only asked for a password installs nothing, so most readers can skip this step.
If the PayPal phishing scam e-mail or the page it opened made you download or open a file, delete it and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options , select Microsoft Defender Antivirus (offline scan) and click Scan now . The PC restarts and the scan takes 15 minutes, so save your work first.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
How to report PayPal phishing scam
How to report a PayPal phishing scam
Report the message to PayPal from inside its own help pages, and to the authorities: the FTC at ReportFraud.ftc.gov for any phishing attempt, the Anti-Phishing Working Group for emails, and 7726 for texts.
The FTC lists three routes:
forward a phishing email to [email protected]
forward a text message to SPAM (7726)
report any attempt at ReportFraud.ftc.gov
Reports help providers block the sender, even though no one will answer you individually.
PayPal has a help article on reporting a fake PayPal email or website. A summary of PayPal's invoice article names [email protected] as the address for suspicious emails, but we could not confirm it on PayPal's page, so use the article's own instructions. For a bad invoice or request, use the report option inside PayPal rather than forwarding it.
Outside the United States, use your own national fraud reporting service. We did not verify those addresses for this guide, so we do not list them.
How to report a PayPal phishing scam
Report the message to PayPal from inside its own help pages, and to the authorities: the FTC at ReportFraud.ftc.gov for any phishing attempt, the Anti-Phishing Working Group for emails, and 7726 for texts.
The FTC lists three routes:
forward a phishing email to [email protected]
forward a text message to SPAM (7726)
report any attempt at ReportFraud.ftc.gov
Reports help providers block the sender, even though no one will answer you individually.
PayPal has a help article on reporting a fake PayPal email or website. A summary of PayPal's invoice article names [email protected] as the address for suspicious emails, but we could not confirm it on PayPal's page, so use the article's own instructions. For a bad invoice or request, use the report option inside PayPal rather than forwarding it.
Outside the United States, use your own national fraud reporting service. We did not verify those addresses for this guide, so we do not list them.
Questions PayPal phishing scam
What is a PayPal phishing scam?
It is a fake message, call or invoice that pretends to come from PayPal so that you give away a password, a card number, a one time code or control of your computer. It can arrive by email, text or phone, and it can even come through PayPal's real invoice system.
The FTC describes the general pattern: an unexpected message an account problem or a payment that asks you to confirm personal or financial details or follow a link. Real companies do not ask for this by email or text.
How do I know if a PayPal email is fake?
Do not judge by looks. Ask whether you expected it, whether it pressures you, whether it uses a generic greeting, and whether it asks you to click a link, open a file, call a number or a code. Then ignore the message and open PayPal yourself, in the app or by typing the address.
Check Activity and the Resolution Center there. Which? notes that scammers can mask the sender address, so a familiar sender name proves nothing. If nothing is waiting inside PayPal, the email was not real.
Is a PayPal invoice I did not expect a scam?
Very likely. PayPal's help centre describes invoice and payment request scams in which you receive a bill for something you never ordered, sometimes with an alarmist note and a fake customer service number. Because the invoice goes through PayPal's real system, it can look genuine.
Do not pay it and do not call the number. Check Activity to see that no payment completed, and report the request from inside PayPal. Never send money to a crypto wallet that an invoice names.
I clicked a link in a PayPal phishing email. What now?
If you only clicked and entered nothing, close the page, update your security software, run a scan and remove anything it flags, as the FTC advises. If you also typed your PayPal password, open PayPal yourself and change it at once, then check Activity.
Change the same password anywhere else you used it, beginning with your email account. If you typed card details, call your bank using the number on the card and ask for a block or a replacement.
Someone called saying they are from PayPal and asked for a code. What should I do?
Hang up. A code that PayPal sends you is meant only for you, and a person who asks you to read it out is trying to sign in as you.
If you already gave it, open PayPal yourself and change your password, then PayPal through its app or website and tell your bank. Do not call back a number the caller gave you. If they asked you to install a program, remove it and run a full scan.
Can a PayPal scam message infect my computer?
Yes, in some cases. The FTC warns that links and attachments in phishing messages may install harmful software, and a fake support caller may ask you to install a remote access tool. Most messages only try to steal what you type.
If you opened a file or installed something, scan with Microsoft Defender, check Settings > Apps > Installed apps for anything you did not choose, and change your passwords from a different device. We know of no single malware family tied to this topic.
Where do I report a PayPal phishing scam?
Use PayPal's own help article for reporting a fake email or website, and the report option inside PayPal for a bad invoice or request.
Beyond that, the FTC says to forward phishing emails to [email protected], forward texts to 7726 and report any attempt at ReportFraud.ftc.gov. Reporting does not bring a personal , but it helps providers block the sender. Outside the United States use your national fraud service.
Should I pay or call the number to cancel a payment I did not make?
No. A payment you did not make will show in your PayPal Activity if it truly happened, and you can dispute it from inside PayPal. A number in an email or invoice note leads to the scammer, not to PayPal.
Calling only starts a conversation designed to get your code, your card or access to your computer. Look at Activity yourself first. If nothing completed, the message was bait.
I do not have a PayPal account but got a PayPal message. Why?
Scammers send the same message to huge lists of addresses and phone numbers and do not know who has an account. This is the FTC's first test: if you have no account with the company, the message is not meant for you, so report it and delete it.
You do not need to take any action in PayPal. Do not click anything, because a link may still lead to a fake page or to harmful software.
Will Fortect remove PayPal phishing scam?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For PayPal phishing scam, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
FTC Consumer Advice: How to recognize and avoid phishing scams ( read October 24, 2026 )
PayPal Help: What are invoice scams and payment request scams on PayPal? ( read October 24, 2026 )
PayPal Help: How do I report a fake PayPal email or website? ( read October 24, 2026 )
Which?: Watch out for these latest PayPal email scams ( read October 24, 2026 )
GridinSoft: PayPal Invoice Scam, fake money requests and support calls ( read October 24, 2026 )
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
