PayPal Account Hacked? What to Do Right Now, Step by Step

If your PayPal account was hacked, secure the email account linked to it first, then sign in to PayPal by typing the address yourself or opening the official app, change your password, turn on two-step verification or a passkey, and check your activity, linked bank accounts, cards, email addresses and automatic payments. Report any payment you didn’t make through PayPal’s own help or resolution pages as soon as you can, and call your bank if a linked account or card was used.

Speed matters with PayPal more than with most accounts, because money can move quickly and reporting promptly usually improves your position. Here is the order to work in. If other payment apps were affected too, see our guides to a hacked Venmo or Cash App account.

Signs your PayPal account was compromised

• Payments you didn’t send, often to unfamiliar individuals or merchants, sometimes in small amounts first.
• Emails from PayPal about a changed password, email, phone or new device you didn’t make.
• A new bank account or card linked, or one of yours removed.
• New automatic payments or subscriptions you didn’t set up.
• Your password stops working, or verification codes arrive that you didn’t request.
• Withdrawals from your PayPal balance to a bank you don’t recognize.

Before you act on an email or text, check it’s genuine. Fake PayPal messages are one of the most common phishing lures. A popular version is a real-looking PayPal invoice or money request for a purchase you never made, with a “support” phone number in the note. The invoice can come from PayPal’s real system, but the number belongs to the scammer. Don’t call it and don’t pay it.

Step 1: Secure your email first

Whoever controls your email can reset your PayPal password. If your inbox might be compromised, fix it before touching PayPal:

1. Change the email password to a new, unique one.
2. Turn on two-step verification or a passkey on the email account.
3. Sign out of other sessions, and remove forwarding rules or filters you didn’t create, especially ones that hide messages from PayPal or your bank.

Our guide on what to do when an email account is hacked covers this in detail for all the major providers.

Step 2: Take back and lock down PayPal

If you can still sign in, go to your PayPal security settings.

1. Change your password to a long, unique one that you’ve never used before.
2. Check your email addresses and phone numbers. Remove any you don’t recognize and make sure your own are set as primary.
3. Turn on two-step verification or add a passkey. An authenticator app or passkey is harder to phish than a text-message code.
4. Sign out of other devices and remove any remembered devices you don’t own, if your settings show them.
5. Update security questions if your account still uses them, with answers an attacker couldn’t guess or look up.

If you can’t sign in, use the “forgot password” or “having trouble logging in” option on PayPal’s sign-in page. If the attacker changed your email and phone, contact PayPal through the help center on its official site or app and explain that your account was taken over. They’ll verify your identity before restoring access. Recovery through PayPal is free.

Step 3: Check money, links and permissions

Once you’re in, go through every area an attacker could use.

Area	What to check	What to do
Activity	Payments, transfers and withdrawals you didn’t make	Note dates, amounts and transaction IDs; report each one
Linked banks and cards	New accounts or cards; any of yours removed	Remove unknown ones; tell your bank about any of yours that were used
Automatic payments	Merchants with permission to charge you that you didn’t approve	Cancel them in your payment settings
Profile details	Changed address, name, email or phone	Restore your own details
Connected apps and sites	Services logged in with PayPal that you don’t use	Remove their access
Business settings	If you have a business account: team users, API credentials, payout settings	Remove unknown users; reset credentials

Screenshot each unauthorized transaction before you do anything else. It helps when you report and when you talk to your bank.

Step 4: Report unauthorized transactions quickly

Report every payment you didn’t make through PayPal’s own reporting route, which you can reach from the help or resolution section of the site or app. Choose the option for unauthorized activity, not a dispute with a seller. They are different processes: unauthorized activity means you didn’t make the payment at all, while a dispute is about a purchase you did make that went wrong.

Report as soon as you notice. PayPal’s user agreement sets out how unauthorized transactions are handled and the time limits for reporting them, and in the US, federal rules on electronic fund transfers generally favor people who report quickly. Waiting can reduce your protection.

Then call your bank or card issuer, using the number on the back of your card or your bank’s official app. Tell them which PayPal-related charges or transfers you didn’t authorize. Ask whether to replace the card and whether they recommend extra monitoring on the account.

Step 5: Look beyond PayPal

A hacked PayPal account often means a password was stolen somewhere else, or your email or phone was compromised.

• Change the old password everywhere you used it, especially email, banking and shopping accounts.
• Check for other account takeovers. Our guide on what to do when an account was hacked covers the general checklist, and there’s a separate guide if your Amazon account was hacked.
• Watch for misuse of your identity. A PayPal profile holds your name, address, phone, and sometimes date of birth and partial bank details. If you see new accounts opened in your name or other signs of identity misuse, report it at IdentityTheft.gov, the FTC’s official site, and consider a free credit freeze with each of the three major credit bureaus. Our guide to identity theft recovery covers the full sequence.

A worked example

This scenario is illustrative, not a real client. Tom, a freelance designer, gets paid through PayPal. One morning his bank app shows a transfer to PayPal he didn’t start, and PayPal shows a payment to a stranger.

1. He opens his email provider directly and finds a filter he didn’t create, moving anything from PayPal to trash. He deletes it, changes his email password and turns on two-step verification.
2. He opens the PayPal app, changes his password, and finds a new email address added to his profile. He removes it.
3. Under automatic payments he finds a merchant he’s never heard of and cancels it.
4. He reports the payment as unauthorized through the PayPal app’s help section, not as a seller dispute, and includes the screenshots.
5. He calls his bank using the number on its app, reports the transfer and asks them to watch the account. He turns on passkeys for both PayPal and email.

The filter was the reason he hadn’t noticed sooner. Without checking his email first, the attacker could have kept hiding PayPal’s security alerts from him.

Common mistakes

• Calling the number on a fake invoice. This is the most common way people lose money after a PayPal scare.
• Filing a seller dispute for an unauthorized payment. Use the unauthorized-activity route so it’s handled correctly.
• Leaving linked banks and automatic payments unchecked. These let an attacker keep taking money after you change your password.
• Waiting to report. Delays can reduce your protection under PayPal’s terms and your bank’s.
• Paying a recovery service. PayPal recovery is free and only happens through PayPal. Anyone offering to recover your account or your money for a fee is almost always running a second scam.

How to keep PayPal secure

• Use a unique password and a password manager.
• Keep two-step verification or a passkey on.
• Turn on notifications for every payment so you see unusual activity immediately.
• Review automatic payments and linked accounts a few times a year.
• Protect your phone number with your carrier’s account PIN and port-out protection, since text codes go to it. Our guide on what to do if your phone has been hacked explains how.

If a takeover leads to messages, fake listings or complaints tied to your name, our personal reputation management team can help with cleanup and removal requests where the platform’s rules allow.

Frequently asked questions

How do I contact PayPal if my account was hacked?

Open the official PayPal app or type PayPal’s web address yourself, then use the help center to report unauthorized activity or get help logging in. Don’t use numbers from emails, invoices, texts or search ads.

Will PayPal refund money a hacker sent?

It depends on the circumstances and PayPal’s user agreement. Report the unauthorized payments through PayPal as quickly as possible, tell your bank about any linked account or card that was used, and keep screenshots and transaction IDs.

Is a PayPal invoice for something I didn't buy a sign I've been hacked?

Not usually. Scammers can send real PayPal invoices or money requests to anyone. Don’t pay it and don’t call the number in it. Sign in to PayPal directly: if nothing has changed in your account, it’s most likely a scam invoice, which you can report through PayPal.

Should I close my PayPal account after it was hacked?

Not until any unauthorized transactions are reported and resolved. Closing too early can make disputes harder. Once it’s secure and settled, close it if you no longer need it.