PayPal scam text

How to tell

In order. The first one holds even when the rest of the message looks completely real, which is the situation most people are actually in.

1. It asks you for your password, or for your two-factor code.

   PayPal’s own security page says it will never ask you for your password, and that it will never ask you for your two-factor code "over the phone, email or text". There is no real PayPal contact in which handing over either one is the next step. That is why this tell is first: it holds when the message looks exactly right, when you do have an account, and when something genuinely is wrong with it.

2. It gives you a phone number to call.

   PayPal tells customers not to call any number stated in a suspicious invoice or message, and describes scam invoices that carry an alarmist note and a fake customer service number. A number inside a message is evidence of nothing except that someone wanted you to dial it. The only number worth calling is one you find after logging in yourself.

3. It is an invoice or a money request for something you never ordered.

   This variant can arrive through PayPal’s real invoicing system, which means the notification genuinely is from PayPal while the invoice itself was created by a stranger. So "it came from PayPal" does not make the demand real. PayPal’s guidance is not to pay it, not to call anything in it, and to report it by logging in to the site or the app.

4. It opens with a generic greeting.

   PayPal says its authentic messages always use your full name or business name exactly as it appears on your account, so "Dear user" is wrong. This is the weakest tell here, because a scammer who already knows your name can simply use it. Use it to confirm a suspicion, never to clear a message.

What PayPal actually does

A real problem with your account is visible inside the account. Open a new browser window, type paypal.com yourself and log in, or open the PayPal app, and look at your notifications and your activity there. If nothing is waiting for you, nothing was wrong. This is PayPal’s own advice for the password-reset version of the message: do not use the link, open a browser and sign in the way you normally would.

Where to report it

PayPal

Forward the suspicious email to phishing@paypal.com and then delete it, which is the route PayPal asks for on its own help page. Do not open the links or attachments first.

The Federal Trade Commission

Report it at ReportFraud.ftc.gov, which is the FTC’s own reporting site.

Your mobile carrier

Forward the message to 7726, which spells SPAM on a keypad. It is free on every major carrier.