Fake PayPal Emails: How to Tell, and What to Do

Fake PayPal emails come in two kinds. Some copy PayPal’s look to send you to a fake login page. Others are real PayPal invoices or money requests sent by scammers, with a fake “customer service number” in the note. Both are easy to spot once you know what PayPal says it does and doesn’t do.

Quick check: paste the sender’s address into Is this PayPal email real?

How PayPal says to spot a fake email

• The greeting. PayPal emails address you by your first and last name, or your business name — not “Dear user” or “Hello PayPal member”.
• The links. Check a link before clicking it: hover over it and read the real address.
• Attachments. Open one only if you’re sure it’s legitimate — be especially careful with invoices from senders you don’t know.
• Urgency. Phishing emails are often alarmist, telling you to update your account immediately.

And two things PayPal says it won’t do: ask for your password anywhere except its own login page, or ask you to share a tracking number by email.

Fake invoices and money requests

PayPal warns about scammers who send invoices or payment requests through PayPal itself — so the email can genuinely come from PayPal while the request is a scam. PayPal’s warning signs:

• A request for something you never bought.
• Alarmist wording pushing you to call quickly.
• A phone number in the note — PayPal calls this the scammer’s “fake customer service number”.
• A request to send money to a cryptocurrency wallet.

What PayPal says to do: don’t pay it, don’t call numbers in the note or open unfamiliar links, log in to PayPal’s website or app yourself to see if anything really needs doing, and report the invoice or request from your PayPal account or app.

Check any PayPal email in three steps

1. Log in yourself. Open the PayPal app or type paypal.com. If the email’s problem, payment or request isn’t in your account, the email is fake.
2. Check the sender. PayPal doesn’t publish a list of its sending addresses, but its own domains include paypal.com. Look-alikes such as paypa1.com or paypal-security.com are not PayPal — the PayPal sender check flags them.
3. Check the headers if you’re still unsure: paste them into the Email Header Analyzer and see whether DMARC passed for a PayPal domain.

If you clicked, logged in or paid

• Entered your PayPal password on a fake page: change it right away from the PayPal app or website, on any other account where you used it too, and turn on two-factor authentication — the general advice from the UK’s NCSC and the FTC. Full steps.
• Paid a fake invoice or sent money: act quickly. If you paid by card or bank transfer, the FTC’s advice is to contact your card issuer or bank immediately and ask them to reverse the payment.

Report it

Forward suspicious emails to phishing@paypal.com, then delete them. Report a fake invoice or money request from inside your PayPal account or app. More places to report: how to report phishing.

More help

• Is this PayPal email real? — check any sender against what PayPal publishes, with look-alike examples.
• How to spot phishing emails — the warning signs and tricks, for any company.
• How to check if an email is real — the headers and DMARC, app by app.
• Clicked a phishing link or gave your password? — what to do, step by step.
• How to report phishing emails — every place worth telling.