PayPal scams hinge on a single, effective trick: showing you a payment you don't recognise. The instinct to "stop" or "dispute" an unexpected charge is exactly what the scammer is counting on. Whether it arrives by call, text or email, the PayPal scam wants you to act fast and on their terms. This guide explains the patterns and how to check safely.
How the PayPal scam works
There are a few variations, often combined:
- The fake payment notification. You receive an email or text saying you've "sent £600 to [name]" or that a payment is "pending". A panic-inducing number is provided to "cancel" or "dispute" it.
- The fake invoice. A genuine-looking PayPal invoice or money request arrives for something you never bought, with a "if you didn't authorise this, call us" line and a scam phone number.
- The account-limited alert. A smishing text claims your account is "limited" or "suspended" and links to a fake login page that harvests your details.
- The call-back. Once you ring the number in the alert, a convincing "PayPal security" agent walks you through "reversing" the payment - which actually means giving them access or moving your money.
A realistic example:
An email styled like PayPal says: "You sent a payment of £729.99 GBP to TechDirect Ltd. If you did not authorise this transaction, call our dispute team immediately on 0xxx xxx xxxx." There was no payment - but if you ring that number, the "agent" asks you to log into your bank and PayPal "so they can reverse it", or to read out a code. That's how the money actually leaves.
The clever part is that some of these fake invoices and requests are sent through PayPal's genuine system by abusing its money-request features, so the email itself can look authentic. The defence is the same regardless.
Red flags
- An unexpected payment, invoice or money request you don't recognise.
- A phone number in the message urging you to call to "cancel" or "dispute".
- Pressure to act immediately to avoid losing money.
- Requests for your password, one-time codes, or remote access.
- Links to "log in" rather than you navigating to PayPal yourself.
What to do
- Don't call the number in the alert and don't click its links.
- Log into PayPal yourself - open the app or type the address manually - and check your activity. If there's no such payment, the alert was fake.
- Report the message to PayPal by forwarding phishing emails to their official reporting address, and forward scam texts to 7726.
- Never share passwords, one-time codes or card details, and never grant remote access.
- Report it to Action Fraud, and if money actually left your bank or PayPal, contact your bank immediately - see what to do if you've been scammed.
How PayPal really handles disputes
Genuine PayPal alerts appear when you log into your account, and real disputes are managed through the Resolution Centre inside PayPal - not by ringing a number from an email or text. PayPal won't phone you out of the blue demanding codes, won't ask you to install software, and won't tell you to move money to "protect" it. If in doubt, ignore the message entirely and check your account directly.
The bottom line
A PayPal scam is a confidence trick built on a payment that never happened. The single rule that defeats it: never use the contact details in the alert - always log into PayPal yourself to check. If the payment isn't there, delete the message and report it. If it is, handle it through PayPal's own Resolution Centre. Don't let manufactured urgency rush you off your own safe path.
Frequently asked questions
I got a PayPal email about a payment I didn't make - is it real?
Treat it as suspicious. Scammers send fake "payment sent/received" alerts with a phone number to "dispute" it. Don't call that number or click its links - log into PayPal yourself via the app or by typing the address, and check your activity. If the payment isn't there, it's a scam.
Why does the fake PayPal invoice look genuine?
Scammers sometimes abuse PayPal's real money-request and invoice features, so the email can be sent through PayPal's own system and look authentic. The giveaway is the unexpected charge and the "call this number to dispute" prompt. Verify only by logging into your account directly.
Will PayPal call me about suspicious activity?
PayPal won't cold-call demanding one-time codes, passwords or remote access, or tell you to move money to "protect" it. Real issues are handled in the Resolution Centre when you log in. Any call pressuring you to act is a scam.
I called the number and gave details - what should I do?
Contact your bank immediately if any payment was made or you shared card or banking details, change your PayPal password and enable two-step verification, and report it to Action Fraud. See our scammed on the phone guide for the full steps.
