How to help protect your business from phishing and spoofing attempts.
It’s not always easy to spot a scammer, especially when they disguise themselves as a reputable brand.
When scammers make communications look, feel, and sound like the reputable organization they’re impersonating, it’s known as spoofing. Phishing is an attempt to gain access to your sensitive data via fake emails, websites, text messages, or voicemails. Here are a few things to watch out for, to help make sure you don’t fall for these types of scams.
1. Fake emails. One of the most common phishing scams involves sending an email that claims to be from a well-known company — like PayPal. The emails may ask you to:
Tip: Use caution if you get an unexpected payment notification via email. Always verify every payment notification by logging in to your PayPal account and locating the corresponding transaction. All transactions (even pending ones) sent by you, or to you, will show up in your transaction history.
2. Fake websites. A fake website usually works in tandem with a fake email. A link in the email takes you to a site that looks legitimate, and asks you for your password, credit or bank information and/or SSN. These are the red flags of a fake website:
3. Fake text messages. Fake text messages, also known as smishing, are when a cyber criminal is phishing using SMS. You receive an urgent text message with a fake phone number or URL that looks like this:
“Your PayPal account has been suspended due to suspicious activity. Please contact us immediately at 1-408-123-4567. It is imperative that we speak to you as soon as possible.”
If you call the number, you’re confirming you have a PayPal account, and the scammer will ask for your account information.
Scammers may also use a fake link instead of a phone number.
4. Fake voicemails. Fake voicemails, also known as vishing, are when a scammer uses an automated system to make voice calls. Typically, the calls mention an “urgent account problem” and ask you to share account information to remedy it. An example of a vishing attempt is:
“This is PayPal calling about a possible fraudulent transaction on your account. Please enter your PIN now to hear the transaction details.”
When you enter your PIN, the scammer gets the key they need to access your account.
Never provide any account information unless you initiated the phone call. Caller IDs are also easily tricked, so don’t rely on them to verify the call is authentic.
How to protect yourself from phishing and spoofing.
If you think you’ve clicked a bad link, close out of it immediately, run an antivirus check, and then change your password and security questions. Remember, it’s important you run an antivirus check first because you might’ve gotten malware from clicking the link, and the malware can still pick up your new password.
Then, contact your bank or card issuer and explain the situation. Make sure to review your transaction history over the next few weeks to ensure there are no unauthorized transactions on your account, and if there are, report them immediately.
Seems phishy?
If you receive an email that you believe could be phishing, don’t respond in any way and also don’t click any links or open any attachments. Instead, simply forward the email to spoof@paypal.com. In order to investigate the email just as you received it, we ask that you don’t change the subject line or send the suspicious email as an attachment. After forwarding to us, delete the email from your account so that there’s no further threat to you.
How do you know when the communication you’ve received is actually from PayPal?
Be assured that we will never send a request for information via email. Instead, we direct account holders to log in to their account and visit the Resolution Center. You know you’re working on the real PayPal site when the URL is https://www.paypal.com.
Additional tools.
In addition, to help prevent a cyber criminal from using phished information in a transaction with your business, the following tools are available through PayPal and other fraud management vendors:
No matter how vigilant you are, inevitably, you will let down your guard and be tempted to click an unsecure link. To help protect you while you browse (and take away some of the stress), there are several site safety rating tools1 available:
We want to help keep your information secure, and alerting us to possible scam attempts helps protect the PayPal community.
You can also access additional information on online security here or by reviewing our FAQs at the bottom of this page.
1. Fake emails. One of the most common phishing scams involves sending an email that claims to be from a well-known company — like PayPal. The emails may ask you to:
- Visit a fake or "spoof" website
- Call a fake customer service number
- Open attachments that install malicious software on your computer when opened or
- Open attachments you didn’t request
- Start with a generic greeting instead of your name
- Have poor grammar or many typos
- Create a sense of urgency or;
- Ask for personal information like credit or debit card numbers, bank account information, driver’s license number, passwords or your full name. PayPal will never ask for sensitive information in an email.
Tip: Use caution if you get an unexpected payment notification via email. Always verify every payment notification by logging in to your PayPal account and locating the corresponding transaction. All transactions (even pending ones) sent by you, or to you, will show up in your transaction history.
2. Fake websites. A fake website usually works in tandem with a fake email. A link in the email takes you to a site that looks legitimate, and asks you for your password, credit or bank information and/or SSN. These are the red flags of a fake website:
- The URL includes non-secure links. To know if it’s a secure link, check that the URL begins with ‘https’, like in this one: https://www.paypal.com/us. Also look for the "lock" symbol that appears in the address bar or the lower right-hand corner of your browser. This symbol indicates you’re on a secure site.
- The URL directs to a completely different website.
3. Fake text messages. Fake text messages, also known as smishing, are when a cyber criminal is phishing using SMS. You receive an urgent text message with a fake phone number or URL that looks like this:
“Your PayPal account has been suspended due to suspicious activity. Please contact us immediately at 1-408-123-4567. It is imperative that we speak to you as soon as possible.”
If you call the number, you’re confirming you have a PayPal account, and the scammer will ask for your account information.
Scammers may also use a fake link instead of a phone number.
4. Fake voicemails. Fake voicemails, also known as vishing, are when a scammer uses an automated system to make voice calls. Typically, the calls mention an “urgent account problem” and ask you to share account information to remedy it. An example of a vishing attempt is:
“This is PayPal calling about a possible fraudulent transaction on your account. Please enter your PIN now to hear the transaction details.”
When you enter your PIN, the scammer gets the key they need to access your account.
Never provide any account information unless you initiated the phone call. Caller IDs are also easily tricked, so don’t rely on them to verify the call is authentic.
How to protect yourself from phishing and spoofing.
If you think you’ve clicked a bad link, close out of it immediately, run an antivirus check, and then change your password and security questions. Remember, it’s important you run an antivirus check first because you might’ve gotten malware from clicking the link, and the malware can still pick up your new password.
Then, contact your bank or card issuer and explain the situation. Make sure to review your transaction history over the next few weeks to ensure there are no unauthorized transactions on your account, and if there are, report them immediately.
Seems phishy?
If you receive an email that you believe could be phishing, don’t respond in any way and also don’t click any links or open any attachments. Instead, simply forward the email to spoof@paypal.com. In order to investigate the email just as you received it, we ask that you don’t change the subject line or send the suspicious email as an attachment. After forwarding to us, delete the email from your account so that there’s no further threat to you.
How do you know when the communication you’ve received is actually from PayPal?
Be assured that we will never send a request for information via email. Instead, we direct account holders to log in to their account and visit the Resolution Center. You know you’re working on the real PayPal site when the URL is https://www.paypal.com.
Additional tools.
In addition, to help prevent a cyber criminal from using phished information in a transaction with your business, the following tools are available through PayPal and other fraud management vendors:
- Address Verification Service (AVS). Use AVS to verify if the billing address matches the one the card issuer has on file.
- Card Security Code (CSC). The CSC is the three- or four-digit number located on the back of the card that confirms the customer has the card in their possession.
- Bank Identification Number (BIN). The first six numbers listed on a card are known as the BIN and identify the financial institution that issued the card.
- IP geolocation. IP geolocation pinpoints the location of the computer used for the transaction; checking the geolocation details against the billing and shipping address your customer provided can flag possibly fraudulent transactions.
No matter how vigilant you are, inevitably, you will let down your guard and be tempted to click an unsecure link. To help protect you while you browse (and take away some of the stress), there are several site safety rating tools1 available:
- SiteAdvisor.com
- MyWOT.com
- Safeweb.Norton.com
We want to help keep your information secure, and alerting us to possible scam attempts helps protect the PayPal community.
You can also access additional information on online security here or by reviewing our FAQs at the bottom of this page.
1 These products aren’t affiliated with PayPal and may require additional costs.
Frequently asked questions.
Having a secure, unique password for each of your online accounts is critically important. If a scammer gets just one password, they can begin to access your other accounts. That’s why it’s important to have a strong, unique password for your PayPal login.
A strong password should have the following characteristics:
• More than 8 characters long.
• Use lower case, upper case, a number, and a special character [like ~!@#$%^&*()_+=?><.,/].
• Not a word or date associated with you (like a pet’s name, family names, or birth dates).
• A combination of words with unusual capitalization, numbers, and special characters interspersed. Misspelled words are stronger because they are not in the dictionary used by attackers.
• Something you can remember.
How often should I change my password?
Normally, there should be no reason to change your password or PIN. But there are a few cases where it's a good precaution. For example:
• You notice something suspicious on your PayPal account.
• You suspect that someone you don’t trust has your password.
• You notice something suspicious in your email account or other online accounts.
• You have recently removed malware from your system.
• PayPal asks you to change your password.
If one of these occurs, change your Password, PIN, and security questions immediately. You can change these under personal settings.
If you receive an email asking you to change your password, it could be a case of phishing. Instead of clicking on a suspect link in an email, just log into your PayPal account by manually typing the URL. Click the Settings tab, and then Personal Info. You will find the password, security questions, and PIN (if you've set one up) on this page.
A strong password should have the following characteristics:
• More than 8 characters long.
• Use lower case, upper case, a number, and a special character [like ~!@#$%^&*()_+=?><.,/].
• Not a word or date associated with you (like a pet’s name, family names, or birth dates).
• A combination of words with unusual capitalization, numbers, and special characters interspersed. Misspelled words are stronger because they are not in the dictionary used by attackers.
• Something you can remember.
How often should I change my password?
Normally, there should be no reason to change your password or PIN. But there are a few cases where it's a good precaution. For example:
• You notice something suspicious on your PayPal account.
• You suspect that someone you don’t trust has your password.
• You notice something suspicious in your email account or other online accounts.
• You have recently removed malware from your system.
• PayPal asks you to change your password.
If one of these occurs, change your Password, PIN, and security questions immediately. You can change these under personal settings.
If you receive an email asking you to change your password, it could be a case of phishing. Instead of clicking on a suspect link in an email, just log into your PayPal account by manually typing the URL. Click the Settings tab, and then Personal Info. You will find the password, security questions, and PIN (if you've set one up) on this page.
You may be receiving emails from us because a PayPal account has been registered with your email.
Someone may have mistakenly added it to their account when they signed up, either mistyping it or intentionally entering an email that wasn’t theirs.
Or it was recycled by a domain provider like Gmail, Hotmail, etc. If you have an email account and stop using it for a while, the domain provider can reissue the email address to the public and allow it to be used again by someone else.
If you don’t have a PayPal account and have received emails from us click here and we’ll show you how to report it. For all other questions, you can message us.
How do I know the email is genuinely from PayPal and not a spoof email?
• Generic Greetings
Be wary of impersonal greetings like “Dear User”, or your email address. A legitimate PayPal email will always greet you by your first and last name.
• Typos/Poor Grammar
Emails sent by popular companies are almost always free of misspellings and grammatical errors.
• False Sense of Urgency
Many scam emails tell you that your account will be in jeopardy if something critical is not updated right away.
• Request for financial/personal information
We never send emails asking you for your bank account number, debit or credit card number or any personal details like your date of birth or social security number.
• Attachments
A real email from PayPal will never include attachments. You should never open an attachment unless you are 100% sure it’s legitimate, because they can contain spyware or viruses.
For more information about email phishing, check our Security page.
Someone may have mistakenly added it to their account when they signed up, either mistyping it or intentionally entering an email that wasn’t theirs.
Or it was recycled by a domain provider like Gmail, Hotmail, etc. If you have an email account and stop using it for a while, the domain provider can reissue the email address to the public and allow it to be used again by someone else.
If you don’t have a PayPal account and have received emails from us click here and we’ll show you how to report it. For all other questions, you can message us.
How do I know the email is genuinely from PayPal and not a spoof email?
• Generic Greetings
Be wary of impersonal greetings like “Dear User”, or your email address. A legitimate PayPal email will always greet you by your first and last name.
• Typos/Poor Grammar
Emails sent by popular companies are almost always free of misspellings and grammatical errors.
• False Sense of Urgency
Many scam emails tell you that your account will be in jeopardy if something critical is not updated right away.
• Request for financial/personal information
We never send emails asking you for your bank account number, debit or credit card number or any personal details like your date of birth or social security number.
• Attachments
A real email from PayPal will never include attachments. You should never open an attachment unless you are 100% sure it’s legitimate, because they can contain spyware or viruses.
For more information about email phishing, check our Security page.
PayPal approves transactions for the following AVS codes:
- Domestic transactions: A, W, X, Y, Z, B, D, P, M, F
- On international transactions PayPal will only deny: N, E
You can view the last month of debit card activity from your PayPal transaction Summary page. If you’d like to see all your PayPal payments, or more than the last month of activity, you can view those from your PayPal Cash Plus account Activity. You can also print your statements by selecting Statements, located in the top right corner of your transaction list on the Activity page.
Withdrawal statuses:
Withdrawal statuses:
- Pending - A debit card purchase can be Pending because of these reasons:
- It takes between 1-7 days for funds to move from your PayPal Cash Plus account to the merchant.
- The merchant uses the hold as an authorization as is the case when you check into a hotel.
- The merchant (typically gas stations) will send out a small funds inquiry to make sure that you have the funds available. Check back in a few days as the "Pending" status will likely change to either "expired” or “completed”. See expired and completed status definitions below.
- Placed - A temporary hold has been placed on the funds in your account for a purchase. This expires when the payment is completed.
- Completed - Your debit card purchase is completed.
- Debit Card Credit Received - This means the merchant has issued you a refund. The funds have credited to your PayPal Cash Plus balance.
- Expired – This appears 5 days after the authorization was initiated. If the merchant has not collected the funds the funds are released back into your PayPal Cash Plus balance. The authorization is still available for the merchant to capture the funds and complete the transaction.
- Canceled Transfer – This is found in the details of the expired authorization. The merchant did not collect the funds within 4 days. At this time, any money that was placed on hold is credited back to your PayPal Cash Plus balance. The merchant can still collect those funds at any time.
We’ll use cookies to improve and customize your experience if you continue to browse. Is it OK if we also use cookies to show you personalized ads? Learn more and manage your cookies