Is PayPal safe? PayPal security practices and tips to protect your account

Is PayPal safe to use?

Yes, PayPal is generally safe to use. PayPal helps protect transactions with encryption, fraud monitoring, and Purchase Protection (also called Buyer Protection) for eligible purchases. It also offers account security features such as two-factor authentication and passkeys, which can reduce the risk of unauthorized access.

Still, using PayPal isn’t completely free of risk. Phishing and social engineering remain common threats. Fraudsters may impersonate PayPal through emails, texts, invoices, search ads, and fake support numbers. They may ask for your password, a one-time security code, bank details, or identity details.

PayPal’s security features are most effective when you practice safe account habits. PayPal may not cover you if you send money to a stranger through the “Sending to a friend” function or enter your password on a fake login page.

PayPal security features that help protect your payments and account

PayPal uses several layers of protection to help secure payments and accounts. Your choices during checkout also affect your level of protection. The existence of PayPal payment security features can lower your risk, but they don’t make every transaction risk free.

Encryption and secure connections

PayPal uses encryption and secure connections to help protect personal and financial information. It encrypts sensitive data when that data is stored and when it moves between your device and PayPal’s servers.

Encryption turns readable data into scrambled text. Only systems with the right key can turn it back into readable data.

PayPal also uses HTTPS and TLS for data in transit. Data in transit means information that moves between your device and PayPal’s servers. These secure connection protocols help confirm that your device connects to a real PayPal server. They also help stop other parties on the network from reading your sensitive information.

On mobile devices, PayPal uses key pinning. Key pinning helps the PayPal app confirm that it has connected to a verified PayPal server. It makes it harder for an impostor server to intercept traffic between the app and PayPal.

For stored data, PayPal uses automatic encryption, but it doesn’t specify the exact encryption type in its public documentation. Many services use AES encryption to protect stored data, but PayPal doesn’t publicly confirm that it uses this method.

PayPal also limits what information sellers can see. When you pay with PayPal, the seller doesn’t receive your full card or bank account details. Paying through PayPal helps keep your financial details from going directly to the websites where you shop.

Fraud monitoring and early fraud alerts

PayPal uses fraud detection technology to help you spot suspicious activity and protect your account and financial information. If you add an eligible card to your PayPal Wallet, you may also receive early fraud alerts.

PayPal email verification and phishing reports

PayPal sends email notifications when you send or receive payments. These alerts can help you notice account activity you don’t recognize.

PayPal also gives users a direct way to report suspicious emails. If you receive a message that appears to come from PayPal but looks suspicious, you can forward it to phishing@paypal.com so PayPal can investigate.

Some inboxes may show PayPal’s logo or a verification mark next to authentic PayPal emails. Many email providers support logo-based verification through BIMI, or Brand Indicators for Message Identification. BIMI helps companies display verified brand logos in email inboxes.

How to verify a PayPal email

Brand logos can make legitimate PayPal emails easier to recognize, but they don’t prove that every message is safe. Scammers can still use copied branding, fake display names, and lookalike domains.

You can check a PayPal email with these steps:

• Check the sending domain carefully. Real PayPal emails should come from a PayPal-controlled domain, such as paypal.com. Scam domains often add extra words, misspell the name, or swap in characters that are hard to tell apart, so a close look won’t always catch them. If you’re unsure, open the PayPal app or type paypal.com into your browser instead of clicking links in the email.
• Don’t trust the display name alone. A scam email can show “PayPal” as the sender name even if the real email address is paypal-security@gmail.com or service@paypaI-support.com. Open the sender details to check the full email address.
• Check links before you click. On desktop, hover over a link to preview the URL. On mobile, press and hold the link to preview it. The link should point to paypal.com, not a lookalike website.
• Watch for language with an urgent tone. Scammers often claim your account will close, a payment will process, or access will be blocked unless you act fast.
• Be careful with attachments. PayPal doesn’t need you to open an unexpected file to fix your account.
• Look for generic greetings. PayPal always addresses you by your first and last name or your business name, so treat “Dear customer” or “Dear [your email address]” as a warning sign.

Prepaid cards and reduced payment exposure

PayPal discontinued the PayPal Prepaid Mastercard program on April 30, 2026, but you can still link eligible prepaid cards from other services to your PayPal Wallet. Once linked, you can use those cards through your PayPal Wallet at merchants that accept PayPal.

A prepaid card can limit potential loss during online shopping. If a scammer steals the card number, they can typically spend only the money loaded onto that card. The prepaid card number alone shouldn’t give them direct access to your bank account.

A prepaid card doesn’t make a risky website safe, though. If you enter the card details on a fake checkout page, the scammer can still steal and use them.

Two-factor authentication and passkeys

Two-factor authentication, or 2FA, adds a second check to your PayPal login. PayPal calls this feature “2-step verification.” Instead of using only a password, you also confirm your identity with a method tied to your device.

PayPal lets you set up 2-step verification with an authenticator app, such as Google Authenticator or Microsoft Authenticator. You can set up this feature only through a web browser.

Authenticator apps usually offer stronger security than SMS codes. Scammers can use SIM-swapping to take control of your registered phone number. SIM-swapping happens when a criminal tricks a mobile carrier into moving your number to a SIM card they control.

PayPal also supports passkeys. A passkey lets you log in with the fingerprint, face scan, PIN, or device password you use to unlock your device. Passkeys can reduce phishing risk because you don’t type a reusable password into a website.

To turn on 2-step verification in PayPal:

1. 1. Log in to PayPal from a web browser.
2. 2. Select the “Settings” icon next to “Log out.”
3. 3. Select “Security.”
4. 4. Select “Set up” next to “2-step verification.”
5. 5. Choose “Use an authenticator app.”
6. 6. Select “Set it up.”
7. 7. Follow the steps on the screen.

3D Secure and Purchase Protection

3D Secure, or 3DS, is an extra security check for some online card payments. It helps validate card transactions and confirm the buyer’s identity before the payment goes through. You may see it under names such as Visa Secure, Mastercard Identity Check, American Express SafeKey, or a general 3D Secure prompt.

The exact check depends on your card issuer. You may need to enter a one-time code, approve the payment in your banking app, answer a security question, or confirm the purchase another way. In most cases, you don’t need to turn on 3D Secure yourself because many major card issuers build it into their payment process.

While 3D Secure helps confirm the payment, PayPal Purchase Protection (also called Buyer Protection) may help after an eligible purchase goes wrong. PayPal says you may qualify for a refund if you pay for an eligible item through your PayPal account and the item doesn’t arrive or is significantly different from the seller’s description.

Purchase Protection terms include eligibility rules, dispute timeframes, and return requirements. PayPal may ask you to return the item as part of the claim process, and the program doesn’t cover return shipping costs. Open a dispute within the required window, and keep records such as receipts, tracking details, seller messages, and product photos.

PayPal payment security: What is and isn’t covered

PayPal payment security depends in part on the payment type you choose. PayPal asks you to choose between a personal payment to a friend or family member, labeled “Sending to a friend,” and a purchase for goods and services, labeled “Paying for an item or service.”

Choose “Paying for an item or service” when you buy from a business, marketplace seller, or person you don’t know well. Eligible purchases made through this payment type may qualify for PayPal Purchase Protection if the item doesn’t arrive or is significantly different from the seller’s description.

Choose “Sending to a friend” only for people you know and trust. PayPal Purchase Protection doesn’t cover personal payments to friends and family. Scammers often ask targets to use this option because they know you’ll have fewer options if the purchase turns out to be fake.

PayPal’s Buyer Protection program also has exclusions. It doesn’t cover certain purchases, including real estate, vehicles, businesses, industrial machinery, investments, NFTs, donations, gambling-related payments, gift cards, prepaid cards, cash-like payments, and items intended for resale.

In-person payment coverage depends on the payment type and claim reason. Purchases made with a PayPal goods and services QR code may be eligible for Purchase Protection, but not every QR code payment or in-person payment qualifies. Check PayPal’s current Purchase Protection terms before relying on coverage.

Disclaimer: The information in this table has been checked against PayPal’s official Purchase Protection terms and support pages. It’s accurate as of September 25, 2026, but PayPal may update its policies, eligibility rules, and dispute processes. Check PayPal’s current terms before relying on coverage.

Common PayPal scams and security alerts to watch for

Scammers exploit PayPal’s trusted name to push people into quick decisions. They send fake alerts, phishing emails, bogus invoice requests, overpayment claims, and phony “you’ve been paid” messages to make targets click links, share login details, or send money.

A PayPal security alert text can be real, but scammers often copy PayPal’s wording. Treat every unexpected message as unverified until you check your account through the PayPal app or by typing paypal.com into your browser.

Below are the most common PayPal scams to watch for.

Fake PayPal security code texts and alerts

A fake PayPal security code text may claim that PayPal detected a login, blocked a payment, or needs you to verify your account. The message may include a link or ask you to reply with a one-time code.

A real PayPal security code usually arrives after you start a login, payment, or account security action. Never share a PayPal security code with another person. PayPal support won’t ask for a one-time code through text, email, or phone.

If you receive a suspicious code, don’t click the link or reply. Open PayPal through the official app or type paypal.com into your browser. Check your account activity and change your password if you see an unfamiliar login or transaction.

Phishing emails and spoofed login pages

Phishing emails try to make you share your PayPal login details. Spoofed websites copy PayPal’s branding, layout, and login forms to look real. If you enter your credentials on a fake page, the scammer can use them to access your account.

Use this quick checklist before you click a suspicious link or open an attachment:

• Check the sender domain. Real PayPal emails should come from a PayPal-controlled domain, such as paypal.com.
• Don’t trust the sender name alone. Scammers can make the sender name look like “PayPal” even when the email address is fake.
• Watch for generic greetings. Lines like “Dear customer” can signal that the sender doesn’t know your name.
• Preview links before you click. On desktop, hover over a button or link to see the real destination. On mobile, press and hold the link to preview it.
• Look for typos, odd formatting, or wording that doesn’t sound like PayPal. AI tools can make scam emails more polished, so don’t rely on spelling mistakes alone.
• Be suspicious of threats or deadlines. Scammers may claim PayPal will close your account unless you act right away.
• Don’t open files from unexpected PayPal messages. Attachments can contain malware or lead to fake login pages.

Does PayPal ask for your Social Security number?

Yes, PayPal may ask for your Social Security number, or SSN, in limited legitimate cases in the US. PayPal may need it when you set up certain accounts, verify your identity, confirm your taxpayer status, or meet tax reporting requirements.

PayPal may also ask for a Taxpayer Identification Number, or TIN, if you receive payments for goods or services. A TIN can be an SSN, Employer Identification Number, or Individual Taxpayer Identification Number. PayPal reports payment activity to the IRS and provides tax documents in certain situations.

PayPal won’t ask you to send your full SSN through an unsolicited email or text message. Treat messages that ask for your SSN outside your PayPal account as warning signs. If you have shared your SSN with a scammer, read our guide on what to do if someone has your Social Security number.

What to do if your PayPal account gets hacked

A PayPal account security breach doesn’t always mean that PayPal’s systems were breached. Account takeovers can happen when attackers reuse passwords exposed in another data leak. Criminals may also use credential stuffing, which means they try leaked usernames and passwords across many websites.

If you suspect a PayPal security breach, take these steps:

1. 1. Change your PayPal password. Use a strong password that you don’t use on other websites.
2. 2. Change the password for your linked email account. Change it if you reused the same password for PayPal and email.
3. 3. Check whether your PayPal-linked email address appeared in a public breach. Use a reputable tool, such as Have I Been Pwned, to search your email address. If your email appears in a breach, change reused passwords across affected accounts.
4. 4. Turn on two-factor authentication. Choose an authenticator app or passkey if PayPal offers that option in your account.
5. 5. Review recent transactions. Check your PayPal activity for payments, transfers, refunds, or account changes you don’t recognize.
6. 6. Report unauthorized activity through PayPal. Use the Resolution Center, select “Report a problem,” choose the payment, and follow the prompts.
7. 7. Remove unfamiliar payment methods and account connections. Check linked cards, bank accounts, authorized apps, and trusted devices. Remove entries you don’t recognize.
8. 8. Contact your bank or card issuer. Ask them to block or monitor the affected payment method if your financial details may have been exposed.
9. 9. Report the incident if you have lost money. In the US, you can file a report with the FTC or the FBI’s Internet Crime Complaint Center.

PayPal security phone number and support contacts

If you need to contact PayPal about a security issue, log in to your PayPal account and use the official “Contact us” page or PayPal Assistant in the app or at paypal.com. PayPal Assistant can answer questions, open a chat, or offer phone support when that option is available.

Be careful when you search for a PayPal security team phone number. Scammers create fake support pages and search ads that show fraudulent “customer service” numbers. If you call one, the scammer may ask for your password, one-time security code, remote access to your device, or payment to “fix” your account.

Don’t trust phone numbers from search ads, forum posts, unsolicited texts, or emails. If you need to call PayPal, confirm the number after logging in to your PayPal account or checking PayPal’s official site. Never share your password or one-time security code with someone who claims to work for PayPal.

How to secure your PayPal account: A checklist

PayPal security measures in 2026 work best when you combine built-in tools with safer account habits. Use this checklist to reduce your risk:

• Use a strong, unique password for PayPal.

• Turn on two-factor authentication or use a passkey.

• Keep your device, browser, and PayPal app updated.

• Use NordVPN’s next-gen antivirus to help block risky domains and scan downloaded files for viruses.

• Review your PayPal activity often and report unfamiliar transactions.

• Consider linking a credit card because credit cards are generally safer and may offer stronger dispute options than debit cards.

• Use a VPN on public or shared Wi-Fi, but don’t rely on it to stop phishing. Public Wi-Fi security can be weak, so avoid logging in to financial accounts on these networks when possible.

• Delete your PayPal account if you no longer use it.

Disclaimer: PayPal is a registered trademark of PayPal, Inc. NordVPN is not affiliated with, sponsored by, or endorsed by PayPal, Inc.