# How to Spot a Fake PayPal Website and Stay Safe Source: https://issitelegit.com/blog/how-to-spot-a-fake-paypal-website-and-stay-safe Published: 2026-11-01 ยท By IsSiteLegit If a message sends you to a PayPal page, do not trust the link. Close it, then open **paypal.com** by typing it yourself or use the official PayPal app. If the message is real, the same news will be in your account. Fake PayPal pages are built to look right at a glance. The address is where they usually slip up. ## Look-alike addresses to watch for Scammers register web addresses that resemble the real one. They count on you reading fast. Here are made-up examples, all on the reserved ending ".example", so none of them are real sites: - **paypa1-login.example** (the letter "l" swapped for the number 1) - **paypal-security-check.example** (the brand name plus extra words) - **paypal.account-verify.example** (the real name sits at the front, but the true site name is the part just before the ending: account-verify.example) - **secure-paypaI.example** (a capital "I" that looks like a lowercase "l") The real site is **paypal.com**. The part that counts is the name right before the ending, and the ending itself. Anything before that is just decoration that anyone can add. ### Free hosting can hide the brand In the phishing links listed by public security feeds on 2026-11-01, 45% were on free website-building or hosting platforms, such as pages.dev and vercel.app. So an address that ends in a platform name, with PayPal only as a prefix, is a warning sign. A company like PayPal uses its own domain for its login page. The same feeds showed no phishing links imitating PayPal on that date. That does not mean PayPal fakes do not exist. It is only a snapshot of one list on one day. ## How to always reach the real PayPal 1. Type **paypal.com** into your browser yourself, or use a bookmark you saved earlier. 2. Or use the official PayPal app, installed from your phone's official app store. 3. Check your account for notices instead of following links in emails, texts or chats. 4. If a message mentions a problem, contact PayPal through the app or site, not through details in the message. Our [guide to checking a link before clicking](https://issitelegit.com/guides/check-a-link-before-clicking) shows how to read an address step by step. You can also see what we show for the real site on our [paypal.com result page](https://issitelegit.com/check/paypal.com). ## What a real payment site would never ask for on a page Here is the general advice that payment companies publish. A genuine page should not ask you to: - Give your password by text, email reply or phone. - Share a one-time code that was sent to you. Codes are for you only. - Install software so someone can "fix" your account. - Send money to a "safe account" or pay by gift card to unlock your account. - Act within a few hours or lose your account forever. Pressure is the main tool of scammers. A real problem can wait while you check it the safe way. ## Other signs of a fake page - You arrived through a link in an unexpected message. - The page asks for your card number, ID or security answers all at once. - The design is slightly off, with odd spelling or blurry logos. Note that good fakes look perfect, so a clean design proves nothing. - The padlock icon is there. This only means the connection is encrypted. Scam sites can have it too. For a wider routine, see [how to check if a website is legit](https://issitelegit.com/guides/how-to-check-if-a-website-is-legit). ## What a check can and can't tell you A tool like ours looks at public signals: how old the domain is, whether it appears on security blacklists, whether the name looks like a known brand, and what the page contains. We show the evidence so you can judge it yourself. There are limits. A brand-new scam site may not be on any list yet, and a clean result is never a guarantee of safety. Use a check as one more piece of information, not as the final word. ## If you already entered details or paid Act quickly but calmly. 1. **Change your password** on the real site (typed in yourself), and on any other site where you used the same one. 2. **Turn on two-step login** if you have not yet. 3. **Check your account** for payments or changes you did not make, and log out other devices if the option exists. 4. **Call your bank or card company** using the number on your card. Tell them what happened and ask about blocking cards or reversing payments. 5. **Run a security scan** on your device if you installed anything. 6. **Report it.** In the US use [reportfraud.ftc.gov](https://reportfraud.ftc.gov). In the UK use [Action Fraud](https://www.actionfraud.police.uk). In Australia use [Scamwatch](https://www.scamwatch.gov.au). Forward phishing emails to the real company too. 7. Watch for follow-up scams. People who fell for one are often targeted again. If you are unsure about a page, you can paste its address into the [IsSiteLegit checker](https://issitelegit.com/) and see the evidence before you enter anything.