# PayPal Scam Texts, Emails and Calls: How to Spot Fake Ones Source: https://issitelegit.com/blog/paypal-scam-texts-emails-and-calls-how-to-spot-fake-ones Published: 2026-11-02 ยท By IsSiteLegit If a message says it is from PayPal and pushes you to act fast, do not tap the link or call the number in it. Open the official PayPal app, or type **paypal.com** into your browser yourself, and look for the same alert there. If nothing is there, the message was almost certainly fake. ## What fake PayPal messages usually say Scammers copy the tone of a real company. The wording changes, but the story is usually one of these: - **Account locked or limited.** "We noticed unusual activity. Confirm your identity within 24 hours or your account will be closed." - **Unusual or unknown payment.** "A payment was sent from your account. If this was not you, click here to cancel it." - **Surprise refund or overpayment.** "You are owed a refund. Log in to claim it." - **Invoice or receipt you did not expect.** It may include a phone number to call "to dispute the charge." All of them create worry or excitement so that you act before you think. Time pressure is the main warning sign. ## The links and addresses they use The link is where the trap closes. It leads to a page that looks like a PayPal login but sends your email and password to the scammer. The real website is **paypal.com**. Fake ones try to look close to it. Here are made-up examples of the tricks: - A swapped character: paypa1-login.example (a number 1 instead of the letter l). - Extra words: paypal-security-check.example. - The real name used as a decoy: paypal.com.account-verify.example. The part that counts is the ending just before the first single slash, which here is account-verify.example, not paypal.com. - Shortened links in texts that hide where you are going. Public security feeds show how common free hosting is for phishing. In the phishing links listed on 2026-11-02, 56% were on free website-hosting platforms rather than on look-alike domains. So a link does not need to resemble PayPal at all to be dangerous. Our guide on [how to check a link before clicking](https://issitelegit.com/guides/check-a-link-before-clicking) explains what to look at. For the same date, the feeds listed no phishing links imitating PayPal. That does not mean PayPal scams have stopped. Feeds are a snapshot, and scam messages can be sent long before a link is listed anywhere. ## Texts, emails and phone calls ### Texts A text with a link and a vague message ("Your PayPal is restricted") is a classic sign. Real companies rarely ask you to fix a problem through a link in a text. Our guide on [fake delivery and toll texts](https://issitelegit.com/guides/fake-delivery-and-toll-texts) covers the same pattern. ### Emails Look for a generic greeting such as "Dear customer," spelling errors, and a sender address that does not end in paypal.com. Be careful, because the display name can say "PayPal" while the real address is something else. Attachments you did not expect are another red flag. ### Phone calls A caller says they are from PayPal's fraud team and asks for a code sent to your phone, or asks you to move money to "keep it safe." Hang up. A one-time code is for you only. Nobody genuine needs it read out to them. If you want to talk to the company, find the number on its official website or in the app, and call that. ## How to check a message is real 1. **Do not click, tap or call anything in the message.** 2. Open the official PayPal app, or type paypal.com into your browser. 3. Log in and look at your notifications and activity. Real account problems show up there. 4. If you are unsure, use the help or contact options inside the app or on the official site. 5. If the message came as an email, check the sender address carefully, but do not rely on it alone, as senders can be faked. You can also see what our checker finds on the real site on the [PayPal result page](https://issitelegit.com/check/paypal.com). It shows the evidence, such as domain details, so you can compare it with any address you were sent. ## What a check can and can't tell you Automated checks, including ours, use public signals: how old a domain is, whether it appears on security blacklists, whether the name imitates a brand, and what the page contains. These help, but they have limits. A brand-new scam site may not be on any list yet. A clean result is not a guarantee of safety. Treat it as one piece of evidence next to your own judgment. In our checks over the last 7 days, 68 of 79 came back as likely legit, 8 as caution and 3 as high risk. That is a small sample and is not a measure of how common scams are overall. ## How to report a fake PayPal message - Forward scam emails to PayPal using the reporting address listed on its official site. - In the US, report to the FTC at [reportfraud.ftc.gov](https://reportfraud.ftc.gov). - In the UK, report to [Action Fraud](https://www.actionfraud.police.uk). For texts, you can forward them to 7726. - In Australia, use [Scamwatch](https://www.scamwatch.gov.au). - Then delete the message. ## If you already paid or clicked Stay calm and act quickly. 1. **If you only clicked,** close the page and do not enter anything. If you typed your password, change it at paypal.com right away, and anywhere else you reuse it. 2. **Turn on two-step login** for your PayPal account and your email. 3. **Check your account activity** for payments you do not recognize, and contact PayPal through the official app or site. 4. **If you sent money or gave card details,** call your bank or card issuer using the number on your card, and ask about blocking or disputing the payment. 5. **If a caller had access to your device,** disconnect it from the internet and get it checked. 6. Report it using the links above. Our guide on [what to do if you paid a scam website](https://issitelegit.com/guides/paid-a-scam-website-what-to-do) has more detail. Not sure about a link or website you have received? You can paste it into the [free IsSiteLegit checker](https://issitelegit.com/) and see the evidence for yourself.