Your friends are messaging you to ask why you sent them odd payment requests. You got a login alert from a country you have never visited, or your password suddenly stopped working when you tried to sign in. Maybe a charge you do not recognize is sitting in your account history. Any of these is a sign that someone else has gotten into your PayPal account, and it is a deeply unsettling feeling when your money is involved.
Once you regain control, replace the old password with one that cannot be guessed. A free password generator creates a long random password locally in your browser, and nothing you generate ever leaves your device.
Take a breath, because most compromised PayPal accounts can be recovered and locked back down. PayPal has a defined recovery path whether you still have access or are fully locked out, and it can temporarily freeze your account while it investigates.
The key is to move in the right order. Confirm what happened, take back control of your sign-in, then seal the account so the intruder cannot return.
Work through the steps below from the top.
Before you touch anything, one safety rule matters more than any single step. Start your recovery on a device, browser, and network you have signed in from before, since PayPal's security checks recognize familiar devices and a new one can slow you down.
Never create a brand-new account to report the hacked one, and never share your password, a verification code, or a two-factor code with anyone who contacts you. Real PayPal support will not ask for those.
Finally, before you type your password or upload any identification, confirm you are on the genuine paypal.com domain rather than a lookalike page from an email link.
Confirm the Compromise and Reset Your Password Right Away
The single fastest thing you can do is take back your login. If you still have access to the email address or phone number on the account, you can reset your password in a few minutes and lock the intruder out of that session.
- 1.On the PayPal login page, or the login screen of the PayPal app, select "Forgot password?"
- 2.Choose how you want to complete the security check, then click Next.
- 3.Once you pass the check, create a new password.
This can be done on a web browser or in the PayPal app, so use whichever you can reach first.
Pick a password you have never used on PayPal before and that is not shared with any other site, since reused passwords are one of the most common ways accounts get taken over in the first place.
If you can sign in but you are unsure whether anyone is still active in the account, treat any payment you did not authorize as confirmation that something is wrong.
Keep moving through the steps below to remove the intruder's footholds.
If You Are Not Sure Which Email Is on the Account
It is common to forget exactly which email address you used, especially on an older account. PayPal has a path for that built into the same flow.
On the login page, select "Forgot password?"
Then select "Forgot your email?"
Enter up to 3 email addresses you may have used with PayPal and click Next.
If PayPal identifies your address, you can log in or create a new password from there.
This gives you a way back in even when the account details are hazy.
Change Your Password and Security Questions From a Browser
Once you are back inside the account, do a fuller reset from a web browser rather than the app. PayPal states that changing your password and security questions cannot be done in the PayPal app, so use paypal.com for this part.
Go to Settings and click the Security tab above your name.
Click Update next to "Password."
Confirm your current password, enter the new password twice, and click Change Password.
While you are on that same Security tab, refresh your security questions too, because an intruder may have seen or changed the answers.
In the Security tab, click Update under "Security questions."
Pick questions from the Security question 1 and Security question 2 dropdowns.
Enter your answers and click Save.
Choose answers that are not easy to guess or find online, and avoid anything tied to public details about you.
When You Cannot Get In, Use the Official Locked-Out Recovery
If the attacker changed the password, email, or phone number on the account, the self-service reset may not be enough and you may be fully locked out. PayPal's route for this is to call them and verify your identity over the phone.
Go to the Contact Us page.
Select "Call Us" near the bottom of the page.
Click "call us as a guest" to see the phone details.
Before you call, gather what PayPal needs to confirm you own the account. Have your telephone number, a statement for the credit card or bank account linked to PayPal, and the email address you registered with.
Having these on hand lets the conversation go quickly instead of stalling on verification.
This is also the right moment to flag the bigger problem. If you believe an unauthorized party has accessed your account or personal data, PayPal says to call them immediately to report it to a team member.
PayPal can temporarily freeze your account while it investigates, which stops further damage while you sort out access.
One caution as you do this. PayPal does not publish a self-service path for losing access to your authenticator device, and there is no official timeline for how long restoring access to a locked or compromised account takes.
Do not pay any third-party "account recovery service" that promises to speed this up, since the only legitimate route is PayPal's own phone verification.
Report Any Unauthorized Transactions in the Resolution Center
If the intruder sent money or made purchases, report each unauthorized payment through the Resolution Center so PayPal can investigate it.
Go to the Resolution Center at paypal.com/resolutioncenter.
Select "Report a problem," choose the payment, and click Continue.
Select "I want to report unauthorized activity" and complete the steps.
You can also do this from the app. Tap Activity, tap the payment, tap "Report a Problem," choose the reason, and follow the steps.
PayPal will investigate and email you within 10 days, so watch the inbox tied to your account for that update.
Lock the Account Down So It Cannot Be Taken Again
Recovering access is only half the job. The intruder may have left changes behind, and your account is still vulnerable until you add a second layer of protection.
Handle the lockdown in this order.
Remove Any Bank or Card the Hacker Added
Attackers sometimes attach their own bank account or card to move money out, so check your Wallet for anything you do not recognize.
To remove a card, go to Wallet, select the card, and click Remove card. In the app, tap Accounts, select the card, and tap Remove.
To remove a bank, go to Wallet, select the bank, and click Remove bank. In the app, tap Accounts, select the bank, and tap Remove.
Removal may be blocked if there is a pending transaction, if the item was a recent backup payment method, or if the account has a limitation.
If you hit one of those blocks, raise it when you contact PayPal so they can sort it out.
Turn On 2-Step Verification
Two-step verification is the strongest single change you can make, because even a stolen password will not be enough to get in. Set it up from a web browser, since PayPal states it cannot be configured in the PayPal app.
Go to Settings and click Security.
Click Set Up next to "2-step verification."
Select "Use an authenticator app," click Set it Up, and follow the on-screen steps.
You can use an app such as Google Authenticator or Microsoft Authenticator to generate the codes.
Keep your authenticator app on a phone you control, and remember the rule from earlier.
Never read one of those codes aloud to anyone who calls or messages you claiming to be support.
Frequently Asked Questions
How long does it take to get my hacked PayPal account back?
PayPal does not publish a timeline for restoring access to a locked or compromised account. The only official timeline is for reported unauthorized transactions. After you report one in the Resolution Center, PayPal states you will receive an investigation email within 10 days.
What if the hacker changed my email and phone so I cannot reset the password?
Use the locked-out route. Go to the Contact Us page, select "Call Us," and click "call us as a guest" to see the phone details. Have your telephone number, a statement for the linked bank or card, and your registered email ready so PayPal can confirm you own the account.
Can I set up two-factor authentication from the PayPal app?
No. PayPal states that 2-step verification cannot be configured in the PayPal app. Use a web browser, go to Settings and then Security, click Set Up next to "2-step verification," and select "Use an authenticator app."
Will PayPal ask me for my password or a verification code to help me recover?
No. Real PayPal support will never ask you to share your password, a verification code, or a two-factor code. Anyone who does is attempting fraud, so do not give those out, and start your recovery only on the genuine paypal.com site after confirming the domain.
Should I pay a recovery service to get my account back faster?
No. The only legitimate way to recover a locked or compromised PayPal account is through PayPal's own flows, either the self-service password reset or phone verification with the company directly. Do not pay any third-party "account recovery service."
Someone added a bank account I do not recognize. How do I remove it?
Go to Wallet, select the bank, and click Remove bank. In the app, tap Accounts, select the bank, then tap Remove. The same works for an unfamiliar card using Remove card. Removal can be blocked by a pending transaction, a recent backup payment method, or an account limitation, in which case raise it with PayPal.