Suspicious PayPal Email: How to Tell If It's Real
Got a suspicious PayPal email? Use four quick checks, verify invoices safely, and learn what to do if you clicked or entered your password.
By George Featherstone·AI-assisted draft, reviewed and edited by George Featherstone.
Key takeaway: Never use a PayPal email's link or phone number to investigate a problem. Open the PayPal app or type paypal.com yourself, then check your account activity there.
- Check the full sender address, links, urgency, and message quality—but remember that a sender address can be spoofed.
- Unexpected invoices and payment requests are common phishing lures.
- Report suspicious messages to [email protected], then delete them.
- If you entered a password, change it immediately on the real PayPal site and anywhere you reused it.
Is that PayPal email real? Check these four things first
The sender address behind the display name
The name at the top of an email can say anything. Expand the sender details and read the actual address. A message from a strange domain such as paypa1-support.xyz is a clear warning sign. But even an address that appears to use paypal.com is not proof by itself, because sender information can be forged. Use the address as one clue, not your final decision.
Links that do not match PayPal
On a computer, hover over a button without clicking and read the destination shown by your browser. On a phone, do not tap the link at all. If the destination is not PayPal's official site, close the message. The safest alternative is to open the app you already use or type paypal.com yourself.
Urgency or a payment you did not make
“Your account will be suspended in 24 hours” and invoices for purchases you never made are classic pressure tactics. Real account problems can be checked after you sign in directly; you do not need to use the email's countdown timer or “resolve now” button.
Generic greetings, odd logos, and sloppy writing
“Dear user,” blurry logos, strange colors, unexpected attachments, typos, and awkward grammar can all point to a fake. PayPal says authentic messages address you by the name on your account. None of these clues is conclusive alone, but several together mean you should stop and verify another way.
How do I check the actual sender and email headers?
The display name is not evidence. If you need a closer look, open the raw message and inspect the sending address, authentication results, and reply-to address.
Show original in Gmail
Open the message, select the three dots, and choose Show original. Gmail displays the full message headers and SPF/DKIM results. A failed authentication result or a reply-to address at a free email service is a strong reason to treat the message as suspicious. A “pass” is helpful, but still verify the claim inside PayPal.
View message source in Outlook
In classic Outlook, open the message, choose File → Properties, and read the Internet headers. In new Outlook or Outlook on the web, use the three-dot menu and choose View message source. Pay attention to the Return-Path, Received lines, and reply-to address.
| Header clue | What it suggests |
|---|---|
| Reply-to matches PayPal and the account activity checks out | More consistent with a genuine message |
| Reply-to points to Gmail, Outlook, or an unfamiliar domain | Likely an attempt to route replies to a scammer |
| Authentication fails or the sending path looks unrelated | Stop and verify through PayPal directly |
Do you have a PayPal account?
If you have an account
Open a browser and type paypal.com yourself, or open the official app. Review recent activity, pending payments, invoices, money requests, and linked cards or bank accounts. A real issue should be visible after you sign in directly. Do not click the email first.
If you do not have an account
An unexpected PayPal invoice addressed to someone who does not use PayPal is almost certainly a phishing lure. Do not click “dispute this charge,” call a number in the message, or reply. Report the message and delete it.
What should I do with a suspicious PayPal email?
- Do not click, call, download, or reply. The message can build every “escape hatch” to send you back to the scammer.
- Forward the entire message to [email protected]. This is PayPal's current official reporting address.
- Report it in Gmail or Outlook using Report phishing, then delete it.
- Empty the trash so nobody accidentally opens it later.
PayPal's official reporting guidance says not to click links, call listed phone numbers, or download attachments before forwarding a suspicious message.
What if I already clicked the link or entered my password?
Act quickly, but do not panic. If you only opened the page and entered nothing, close it and continue with the steps below.
- Log in directly at PayPal and change your password. Change it anywhere else you reused it.
- Turn on two-factor authentication or a passkey in PayPal's security settings.
- Check your PayPal wallet and recent activity for unfamiliar cards, bank accounts, payments, or money requests.
- If you entered card or bank details, call the institution using the number on your card or statement.
- Expect follow-up calls claiming to be “PayPal support.” Do not share your password, one-time code, or remote-computer access.
What if the invoice or payment looks real?
A scammer can create a genuine PayPal invoice or money request for something you never ordered. In that case the email may be authentic, but the transaction is still a scam. Verify the seller independently, compare the amount and sender inside your PayPal account, and cancel an unwanted invoice from inside the account. Never pay an unexpected invoice or send an “overpayment” refund because an email tells you to.
Helping a parent check a suspicious PayPal email
Use a short script:
- “Read me the sender's full address, character by character.”
- “Were you expecting this payment, invoice, or account alert?”
- “Is it asking you to click, call, or pay today?”
If the answer to the last question is yes, pause. Agree on a standing rule: any message asking for money, a password, or a one-time code gets a callback through a number already saved or printed on a card—not through the message itself.
The same checks work for any brand
Scammers swap the logo, but the playbook stays the same. Fake bank, Facebook, USAA, delivery, and PayPal messages all use unexpected contact, a dangerous link or number, and pressure to act now. Open the company's official app or type its address yourself, then check for the claimed alert there.
FAQ
What is PayPal's official email address for reporting phishing?
Forward the entire suspicious message to [email protected], then delete it. Do not click anything in the message first.
Can a PayPal email be real but still part of a scam?
Yes. A real PayPal invoice or money request can be created for something you never ordered. Verify the transaction inside your account and cancel it there instead of paying or responding to the email.
I got a PayPal invoice for something I never bought. Is it a scam?
It is a common scam setup. Do not use the email's dispute button. Type paypal.com yourself, check whether the invoice appears in your account, and cancel it from there if it does.
How can I tell if a PayPal text message is fake?
Use the same rule: do not tap the link, call an unknown number, or share a password or code. Open the PayPal app you already have or type the address yourself and check your activity.
My mom got a PayPal email but does not have an account. What does that mean?
It is almost certainly a phishing lure. Do not click it. Report it to PayPal's phishing address, delete it, and empty the trash.