PayPal scam calls, texts and emails in the UK: how to spot and stop them

PayPal is one of the most impersonated brands in UK fraud, and PayPal scam calls, texts and emails all follow a few recognisable patterns: a payment you didn't make, an account that's been 'locked', an unexpected 'invoice' or refund, or a 'security alert' urging you to act fast. Because so many people genuinely use PayPal, these messages land convincingly — and the scammers' goal is always the same: your PayPal or bank login, your card details, or a direct payment. This guide explains exactly how PayPal scams work across calls, texts and emails, the red flags that give them away, and precisely what to do (including if you've already clicked or paid). The single most important rule up front: never act on a PayPal alert through the message itself — always log in to PayPal independently, through the official app or by typing the address yourself, to check whether anything is real.

#Why PayPal is such a common scam disguise

PayPal scams work for the same reason most brand-impersonation fraud works: PayPal is used by millions of people, so a message about your PayPal account feels relevant to a huge share of the population. The scammers send these messages in vast numbers, knowing that many recipients will be actual PayPal users with money and cards linked to their accounts — exactly the high-value target fraud thrives on. PayPal's own role as a payment middleman also makes the scams especially plausible: people are used to getting genuine PayPal emails about payments, invoices and security, so a fake one slots neatly into expectations. And because PayPal sits between your bank and your purchases, a compromised PayPal account can give fraudsters access to linked cards and bank accounts, making it a particularly damaging thing to lose control of.

There's a psychological hook too. PayPal scams typically combine alarm ('a payment has gone out', 'your account is locked', 'unusual activity detected') with a quick, easy fix (click here, call this number, confirm your details). That combination — fear plus a simple resolution — is precisely engineered to make you act before thinking. You're worried about money leaving your account, so you grab the offered lifeline without pausing to ask whether the message itself is genuine. Recognising that this exact feeling is the *designed* effect is the first and most powerful defence. For the broader principle of judging the contact rather than trusting how it reached you, our is this number a scammer? guide is a useful companion.

#The main types of PayPal scam

PayPal scams come in several recognisable flavours, across email, text and phone. Knowing the cast of characters makes each one easier to spot.

• 'Payment sent' / 'you paid £X' scam. An email or text says you've just paid someone (often a large sum to an unfamiliar name), with a link or number to 'cancel' or 'dispute' it — panic does the rest.
• 'Account locked / limited' scam. A message claims your account is suspended for 'unusual activity' and you must 'verify' your details via a link to restore access.
• Fake invoice / money request. A genuine-looking PayPal invoice or money request arrives for something you didn't buy, with a phone number to 'query' it that routes to a scammer.
• Refund / overpayment scam. You're told you're owed a refund or were 'overpaid', and asked to confirm bank details or even send money back — sometimes after a fake payment notification.
• 'Security team' phone call. A caller claims to be PayPal (or your bank, via a PayPal issue) and pressures you to move money, install software, or share codes.

Notice that several of these — particularly the fake invoice and 'payment sent' versions — cleverly use a phone number in the message as the hook, rather than a link. That's deliberate: people have learned not to click suspicious links, but may still trust a phone number, and calling it connects you to the scammer's own 'support line'. The rule that defeats all of these is the same: never use a contact detail provided in the message itself. Our scam numbers guide covers how these call-back traps work in more detail.

#The red flags that give a PayPal scam away

Whatever form it takes, a PayPal scam shares a recognisable shape. Learn it and you'll catch the great majority.

• Urgency and alarm. 'Act within 24 hours', 'your account will be permanently limited', 'a payment is pending' — manufactured pressure to stop you checking.
• A link or phone number to act through. Genuine issues can always be handled by logging into PayPal yourself; a scam needs you to use *its* link or number.
• Requests for login details, card numbers or codes. PayPal never asks for your password, full card number or one-time security codes by phone, text or email.
• A payment or invoice you don't recognise. Designed to make you panic and 'dispute' it through the scammer's channel.
• Generic greetings and odd details. 'Dear user', mismatched sender addresses, or wording that's slightly off.
• Pressure to move money, send a refund, or install software. No genuine PayPal process requires any of these.

If a message or call ticks one or more of these boxes, treat it as a scam until proven otherwise — and the way to prove otherwise is never through the message, but by checking PayPal independently. Open the official PayPal app, or type the PayPal address into your browser yourself, and look at your account: if there's a genuine issue, it'll show there. A real problem will still be there when you log in safely; a fake one simply won't exist.

#What to do when a PayPal message or call arrives

1. 1

   Don't click, call back, or share anything

   Don't tap links, call numbers in the message, or share login, card or code details. Don't reply. Take the pressure out by slowing down.

2. 2

   Check PayPal independently

   Open the official PayPal app, or type PayPal's address into your browser yourself, and log in to check for any genuine alerts, payments or limitations.

3. 3

   Verify any 'payment' from your own records

   If you're told you paid someone, check your actual PayPal activity and bank statements. A scam 'payment' won't appear in your real account.

4. 4

   Report and forward

   Forward scam emails to PayPal's official phishing reporting address, forward scam texts to 7726, and report to Action Fraud. Then delete the message.

5. 5

   If you've acted, secure everything fast

   Change your PayPal password, enable two-factor authentication, contact your bank (dial 159), and watch for follow-up 'support' calls.

The single habit that defeats virtually every PayPal scam is to decouple checking your account from the message in front of you. A text, email or call can claim anything; the truth lives only in your actual PayPal account, which you reach by your own route — the official app or a web address you typed yourself — never through a link or number someone sent you. This one reflex removes the only thing the scam depends on: you interacting on the scammer's terms instead of through a channel you control.

#A realistic example: the fake 'PayPal invoice' phone trap

Consider a version that's grown common because it sidesteps people's wariness of links. You receive a genuine-looking PayPal invoice or money request by email — say, for £499 for a crypto purchase, a software subscription or an electronics order you never made. It looks authentic because, in some cases, it really is sent through PayPal's system by a fraudster abusing the invoicing feature. The email includes a phone number to call 'if you didn't authorise this payment'. Alarmed at a £499 charge, you call — and reach a confident 'PayPal support agent' who, to 'cancel' the payment, asks you to confirm card details, log in while they watch, install remote-access software so they can 'process the refund', or move money to a 'safe account'. Every one of those requests is the actual scam; the invoice was just the bait to make you dial.

Here's the calm way through it. First, recognise that an unexpected invoice for something you didn't buy is a classic lure, and that the phone number in it leads to the scammer, not PayPal. Second, do not call that number. Instead, log in to PayPal independently through the official app or website and check whether any such payment or invoice genuinely exists and what PayPal's own guidance says — unpaid invoices you ignore generally cause you no harm, and you can report the abuse to PayPal. Third, never install remote-access software, share codes, or move money because a 'support agent' tells you to. If you want to check the number that contacted you, our who called me and reverse phone lookup guides show how, and the key test from our is this number a scammer? guide applies: genuine support is happy for you to hang up and reach them through official channels, while a scammer fights to keep you on the line.

#PayPal scam calls specifically

While many PayPal scams start as emails or texts, phone calls — whether you're called directly or lured into calling — are where the most damage often happens, because a live voice can adapt, reassure and pressure in real time. A PayPal scam call might claim there's been unauthorised activity, that a refund needs 'processing', or that your account and linked bank are at risk and you must act now to protect your money. The scammer may already have some of your details (from a previous phishing step or a data breach) to sound convincing. The danger escalates when they ask you to install remote-access software ('so we can secure your account'), read out one-time codes, or move money to a 'safe account' — these are the moves that hand them control of your money, and no genuine PayPal or bank process ever requires them.

The safe response to any PayPal-related call is to not share anything and hang up, then verify independently by logging into PayPal or, for bank concerns, contacting your bank on a trusted number. Apply the golden rule that defeats phone fraud: a genuine organisation is always happy for you to hang up and call back through official channels, whereas a scammer will insist there's no time, that calling back is unnecessary, or that you must stay on the line. If the call veers towards your bank account or a 'safe account', treat it exactly as you would a bank-impersonation scam — hang up and dial 159, the free service that connects you securely to your bank's fraud team. Caller ID is no help here either: scammers can spoof PayPal's or a bank's number, as our spoofed UK numbers guide explains, so never trust the displayed number as proof of who's calling.

#If you've already clicked, called or paid

If you've entered details on a fake PayPal page, called a scam number and shared information, or made a payment, act quickly and without embarrassment — these scams catch careful, capable people every day. If you entered your PayPal password, log into PayPal independently and change it immediately, then turn on two-factor authentication; if you reused that password elsewhere, change it on those accounts too. If you shared card or bank details, or were persuaded to move money, contact your bank straight away on a trusted number (159, or the number on your card) to stop payments and protect your account. If you installed remote-access software, disconnect the device from the internet and have it checked, as the fraudster may still have access. Watch closely in the following days for follow-up calls claiming to be PayPal, your bank or even the police 'helping' with the fraud — this second wave uses your earlier details to sound credible. Keep a record of what happened and report it to Action Fraud.

#Protecting your PayPal account long-term

Beyond handling individual scams, a few habits make your PayPal account far harder to compromise. Turn on two-factor authentication so a stolen password alone isn't enough to get in. Use a strong, unique password for PayPal that you don't reuse anywhere else, ideally stored in a password manager. Always reach PayPal through the official app or by typing the address yourself, never via a link in a message — make this an unbreakable habit. Be sceptical of every unexpected payment, invoice or 'security' message, and verify it only by logging in independently. And keep your linked email secure, because access to that inbox is often the route to resetting account passwords; protect it with its own strong password and two-factor authentication.

It's also worth helping the people around you, because PayPal scams are so widespread that someone you know is likely receiving them too. Share the single rule that covers all of it — never act on a PayPal alert through the message; always log in independently to check — and reassure less confident relatives that checking with you first is always the right move, never a bother. Making the safe behaviour normal and judgement-free closes the gap between 'this looks worrying' and 'I'd better sort it quickly', which is exactly the gap these scams exploit. For the wider toolkit on identifying and reporting suspicious numbers and messages, our scam numbers and report a scam call guides bring the practical steps together.

#Spotting PayPal scams in your inbox

Email is where many PayPal scams begin, so a few specific checks help you spot the fakes without even needing to open them properly. Look at the actual sender address, not just the display name — scammers set the visible name to 'PayPal' or 'PayPal Service' while the underlying email address is something unrelated or subtly misspelt. Be suspicious of generic greetings: PayPal generally addresses you by your registered name, so 'Dear customer' or 'Dear user' is a warning sign. Hover over (don't click) any links to preview where they really lead — a genuine PayPal link goes to PayPal's real domain, while a scam link points somewhere else dressed up to look official. And treat unexpected attachments with great suspicion, because PayPal doesn't send account alerts as attachments you must open. None of these checks is foolproof on its own, which is exactly why the golden rule still stands: rather than trying to forensically judge an email, simply ignore its links and buttons and log into PayPal independently to see whether anything it claims is real.

Remember too that a convincing-looking email is easy to produce — logos, formatting and layout can all be copied perfectly, so 'it looks exactly like PayPal' is not evidence that it's genuine. The scammers' whole craft is making fakes look real, so appearance proves nothing. What can't be faked is your actual PayPal account: if an email says your account is limited, log in independently and see whether it actually is; if it says you sent a payment, check your real transaction history. This habit of treating every PayPal email as merely a *prompt to go and check independently* — rather than as a source of truth in itself — neutralises the entire category of email scams at a stroke, regardless of how polished or alarming the message looks.

#Why you can't just block your way to safety

People often hope that blocking 'the PayPal scam number' will solve the problem, but scammers send these messages and make these calls from constantly changing numbers and email addresses, and they spoof caller ID so the displayed number can't be trusted anyway. Blocking the number that contacted you today is sensible, but tomorrow's attempt will come from a different one, and the email versions rotate addresses just as fast. The durable defence is therefore a behaviour, not a blocklist: recognise the shape of the scam (alarm about your account, a link or number to act through, requests for login/card details or money, urgency) and respond the same way every time — by ignoring the message's contact details and logging into PayPal independently. That approach never goes stale, works across calls, texts and emails alike, and protects you against the next variant before it's even been reported. Checking a specific number for community reports remains a useful way to confirm a suspicion, but it's the recognition of the pattern, not a frozen list, that keeps you genuinely safe.

#Bottom line

PayPal scam calls, texts and emails impersonate PayPal about payments, locked accounts, invoices, refunds and 'security alerts', and they're so convincing because nearly everyone uses or recognises PayPal. The rule that defeats them is simple: never act through the message — always log in to PayPal independently, via the official app or by typing the address yourself, to check whether anything is real. Don't click links, call numbers in the message, or share your password, card details or codes; PayPal never asks for those. Forward scam emails to PayPal's phishing address, scam texts to 7726, and report to Action Fraud. If you've paid or shared details, secure your account, contact your bank on 159, and watch for follow-up calls. For the wider method, see is this number a scammer? and who called me.