PayPal scams: fake emails, fake invoices, and the "Friends and Family" trap

Three scams, one name

"PayPal scam" covers three different tricks. They share a brand, because PayPal is trusted and very widely used, but each one wants something different from you: your password, a phone call, or a payment that cannot be reversed.

1. The fake PayPal email

An email says your account is limited, a payment is on hold, or someone logged in from another country. There is a button to "resolve" it, and the button opens a copy of the PayPal login page.

PayPal gives you two tests that a fake usually fails (PayPal):

• How it greets you. PayPal says its emails "will always address you by your first and last names or by your business name". It never writes "Dear user" or "Dear customer".
• Where the link really goes. On a computer, move your mouse over the button and read the address that appears. The site is the part just before the first single slash, read from the right: paypal.com.secure-review.top is a site called secure-review.top.

The safe habit beats both tests: don't use the link at all. Open the PayPal app, or type paypal.com yourself, and look. If your account really has a problem, it will say so there.

Forward the fake email to [email protected], then delete it. That is the address PayPal itself asks for.

2. The fake invoice or money request

This one arrives through PayPal itself, which is why it fools people. Someone sends you an invoice or a money request, for a laptop or an antivirus renewal you never bought, with a note: "If you did not authorize this charge, call our billing department" and a phone number.

The invoice is not the scam. The phone call is. The "billing department" is the scammer, and the call ends with them asking for remote access to your computer, your login, or a payment to "refund" you.

PayPal's own advice (PayPal):

• Don't pay it.
• Don't call any phone number in the note.
• Never send money to a cryptocurrency wallet mentioned in an invoice or a money request.
• To check, log in to PayPal directly, not through the email.

An invoice you did not expect costs you nothing until you pay it or call the number on it. Ignore it and report it.

3. "Can you send it as Friends and Family?"

You are buying something from a stranger, and they ask you to pay as "Friends and Family" instead of "Goods and Services", usually to "avoid the fees".

That one choice decides whether you can get your money back. PayPal is clear: "Personal payments aren't covered by PayPal Purchase Protection" (PayPal). If the item never comes, there is nothing to claim.

A real seller who wants your business will take a Goods and Services payment. A seller who insists on Friends and Family for a stranger is telling you they do not want you to be able to dispute it.

Before you pay anyone on PayPal

• Pay strangers with Goods and Services, always.
• If the seller sent you a link to their shop or a listing, paste it into our checker first. We open it in a browser that is not yours and tell you where it really goes, how old the site is, and whether it asks for a login or a payment.
• Be wary of prices far below everyone else's and of anyone in a hurry. Both are there to stop you checking.

If you already paid, or gave away your password

• You paid: report it to PayPal straight away and ask it to reverse the payment and refund you. That is the FTC's advice for any payment app (FTC). If you paid by card through PayPal, call your card issuer as well.
• You typed your password into a fake page: change it now, in the app or at paypal.com typed by hand, and anywhere else you use the same password. Turn on two-step verification.
• You gave someone remote access to your computer: disconnect it from the internet, change your passwords from a different device, and have the computer checked before you use it for banking again.

Then report it to the FTC at reportfraud.ftc.gov. If someone then offers to recover your money for a fee, that is a second scam: the FTC warns that recovery scams target people who have already lost money (FTC).