Your PayPal Account Has Been Hacked: An Expert Guide on What to Do Next

As a cyber security professional who has specialized in cloud data security for over a decade, I‘ve seen firsthand the chaos and emotional distress a hacked PayPal account can cause. A compromised account gives bad actors a direct line to your money, sensitive personal info, and linked financial accounts.

But while alarming, a PayPal hack is not insurmountable. With swift action and the right steps, you can regain control of your account, mitigate losses, and protect yourself going forward. Here is my comprehensive guide on what to do if you find your PayPal account has been breached.

The Scope of the Problem

PayPal fraud and account takeovers are, unfortunately, not uncommon. According to PayPal‘s 2021 annual report, the company has over 426 million active accounts. That massive user base makes PayPal a lucrative target for cybercriminals.

Year	Number of Accounts	Fraud Losses
2021	426 million	$462 million
2020	377 million	$278 million
2019	305 million	$188 million

PayPal Annual Financial Reports

As the table shows, both the number of PayPal users and the company‘s net losses from fraudulent transactions have steadily increased in recent years. And those are just the cases PayPal knows about and publicly discloses. The real numbers are likely higher.

Signs Your PayPal Has Been Hacked

So how do you know if you‘ve fallen victim to one of these increasingly common hacks? Be on the lookout for these red flags:

1. You can‘t log in to your account. Fraudsters will often change the password as soon as they gain access to lock you out and buy themselves more time in your account.

2. There are unfamiliar or unauthorized transactions, transfers or purchases. Always review your PayPal activity regularly and be suspicious of anything you don‘t recognize, even small amounts. Hackers often start small to test if you‘re paying attention before making bigger moves.

3. You‘re getting notifications about account changes you didn‘t make. Be alarmed if you get emails or SMS messages about changes to your info, like your email, password, or phone number, that you didn‘t initiate. Same goes for login attempt notifications from unrecognized devices or locations.

4. Payments are getting denied. If your usual payments suddenly aren‘t going through due to "insufficient funds," a hacker may have drained your balance or maxed out your linked funding sources.

Steps to Recover Your Hacked Account

If any of the above scenarios sound familiar, it‘s crucial to act fast to minimize damage. Here are the steps to take to reclaim your account:

1. Change Your Password Immediately

Your first priority should be locking the hacker out of your account. If you‘re still able to log in, go to your PayPal security settings and change your password to something strong and unique.

If you can‘t log in, use the "Having trouble logging in?" link on the sign-in page. You‘ll have to verify your identity by providing the email address or mobile number associated with your account, then you can reset your password via a confirmation code.

When creating a new password, aim for at least 12 characters and include a mix of upper and lowercase letters, numbers, and symbols. Avoid anything you‘ve used for other accounts or that could be easily guessed based on information about you (no birthdays or pet names). A password manager like LastPass or 1Password can help you generate and securely store strong, unique passwords.

2. Check All Linked Accounts for Fraudulent Activity

Once you‘re back in your account, your next step should be checking all linked bank accounts and cards for suspicious activity. Hackers may have attempted transfers from your banks or made purchases using your saved payment methods.

Carefully review your recent PayPal transactions as well as the activity on your attached funding sources. If you see anything fraudulent, report it to your bank and card issuers immediately. Most banks will have a dedicated fraud department and specific procedures for disputing unauthorized charges and recovering your money.

After reporting fraud, unlink any compromised accounts from your PayPal. Remove any saved payment methods you don‘t recognize. Hackers will often add their own funding sources to your PayPal for their purchases or transfers.

3. Update Your Security Settings

With the hacker hopefully locked out and linked accounts secured, turn your attention to beefing up your PayPal security settings. Log in to your account and go to the Security tab under Account Settings.

If you don‘t already have two-factor authentication (2FA) enabled, do that immediately. 2FA adds an extra layer of security to your account by requiring a second form of verification beyond your password for every login attempt. For PayPal, you can choose to receive a one-time security code via SMS or use an authenticator app. While this extra step adds a few seconds to your login process, it makes it exponentially harder for hackers to breach your account.

Enabling 2FA in PayPal Account Security Settings

While in your security settings, review all your info to make sure the hacker hasn‘t made changes. Be on the lookout for any updates to your:

• Email addresses
• Phone numbers
• Security questions and answers
• Linked accounts and payment methods

If anything looks off, investigate further. Remove any email addresses, phone numbers, or security question answers you don‘t recognize. If the hacker changed this info, update it back to your correct, current details.

4. Report the Hack to PayPal

Your next step should be alerting PayPal to the unauthorized access to your account. You can report an account hack and fraudulent activity a few ways:

1. Log in to your PayPal account, go to the Resolution Center, and click "Report a Problem." Select the unauthorized transaction(s) and click Continue. You‘ll be prompted to provide more details about the fraudulent activity and verify your identity. You can also upload supporting documentation like screenshots of the unauthorized activity in your account or on your linked funding sources.

2. Call PayPal‘s customer support line. The company has taken steps to make reporting fraud over the phone easier. "We understand that when fraud occurs, time is of the essence. That‘s why we‘ve expanded our customer service phone support to allow users to report unauthorized activity without needing to log in to their accounts," said PayPal CISO Sri Shivananda in a 2021 blog post.

To contact PayPal support by phone, call 1-888-221-1161. Enter your account info when prompted or say "speak with an agent" to be connected to a live representative who can help you report the hack and fraudulent activity.

If your account was hacked, there‘s a good chance your money was too. Fortunately, PayPal has robust security and fraud prevention infrastructure. Their system constantly monitors accounts for suspicious activity and alerts users of unusual login attempts via email and SMS.

More importantly, the company offers solid purchase and fraud protection for users. PayPal‘s Buyer Protection and Seller Protection programs cover users in cases of unauthorized account activity:

"PayPal‘s Seller Protection program can help sellers who encounter unauthorized transactions or chargeback fraud. Meanwhile, Buyer Protection helps buyers who did not receive items they paid for or who received items significantly different than described by the seller. These policies can help protect against some common adverse impacts of unauthorized account access, such as hacked accounts and identity theft."

PayPal Buyer Protection and Seller Protection Documentation

According to PayPal‘s terms, as long as you report unauthorized activity within 60 days, you will be covered:

"PayPal Buyer Protection covers all eligible purchases where PayPal is used, as well as payments made through our website. To take advantage of Buyer Protection, we require that a dispute be filed within 180 days of your purchase or payment and the outcome of the dispute must be decided in your favor. Buyer Protection does not cover donations; purchases of most vehicles, real estate or airline flight tickets; or unauthorized payments."

PayPal User Agreement and Buyer Protection Terms

So in most cases, you should be able to recover any fraudulent charges or losses by disputing them with PayPal. The company will investigate and reimburse you if the activity is found to indeed be unauthorized. Keep in mind the process may take some time though, and PayPal may put a temporary hold on your account during the investigation.

5. Monitor Your Credit and Statements

After going through the steps above, your PayPal account should be back under your control and any fraudulent activity should be resolved. But your work isn‘t done. It‘s crucial to stay vigilant in the days, weeks, and even months after a hack.

There‘s a good chance that in the process of accessing your PayPal, the hacker was able to obtain sensitive personal info about you, like your name, address, SSN, and financial account details. They can use this data to try to open new accounts or lines of credit in your name, gain access to your other online profiles, or sell it to other fraudsters on the dark web.

In the immediate aftermath, keep a close eye on your credit report and financial statements. Look out for any suspicious activity, like accounts or credit inquiries you don‘t recognize. If you see anything fishy, report it to the relevant institution immediately. You can also put a freeze on your credit to prevent fraudsters from opening new accounts in your name.

Consider signing up for a credit monitoring or identity theft protection service. These services keep an eye on your credit report and alert you of any suspicious changes in close to real-time. Many will also scan dark web forums and databases for signs your personal info is being sold or traded. If you do experience identity theft as a result of your PayPal hack, these services will help you through the recovery process.

Via PayPal‘s User Agreement and Security Policies

Protecting Your Account Going Forward

You‘ve done the hard work of reclaiming your hacked PayPal account and hopefully recovered any lost funds. Now it‘s time to focus on prevention. Here are some expert tips for keeping your PayPal secure going forward:

1. Use a strong, unique password. I can‘t emphasize this enough. Using the same password across multiple accounts is basically handing fraudsters the keys to your digital kingdom. If one account gets breached, they‘ll all be vulnerable. Every account should have its own password that‘s long, random, and contains a variety of characters.

2. Enable two-factor authentication. Adding that second layer of security to your login process is one of the easiest and most effective ways to prevent unauthorized access. With 2FA enabled, even if a hacker manages to get your password, they likely won‘t be able to verify the one-time security code needed to actually get into your account.

3. Be extremely wary of phishing attempts. Phishing is one of the most common ways hackers gain access to PayPal accounts. They‘ll send emails or text messages pretending to be from PayPal in hopes of tricking you into clicking a malicious link, downloading malware, or entering your account credentials on a fake login page.

Some red flags an email or text is a phishing attempt include:

• A generic greeting like "Dear user" instead of your name
• Typos and grammatical errors
• A mismatched or misleading URL (hover over links before clicking to see where they really lead)
• Requests for sensitive info like your full SSN or password
• Urgent calls to action citing suspicious activity or prize winnings
• Attachments you weren‘t expecting

When in doubt, don‘t engage. Contact PayPal directly using contact info listed on their website, not in the message, to verify any suspicious communications.

4. Keep your software up to date. Hackers exploit vulnerabilities in outdated operating systems and programs to gain access to your devices and data. Keep your device‘s OS, antivirus software, and apps updated to patch any known security holes.

5. Limit the devices and networks you use to access PayPal. The fewer access points to your account, the fewer opportunities for compromise. Log in to PayPal only on trusted devices and secure private wifi networks. Avoid accessing your account on shared computers or public wifi that‘s more likely to be monitored by bad actors.

6. Review your PayPal account activity regularly. The quicker you catch unauthorized transactions, the easier they are to resolve and recover from. Get in the habit of reviewing your recent PayPal activity at least once a week. Be on the lookout for anything suspicious, like logins from unfamiliar devices/locations or small mystery transactions. Report anything fishy to PayPal right away.

The Emotional Toll of a PayPal Hack

Having a fraudster infiltrate your PayPal account can be a traumatic experience. It‘s a violation of your privacy, security, and financial well-being that can leave you feeling vulnerable and paranoid.

It‘s normal to feel overwhelmed, angry, stressed, or even a misplaced sense of shame after a hack. Remember, this is not your fault. Falling victim to a cyber security incident doesn‘t mean you‘re stupid or careless. These things can happen to anyone.

If you‘re struggling to cope with the fallout of a hack, be kind to yourself. You will get through this. Talk about how you‘re feeling with trusted loved ones or a mental health professional. Consider a digital detox to give yourself some space from screens and the pressure of constant password changes and statement checking post-hack.

Focus on taking proactive steps to shore up your online security across all accounts, not just PayPal. Taking back a sense of control can make a big psychological difference. And always remember you‘re resilient.

You Will Recover

Having your PayPal hacked may feel like the end of the digital world, but you will bounce back. Acting quickly, reporting the fraud, and staying on top of your account security will help you mitigate damage and protect you going forward.

"Time and time again, we see that users who take simple, proactive security measures like using strong unique passwords and enabling 2FA have much lower rates of account compromise," notes PayPal CISO Shivananda. "The power to protect your account is in your hands."

If the process of recovering your account ever feels too overwhelming, don‘t hesitate to contact PayPal support. The company has increased its support operations and agent training to better assist users through the fraud recovery process.

You will get through this. Stay vigilant and don‘t let fear stop you from taking advantage of the convenience and opportunities digital payments have to offer. If a cyber security expert like me can recover from a PayPal hack (true story), so can you!