PayPal Scam Text (2026): Unauthorized Payment — Don't Tap

Short answer: A PayPal scam text (or email) about an unauthorized payment, a limited account, or a surprise invoice is usually phishing. Do not tap the link. Open the official PayPal app or type paypal.com yourself, then check Activity and the Resolution Center. Real problems live there. Fake ones live in the message.

The panic is the product. Someone “charged $487.” Your account is “limited in 15 minutes.” An invoice looks almost right. That spike is why PayPal is impersonated so often — people already trust the logo, so they tap before they think.

Real PayPal vs fake PayPal (start here)

If the message fails even one row on the fake side, treat it as hostile until your login says otherwise.

The four costumes that keep ranking in search

People do not search “phishing.” They search the sentence on the screen. These are the ones that show up most.

1. “Unauthorized payment — tap to cancel”

This is the high-click PayPal unauthorized payment bait. The amount is specific. The merchant name is almost familiar. The button says Cancel, Dispute, or Refund.

Nothing gets canceled on that page. The page is there to catch a password, a card, or a one-time code. If a charge were real, you would see it after you open Activity. PayPal’s help for unauthorized transactions starts in the Resolution Center — not in SMS.

2. “Your account has been limited”

A real limitation can happen. PayPal may email you and ask for steps inside the account. The test is not “does PayPal ever limit people.” The test is: after you log in yourself, do you see a limitation and a task list?

If the email is loud and the Resolution Center is empty, PayPal says to treat that email as fake and forward it. Do not upload a driver’s license to a page you reached from the message.

3. The surprise invoice or “you received money”

A polished invoice PDF or “Goods and Services payment received” screenshot is a costume, not cash. Same engine as a Facebook Marketplace fake payment: proof lives in your Activity, not in an attachment. Friends and Family “refund this overpayment” is the follow-up. If the money was never there, the refund is you sending a gift.

4. Text, then a helpful caller

The SMS makes the call feel expected. The voice asks you to read the code “to reverse the charge.” That is an OTP scam wearing a PayPal hat. Hang up. Open the app. Never read a code to someone who contacted you first. If they stay on the line and talk like a fraud desk, use the same hang-up reflex as a bank fraud call.

Why the page can still look perfect

HTTPS, a padlock, and a blue button do not prove ownership. Scammers clone the layout and buy lookalike domains (paypal-secure-…, paypa1.com, random hosts with /paypal/ in the path). The checklist in how to tell if a website is safe still applies: you should have typed the address, not borrowed it from panic.

A phishing email can do the same job as the text. Display name “PayPal” plus a random sender is not PayPal. Hover or long-press a link only if you already decided not to tap it — or skip hovering and go to the app.

Caller ID can spoof too. A “PayPal” number on the screen is a costume, not a badge.

What to do in two minutes (no link required)

1. Do not tap, reply, or call the number in the message.
2. Open PayPal yourself — home-screen app, or a browser where you type paypal.com. Bookmark that. Do not search “PayPal login” and tap the first ad.
3. Check Activity. No strange payment? The text was theater.
4. Open Resolution Center / the bell. No limitation and no task? The “limited account” email was theater.
5. Forward the message to [email protected], then delete it. PayPal publishes this path for both email and SMS.
6. If Activity does show a payment you did not make, stay inside the official account. Use PayPal’s steps to report unauthorized activity. Do not use the SMS as a shortcut.

That is the whole ritual. You do not need to “just check” the link to be thorough.

What PayPal will not ask in a text

Use this as a second filter when the table still feels fuzzy:

• Your password, PIN, or full card number — those belong on a page you opened yourself.
• A one-time code read back to a stranger — that code is a key, not a conversation.
• Gift cards, crypto, wire, or cash “to reverse a charge” — refunds do not travel that way.
• A driver’s license upload on a page from the SMS — identity steps, when they exist, show up after you sign in.
• A demand that you stay on the line or keep the chat secret — real support can survive a callback you start.

PayPal’s phishing article also flags generic greetings, mystery attachments, and “your account is about to be suspended — enter your password here.” If the message does any of those, you already have your answer.

If you already tapped

Speed beats embarrassment. Do this in order.

You only opened the page
Close it. Open PayPal yourself. Change the password from a device you trust. Review Activity. Turn on or review two-factor settings. If the page asked for a password, assume it was harvested even if you “backed out.”

You typed a password or approved a prompt
Change the PayPal password immediately. Review linked banks and cards. Check email recovery options and phone numbers you did not add. If you reuse that password anywhere, change those logins too — a password manager stops the next leak from being a pile-up.

You shared a one-time code
Treat the session as stolen. Change the password, revoke sessions if PayPal shows devices you do not recognize, and read what to do if an OTP was shared.

Money left
Same-day: PayPal Resolution Center plus your bank or card issuer. Then ReportFraud.ftc.gov. Full first-day map: What to do if you already paid a scammer. Do not pay a second “recovery agent.”

They want a photo of your ID “to unlock”
Stop. Real identity steps appear after you sign in. A cold text that wants a selfie plus a license is a harvest.

A household line that actually sticks

Say it once at dinner, the same way you would post a fridge rule for bank calls:

If PayPal needs us, we will see it after we open PayPal. We will not fix PayPal from a text.

Older relatives get the extra sentence: if they say do not tell the family, tell the family. Secrecy is a scam feature.

If the next message wears a Google logo instead, use the same muscle: Google account compromised text — verify inside the real account, never through the alert.

Trusted sources

• PayPal — report suspicious emails and texts
• PayPal — how to spot a fake PayPal email or website
• PayPal — report unauthorized activity
• PayPal — common scams
• FTC — how to recognize and avoid phishing
• ReportFraud.ftc.gov

Key takeaways

• A PayPal scam text about an unauthorized payment or a limited account is checked in the app — not in the message.
• Empty Activity plus a screaming SMS means the text is the attack.
• Forward fakes to [email protected], then delete them.
• Password, OTP, ID upload, or money already moved: lock the account the same day and skip the recovery sequel.