NewsCompaniesFlawsGuides
Get the app

Is PayPal safe?

From Is it safe?, in the HARD wiki · Updated
This article is about the PayPal payment app. For other apps, see Is it safe?.

Safe to use: PayPal is a long-established service, and checkout and Goods and Services payments get Purchase Protection; Friends and Family payments don’t, so never use them with strangers.

PayPal is a legitimate payment service. When you check out with PayPal or send a Goods and Services payment, an eligible item that never arrives or is significantly not as described can be refunded under its Purchase Protection programme, if you open a dispute in time.

The risks are scams that borrow PayPal’s name: fake emails and texts, fake invoices and money requests sent through PayPal itself, and sellers who ask for Friends and Family payments. In January 2025 New York’s financial regulator fined PayPal US$2 million over a 2022 security lapse.

PayPal, Inc. runs PayPal for US users from San Jose, California, and also owns Venmo. US accounts are only for residents aged 18 or over.[1][2][3]

The real risks

What PayPal itself says it collects, what regulators and courts have found, its security record and the scams that borrow its name. Each line links to the page it comes from.

What it collects

From PayPal’s own privacy policy:

  • Identity and contact details: name, address, phone, email, government ID, signature and, for some services, Social Security or tax ID numbers.[2]
  • Financial details: bank account and routing numbers, card details, balances, and the transactions you send, receive or request.[2]
  • Shopping data: carts, purchase history, products viewed on partner sites, shipping addresses and order tracking.[2]
  • Device and location data, including IP address, device IDs and, with your consent, precise GPS location while you’re logged in to a financial account.[2]
  • Biometric data such as face scans or voice, if you agree, to confirm it’s you. PayPal keeps it no more than three years after your account closes.[2]
  • Inferences such as income, shopping habits and creditworthiness. PayPal may share shopping preferences with merchants unless you opt out in Data and Privacy settings.[2]

App store label. Apple’s label says PayPal may use usage data to track you across other companies’ apps and websites, and uses name, product interaction and advertising data for third-party advertising. Data linked to you includes location, contacts, search and browsing history, purchases and financial info. Rated 4+.[4]

Regulators and courts

Fines, orders, investigations and lawsuits, newest first. A lawsuit is what the side bringing it alleges until a court decides.

WhenWhat happened
New York’s financial regulator (NYDFS) fined PayPal US$2 million under its cybersecurity rules. It found that untrained teams made the change that exposed customers’ tax forms, that two-step verification wasn’t required, and that basic login protections were missing.[5][6]
PayPal agreed to settle FTC allegations about its Venmo app: unclear warnings that money could be frozen or reversed, confusing privacy settings, and false ‘bank grade security’ claims. The order runs 20 years.[7]

Breaches and security flaws

  • : Attackers used passwords stolen elsewhere to log in to PayPal accounts and view 1099-K tax forms showing names, dates of birth and full Social Security numbers. PayPal added protections, masked the data and forced password resets, according to NYDFS.[6]

Scams that use PayPal

Fake invoices and money requests
A real PayPal invoice or money request arrives for something you never ordered, often with an alarming note telling you to call a ‘customer service’ number. Don’t pay it or call the number; report it in the PayPal app or website.[8]
Phishing emails and texts
A message warns your account will be suspended or links to a fake login page. PayPal says its emails always use your first and last name, never ‘Dear user’. Forward suspicious ones to [email protected].[9][10]
Fake calls from ‘PayPal’
Scammers fake caller ID, ask for passwords or one-time codes, or leave automated messages asking you to call back. PayPal says it never asks for these; contact it only through its Help Center.[3][8]
‘Pay me with Friends and Family’
A seller asks you to pay with a Friends and Family payment. PayPal says refuse: the scammer knows that payment isn’t covered by Purchase Protection.[11]
Overpayments and fake ‘you’ve been paid’ emails
A ‘buyer’ says they overpaid and asks you to send back the difference, or emails a fake payment notice. Log in to PayPal to check. Payments made with stolen cards can later be taken back.[9][8]
Shipping tricks against sellers
A buyer asks you to use their shipping account or prepaid label, then reroutes the parcel and claims it never arrived. PayPal says ship only to the address on the Transaction Details page.[8]

What to do

In order, with the place to find each one in PayPal.

  1. Turn on 2-step verification.On the PayPal website, click Settings → Security → Set Up under 2-step verification, then choose an authenticator app or Text me a code. PayPal will never ask you for this code.[12]
  2. Create a passkey.Go to PayPal’s Passkey Creation page and follow the prompts to sign in with your face, fingerprint or device PIN instead of a password. Review or remove passkeys on the Passkey Management page.[13]
  3. Check your automatic payments.Go to Settings → Payments → Subscriptions and saved businesses (or Automatic Payments), select any merchant you don’t recognise or no longer use, and cancel it.[14]
  4. Turn on app notifications.Turn on push notifications in the PayPal app to get real-time alerts about unusual activity PayPal detects or blocks on your linked cards.[15]
  5. Opt out of shopping data sharing.Log in, open Data and Privacy settings and edit your preferences to stop PayPal sharing your information with merchants for personalised shopping.[2]
  6. Pick the right payment type.When buying, choose ‘Paying for an item or service’ (Goods and Services). Use ‘Sending to a friend’ only for people you know, such as splitting a bill.[16]

When not to use it

  • Paying anyone you don’t know with Friends and Family. PayPal says personal payments aren’t covered by Purchase Protection, so there is no claim to make if the item never comes.[16][17]
  • Paying a rental or property deposit, or for a car or a business, to someone you haven’t met: real estate, most vehicles, businesses and gift cards are excluded from Purchase Protection.[17][11]
  • Paying an invoice or money request you didn’t expect, or calling a phone number written in one.[8]
  • Sending money to someone met online for romance, a ‘no-risk’ investment, or a debt a ‘government agency’ says you owe.[11]

What HARD couldn’t verify

Claims you may see elsewhere that HARD couldn’t confirm from a primary source on 7 Nov 2026, so they aren’t in the record above.

  • Figures that the December 2022 incident affected about 35,000 accounts come from PayPal’s breach notices to state attorneys general, which HARD could not load; the NYDFS order does not give a number.

Questions

Is PayPal safe?

Yes, for most uses. PayPal offers 2-step verification and passkeys, and eligible checkout and Goods and Services purchases are covered by Purchase Protection. The main risks are fake messages and invoices, and paying strangers with Friends and Family, which isn’t protected.

Is PayPal legit?

Yes. PayPal, Inc. is a long-established payment company based in San Jose, California, and it also owns Venmo. Its most recent regulator penalty HARD found was US$2 million from New York’s financial regulator in January 2025, over a 2022 security lapse.

Is PayPal safe to receive money from strangers?

Receiving money is safe in itself, but sellers are targeted. Scammers send fake ‘you’ve been paid’ emails, overpay and ask for change back, or pay with stolen cards that are later reversed. Always log in to PayPal to check a payment is real before you ship.

Does PayPal protect Friends and Family payments?

No. PayPal says personal payments aren’t covered by Purchase Protection. Eligible checkout purchases and Goods and Services payments are, but some things are excluded, including property, most vehicles and gift cards.

How long do I have to open a PayPal dispute?

For an item that never arrived, within 180 days of paying. For an item significantly not as described, within 30 days of delivery or 180 days of paying, whichever is sooner.

Can kids use PayPal?

Not on their own. A US PayPal account requires you to be at least 18, or the age of majority in your state.

Paying people on HARD: Is Cash App safe?, Is Zelle safe?, Is Venmo safe?. All of them: Is it safe?

References

Primary sources only: PayPal’s own pages, regulators, courts and app stores. Each was checked on 7 Nov 2026.

  1. PayPal, Inc.. PayPal User Agreement, 4 Nov 2026. paypal.com, checked 7 Nov 2026
  2. PayPal, Inc.. PayPal Privacy Statement, 12 Oct 2026. paypal.com, checked 7 Nov 2026
  3. PayPal. How to identify fake messages. paypal.com, checked 7 Nov 2026
  4. Apple. PayPal - Pay, Send, Save on the App Store. apps.apple.com, checked 7 Nov 2026
  5. New York State Department of Financial Services. Superintendent Adrienne A. Harris Secures $2 Million Cybersecurity Settlement with PayPal, Inc., 23 Jan 2025. dfs.ny.gov, checked 7 Nov 2026
  6. New York State Department of Financial Services. Consent Order: PayPal, Inc., 23 Jan 2025. dfs.ny.gov, checked 7 Nov 2026
  7. Federal Trade Commission, via the Federal Register. PayPal, Inc.; Analysis To Aid Public Comment (Venmo consent agreement), 5 Mar 2018. federalregister.gov, checked 7 Nov 2026
  8. PayPal Help Center. What are common scams and how do I spot them?. paypal.com, checked 7 Nov 2026
  9. PayPal Help Center. How do I spot a fake, fraudulent, or phishing PayPal email or website?. paypal.com, checked 7 Nov 2026
  10. PayPal. How to Report Suspicious Emails & Messages. paypal.com, checked 7 Nov 2026
  11. PayPal Help Center. What are ‘Friends and Family’ payment scams?. paypal.com, checked 7 Nov 2026
  12. PayPal. Account Security: Protect Your PayPal Account. paypal.com, checked 7 Nov 2026
  13. PayPal Help Center. What is a passkey and how do I use it to log in to my PayPal account?. paypal.com, checked 7 Nov 2026
  14. PayPal Help Center. What is an automatic payment and how do I update or cancel one?. paypal.com, checked 7 Nov 2026
  15. PayPal. PayPal Security: Protect Your Financial Data. paypal.com, checked 7 Nov 2026
  16. PayPal Help Center. What’s the difference between friends and family or goods and services payments?. paypal.com, checked 7 Nov 2026
  17. PayPal, Inc.. PayPal’s Purchase Protection Program, 26 Jan 2026. paypal.com, checked 7 Nov 2026