PayPal's safety depends on which direction the money moves
PayPal is safer than handing cash to a stranger, but not equally safe for every transaction type. If you send money to someone you know and trust, PayPal's fraud detection catches most criminals before they touch your account. If you send money to a stranger or buy something from an unfamiliar seller, PayPal Buyer Protection covers you if the item never arrives or comes damaged — but only if you used PayPal's checkout, not a bank transfer or wire through PayPal's system.
The real risk is not PayPal losing your money to hackers. The real risk is someone getting into your PayPal account and sending your money out, or you sending money to a scammer and having no way to reverse it. PayPal's protections are strong against the first scenario and weak against the second.
Key Takeaways
- PayPal Buyer Protection covers purchases made through PayPal's checkout, but not money sent as a personal transfer or wire.
- If your account is hacked, PayPal's fraud liability limits your loss to $0 if you report it within 60 days, but you must act fast.
- Money sent to a scammer as a "friends and family" transfer or wire cannot be reversed, even if PayPal later confirms it was fraud.
- Linking a bank account or card to PayPal adds a layer of security because PayPal can freeze the account if fraud is detected, but it also means a hacked PayPal account can drain your bank account.
- Two-factor authentication and a strong password reduce the chance of account takeover, but they do not protect you if you voluntarily send money to a criminal.
What PayPal Buyer Protection actually covers
PayPal Buyer Protection covers purchases you make through PayPal's checkout on a seller's website or on eBay. If the seller ships you nothing, ships you something broken, or ships you something that does not match the listing, you can file a claim within 180 days. PayPal will investigate, and if the seller cannot prove they shipped a working item, PayPal refunds you from the seller's account.
This protection does not apply if you sent money as a personal transfer (labeled "friends and family" or "send money to friends"), even if you were buying something. It does not apply if you used a wire transfer or bank transfer through PayPal. It does not apply if you paid with a credit card outside of PayPal's system. The protection exists only for transactions PayPal can see and control.
If you are buying from a stranger, use PayPal's standard checkout and pay as a "goods and services" transaction, not as a personal transfer. The seller will pay a small fee, but you will have a paper trail and recourse if something goes wrong.
What happens if your PayPal account is hacked
If someone breaks into your PayPal account and sends money out, PayPal's fraud liability policy says you are not responsible for the loss — but only if you report it within 60 days. After 60 days, you may be liable for the full amount. This is why checking your account regularly matters: the faster you spot unauthorized activity, the faster you can report it and lock down your liability.
When you report unauthorized activity, PayPal freezes the account and begins an investigation. During this time, your money is held and you cannot access it. The investigation typically takes 10 business days, though it can stretch longer if PayPal needs to contact the recipient or a bank. Once PayPal confirms the activity was fraudulent, it reverses the transaction and returns your money to your account.
The catch: if the recipient has already withdrawn the money to their bank account, PayPal may not be able to recover it. PayPal can ask the receiving bank to reverse the transfer, but the bank is not obligated to comply if the recipient claims the money was legitimate. In practice, PayPal recovers most fraudulent transfers within a few weeks, but some are lost permanently.
Money sent to a scammer cannot be reversed
If you voluntarily send money to someone through PayPal — whether as a personal transfer, a wire, or even through the goods-and-services checkout — and that person turns out to be a scammer, PayPal cannot reverse the transaction. The money is gone. This is the biggest gap in PayPal's safety net.
A scammer might pose as a seller, a landlord, a job recruiter, or someone selling a car. You send the money in good faith. Days later, you realize the listing was fake, the job was fake, or the person never intended to send you anything. You contact PayPal and ask for your money back. PayPal will tell you that you sent the money voluntarily to an account holder, and that reversing voluntary transfers would expose PayPal to abuse. They will not reverse it.
The only exception is if you used PayPal's goods-and-services checkout and can prove the seller did not ship the item or shipped something that does not match the listing. Then you have Buyer Protection. But if you sent money as a personal transfer or wire, or if you sent it to someone you thought was a friend, PayPal treats it as a completed transaction and will not touch it.
How to reduce the risk of account takeover
The most common way someone breaks into a PayPal account is by reusing a password from another website that was hacked. If your email and password were exposed in a breach at Target, LinkedIn, or any other site, a criminal can try that same combination on PayPal. If it works, they have access to your money.
Use a unique, strong password for PayPal — one you do not use anywhere else. A password manager like Bitwarden or 1Password can generate and store a 16-character random password so you do not have to remember it. Change your password every six months, or immediately if you learn that a website you use was hacked.
Turn on two-factor authentication in your PayPal security settings. This means that even if someone has your password, they cannot log in without a code from your phone. PayPal offers authentication through an app (like Google Authenticator), SMS text, or a security key. An app or security key is more secure than SMS, because SMS can be intercepted. Two-factor authentication does not prevent you from sending money to a scammer, but it does prevent someone else from logging into your account and sending your money out.
Linking a bank account or card: convenience versus risk
When you link a bank account or debit card to PayPal, you make it easier to send money and load your PayPal balance. But you also give PayPal the ability to pull money directly from your bank account if a transaction fails or if you dispute a charge. If your PayPal account is hacked, the hacker can drain your linked bank account, not just your PayPal balance.
If you must link a bank account, link a savings account with a low balance rather than your primary checking account. This limits the damage if fraud occurs. Check your bank account regularly for unauthorized withdrawals, just as you would check PayPal. Report any suspicious activity to your bank within 60 days to limit your liability.
A credit card is safer to link than a bank account, because credit card fraud is easier to dispute and credit card companies have stronger fraud protections than banks. If you link a card, use one with a low credit limit or a card you do not use for other purchases.
Red flags that signal a PayPal scam
Before you send money through PayPal, watch for these warning signs. A seller asking you to send money as a personal transfer instead of through their checkout is a red flag — legitimate sellers want the transaction recorded. Someone asking you to send money to a different PayPal account than the one listed on their website is a red flag. A job offer that asks you to pay upfront for training, equipment, or a background check is a red flag.
If a deal seems too good to be true — a rental listing far below market rate, a car priced 30 percent below book value, a job paying $50 an hour for no experience — it probably is. Scammers use artificially low prices to lure people in. Do not send money until you have verified the seller's identity through a phone call, video chat, or in-person meeting.
If you are buying something, use PayPal's goods-and-services checkout and pay through PayPal's website or app, not through a link in an email or text. Phishing emails that look like they come from PayPal often direct you to a fake login page designed to steal your password. Go directly to paypal.com instead of clicking a link.
What to do if money is sent from your account without permission
Log into your PayPal account and go to your transaction history. Look for any transfers you did not make. If you find unauthorized activity, click on the transaction and select "Report a Problem." Choose "Unauthorized Transaction" and describe what happened. PayPal will freeze your account and begin an investigation.
While the investigation is underway, change your PayPal password immediately. Check your linked bank account and credit card for other unauthorized charges. If your email or password was compromised, change your email password too, and check for any other accounts that might use the same password.
Contact your bank or credit card company and let them know your PayPal account was compromised. They can flag your account for fraud and monitor for suspicious activity. Keep records of all communications with PayPal and your bank — dates, times, names of representatives, and what they told you. You may need this documentation if the dispute takes weeks to resolve.
Frequently Asked Questions
Is PayPal safer than a credit card for online shopping?
PayPal and credit cards offer different protections. Credit cards have stronger fraud liability laws — you are not responsible for unauthorized charges over $50. PayPal Buyer Protection covers items that do not arrive or do not match the listing, which credit cards do not always cover. For shopping, use whichever method the seller offers, and check that you are using their official checkout, not a link in an email.
Can PayPal see my bank account password?
No. When you link a bank account to PayPal, you give PayPal permission to pull money from that account, but PayPal does not store your bank password. You log into your bank separately to authorize the connection. However, if your PayPal account is hacked, the hacker can still use the linked bank account to send money out, so monitor your bank account regularly.
What if I sent money to a scammer and PayPal refuses to reverse it?
If you sent money as a personal transfer or wire, PayPal will not reverse it. Your only option is to contact your bank or credit card company if you paid PayPal with a card, and ask them to dispute the charge. This works only if you funded the transfer with a credit card, not with money already in your PayPal balance. If the money came from your PayPal balance, it is gone.
Do I need to use PayPal, or can I just use my credit card directly?
You can use a credit card directly on most websites. Credit cards offer strong fraud protection and are easier to dispute if something goes wrong. PayPal adds a layer of privacy — the seller does not see your card number — but it does not offer stronger protection than a credit card for most purchases. Use whichever method feels safest to you.
How often should I check my PayPal account for fraud?
Check at least once a week if you use PayPal regularly, or once a month if you use it rarely. The faster you spot unauthorized activity, the faster you can report it and protect yourself. Set up email notifications for all transactions so you are alerted immediately when money moves in or out of your account.