Is the PayPal payment real? How to check "you've been paid" and account alerts.

PayPal impersonation scams target buyers and sellers in different ways, but they share the same goal: get you to act on a message before you check what's actually happening in your account. A seller might receive an email insisting that a payment is being held until the item ships. A buyer might get a "your account has been limited" warning, an invoice for something they never ordered, or a payment request with an urgent phone number attached. PayPal itself warns that criminals routinely spoof payment confirmations, suspension notices, and invoices, and the fix is always the same: verify inside the official app or account, never by replying to the message or clicking the link it contains.

What makes PayPal a popular target for impersonation is that it sits between buyers, sellers, and their bank accounts, so a convincing message about money can trigger action fast – sellers want to get paid, buyers want to avoid losing an item they already paid for, and both groups are used to receiving legitimate transactional emails from the service regularly.

The fake "payment received" scam

A criminal claims to have bought an item and sends a convincing but entirely fake payment confirmation, sometimes saying the funds are "pending," sometimes claiming they accidentally overpaid and asking for the difference back. If the transaction doesn't appear in your actual PayPal Activity, no payment has been confirmed: don't ship the item and don't refund anything based solely on what an email says.

The "limited account" scam

This version threatens suspension and links to a page built to look identical to PayPal's real login, which then asks for a card number, ID document, or a one-time SMS code after you "sign in." Open the app or type the official address in manually instead of clicking through. A genuine account restriction is always visible directly inside the account itself or the Resolution Center: it doesn't require you to hand over new information through an email link.

Fake invoices and support calls

Some scammers abuse PayPal's real invoicing feature to send a legitimate-looking payment request, then attach an alarming note claiming an expensive purchase was just charged and demanding an urgent call to "cancel" it. The phone number in the note doesn't belong to PayPal – its entire purpose is to get you on a call with a fake support agent. PayPal's own guidance is not to pay the invoice and not to call the number listed in it.

This version is particularly effective because the invoice itself is technically real: it was actually generated through PayPal's system, just by a scammer's account rather than a legitimate business. That's why the email can pass basic authenticity checks while the "problem" it describes and the phone number attached to it are entirely fabricated.

Warning signs

• A generic greeting or an artificially urgent tone
• A link or domain that isn't actually PayPal's
• A request for your password, a one-time code, a card number, or an ID document
• A "payment" that only exists in the email, not in your account activity
• Pressure to ship an item before the money actually shows up
• An unfamiliar invoice paired with a "support" phone number
• Any request to pay in cryptocurrency or gift cards

None of these signs need to appear all at once for a message to be worth double-checking. A single request that only exists in an email, with no matching entry in your actual account, is reason enough to stop and verify independently before doing anything else.

What to do

Don't reply to the message and don't click anything in it. Open PayPal directly and check Activity, your notifications, and the Resolution Center for anything matching the claim. If the message is fake, forward it to phishing@paypal.com.

If you already gave up information

Change your PayPal password immediately, along with any other account where you reused it. Turn on two-step verification if it isn't already active. Review the devices and cards linked to your account and remove anything unfamiliar. If you shared banking details, contact your bank directly. Keep the original email, its headers, and screenshots of everything – they're useful if you need to dispute a charge or file a report. If you shipped an item before confirming a payment actually existed, it's still worth documenting the listing, the buyer's messages, and any shipping confirmation, since that record helps if you later dispute the loss with PayPal or your marketplace.

Other variants you'll run into

Beyond the three big patterns above, the same impersonation machinery gets re-skinned constantly. The delivery channel and the story change; the demand to act outside your real account never does.

• The SMS version. A short text – "PayPal: your account is temporarily restricted, verify here" – with a shortened link. Phone screens hide the full URL, and texts feel more urgent than email, which is exactly the point.
• The overpayment refund. A "buyer" claims they sent too much by mistake, shows you a fake confirmation for the higher amount, and asks you to refund the difference through Zelle, a wire, or gift cards. The original payment never existed; your refund is real money leaving your account.
• The off-platform push. On a marketplace listing, the buyer insists on "PayPal only, but let's finish this by email." Moving the conversation off the marketplace removes the platform's fraud checks and lets the scammer control every message you see.
• The friends-and-family request. Someone asks you to receive or send money using the friends-and-family option "to avoid fees." That option carries no purchase protection at all, which is precisely why scammers push it.
• The charity or "money waiting" hook. A message says a payment is being held for you and you only need to confirm your details – or a card number – to release it. Real held funds appear in your account with clear instructions; they never require re-entering credentials through a link.

How it plays out: a realistic example

Mark runs a one-person woodworking shop and sells a $600 side table through an online listing. A buyer agrees quickly – almost too quickly – and minutes later an email arrives that looks exactly like a PayPal payment confirmation: right logo, right formatting, the correct amount. There's one twist: a highlighted note says the funds are "on hold until the seller provides a tracking number." Mark has orders to get out and doesn't want a dispute, so he ships the table the same afternoon and replies with the tracking number as instructed.

Two days later he opens his actual PayPal account to move the money to his bank. There is no payment. There never was one: the confirmation was a fabricated email, and the "buyer" is now unreachable. The table is gone, and because no transaction ever existed inside PayPal, there's nothing for PayPal's dispute process to act on. The lesson costs him a table instead of ruining him, and it's the same one every seller eventually learns: an email can be forged in minutes, but the Activity page in your own logged-in account cannot. If the money isn't there, it doesn't exist, no matter how official the message looks or how impatient the buyer sounds.

Prevention that goes one level deeper

A few settings and habits, configured once on a calm day, make every variant of this scam structurally harder to land. The goal is to remove the decision from the moment of pressure entirely.

• Use an authenticator app for two-step verification. App-based codes are harder to intercept than SMS, and they protect the account even if a phishing page captures your password.
• Log in through a bookmark or the app only. Make it a personal rule that you never reach PayPal through a link in a message. A password manager reinforces this: it won't autofill on a lookalike domain, which is itself a warning.
• Check Activity before you ship – every time. Turn it into a mechanical step of your selling routine, like printing the label. Routine beats judgment under pressure.
• Review linked cards, banks, and devices quarterly. Remove anything you no longer use. A smaller footprint means less to clean up if something goes wrong.
• Warn the sellers in your family. Anyone who sells on marketplaces – a teenager flipping sneakers, a retired parent clearing out furniture – will meet the fake-confirmation trick eventually. Tell them the one rule: no payment in Activity, no shipment.

Quick checklist

• Confirm every payment inside official PayPal Activity, never from an email alone
• Never ship an item before the funds actually appear in your account
• Don't call phone numbers listed inside invoices or payment requests
• Treat requests for passwords, codes, or ID documents as a hard stop
• Report suspicious messages to phishing@paypal.com

Selling online regularly makes it worth building this check into your routine rather than treating it as a one-off precaution. A quick habit of confirming Activity before shipping anything costs a few seconds and closes off almost every version of this scam at once, regardless of how the message itself is dressed up.

Frequently asked questions