How to Spot a PayPal Phishing Email (7 Red Flags)

"Your account has been limited." "Unusual activity detected." "Confirm your information within 24 hours." If you've ever gotten an email like this from "PayPal," you've seen one of the most common phishing templates on the internet.

Real PayPal emails do exist — but scammers copy them almost perfectly. Here's how to tell the difference before you click anything.

1. The sender's address doesn't actually match PayPal

The display name might say PayPal, but the real email address is what matters. Tap or hover over the sender and look at the part after the @. Legitimate PayPal mail comes from domains like paypal.com — not paypa1.com, paypal-secure.net, or service-paypal.com.

2. A link points somewhere other than paypal.com

Before clicking, hover over (or long-press on mobile) any "Log in" or "Verify" button. If the link goes to a random domain instead of paypal.com, it's a trap. Scammers often hide the real destination behind official-looking text.

3. It creates urgency

"Act within 24 hours or your account will be suspended." Urgency is the scammer's favorite tool — it pushes you to act before you think. Real account notices give you time and never threaten instant closure over email.

4. It asks you to "confirm" sensitive details

PayPal will never ask you to confirm your full password, card number, or Social Security number by email. Any message that does is fraudulent, full stop.

5. Generic greetings

"Dear Customer" or "Dear User" instead of your name is a warning sign. Companies that already have your account usually address you by name.

6. Small spelling and grammar mistakes

Odd phrasing, missing words, or strange capitalization often slip through in scam emails. Professional companies proofread; rushed scammers don't.

7. Unexpected attachments

PayPal doesn't send invoices or "account documents" as attachments you need to open. An unexpected PDF or HTML attachment is a red flag.

The safest way to check your PayPal account

Never use the links in a suspicious email. Instead:

1. Open the PayPal app, or type paypal.com into your browser yourself.
2. Log in and check your account directly.
3. If there's a real issue, it will show up there.

Not sure about an email? Forward it to check@fraudroom.com and FraudRoom will check the sender, links, and wording, then reply with a plain-English risk level and the safest next step.

Staying safe online isn't about being an expert — it's about slowing down and getting a second look before you click.