If a PayPal payment isn't yours, don't wait for the seller to respond. If you can still access your account, save the transaction details, secure PayPal and the email account connected to it, report the payment to PayPal, and notify the card issuer or bank that supplied the funds. The relevant deadline depends on the payment method. PayPal's 180-day Purchase Protection window isn't a universal deadline for every type of fraud claim.

These steps are for U.S. consumers. PayPal procedures and banking protections can differ in other countries.

Do these things immediately

1. Secure PayPal and your email

Sign in by typing PayPal's address yourself or by using the official app. Don't use a link or phone number from a suspicious message.

If you can sign in:

• Change your PayPal password to a unique password. Change it anywhere else you reused it.
• Change the password for your email account if it may also be exposed.
• Turn on two-step verification or a passkey if the option is available.
• Review recent logins, connected apps, automatic payments, saved payment methods, and contact details. Remove anything you don't recognize.
• Ask the card issuer to lock or replace a linked card if its number may have been exposed.

If you're locked out, open PayPal's official Help or Contact page yourself. Never give a password, security code, or one-time verification code to someone who claims they can recover your money.

2. Check and save the transaction details

Open PayPal's Activity section and record:

• The date, amount, status, and transaction ID
• The merchant name and description
• The funding source, such as PayPal balance, debit card, credit card, or bank account
• Whether the payment is an automatic payment or subscription

Take a screenshot of the full transaction before account details change. An unfamiliar merchant name isn't proof of fraud by itself. It could be a household purchase, a recurring payment, a temporary authorization, or a business using a different billing name. Check those possibilities promptly. If nobody authorized the payment, continue with the report.

If the charge appears only on a card statement and not in PayPal Activity, call the issuer using the number on the back of the card. It may be a PayPal-processed transaction that doesn't appear as activity inside your account.

3. Report it to PayPal

Select the transaction in Activity and look for Report a problem, Report unauthorized activity, or a similar option. The wording can vary by app version and account type.

Describe the facts plainly:

• You didn't make or authorize the payment.
• The amount and date are [amount and date].
• You still control the account, or you believe someone else accessed it.
• You changed your password and checked for other suspicious activity.
• You found other unfamiliar payments or account changes, if any.

Save the confirmation screen, case number, and any deadline shown in the Resolution Center. If the reporting option isn't available, use PayPal's official support route after signing in or open its Help page manually. You don't need to wait for a seller to answer before reporting a payment you didn't authorize.

4. Notify the provider that funded the payment

A PayPal report doesn't automatically replace the dispute process for the card or bank account behind the payment.

• Credit card: Ask the issuer how to submit a billing-error dispute and whether the card should be replaced.
• Debit card: Contact the bank immediately and ask for its procedure for an unauthorized electronic transfer.
• Bank account or ACH payment: Notify the bank promptly and ask what options are available for the payment, future debits, and account protection.
• PayPal balance: Continue through PayPal's account and transaction process.

For a U.S. credit-card billing error, the Federal Trade Commission says the issuer must receive a written dispute within 60 days after the first statement containing the error was sent. Keep a copy of the letter and proof that it was delivered. Under that process, the issuer generally must acknowledge the complaint within 30 days and resolve it within 90 days.

The 60-day written-notice rule is a credit-card billing-error rule. It isn't a universal PayPal deadline and doesn't automatically govern debit cards, bank-account transfers, or a PayPal balance. Don't let a PayPal review make you miss a time-sensitive deadline from your card issuer or bank.

5. Watch every linked account

Turn on transaction alerts and check PayPal, card, and bank activity for further attempts. Look for:

• New automatic payments
• Unknown shipping addresses or phone numbers
• New linked cards or bank accounts
• Password-reset emails you didn't request
• Small test charges followed by larger or repeated payments

If the same card or bank account is being targeted, ask the provider whether it should be blocked or replaced.

Make sure "unauthorized" is the right category

PayPal can treat account takeover, a purchase problem, and a payment made after a scam differently.

Someone else using your credentials can still make a payment unauthorized. The reverse is also true: if you personally clicked approve, entered a verification code, or sent the money after being deceived, PayPal or the bank may classify it as an authorized payment. Give an accurate account of what you did and what the scammer told you rather than choosing a category that doesn't fit.

What PayPal's 180-day deadline covers

PayPal's U.S. Purchase Protection terms say an eligible purchase dispute generally must be opened within 180 days of the date you sent the payment to the seller. For certain orders, the terms also state that the dispute must be opened within 30 days of delivery or fulfillment, as applicable, or within 180 days of payment, whichever comes sooner.

Those are purchase-dispute rules. They cover issues such as non-delivery or a qualifying problem with the item. They shouldn't be treated as a guaranteed, one-size-fits-all deadline for unauthorized account activity, an ACH transfer, a debit-card transaction, or a payment made after a scam. The payment method, country, account, and dispute category can change the process.

Report suspected unauthorized activity as soon as you see it. Use the deadline displayed in your PayPal case, and ask support which policy applies if the category is unclear. A search result that says every PayPal fraud claim has 180 days isn't enough.

PayPal dispute or card dispute?

The payment rail determines which provider can investigate and return the funds.

Use PayPal's process when the payment is visible in Activity or the issue involves access to your PayPal account. Contact the card issuer when the charge is posted to a credit or debit card, particularly if the card itself may be compromised or the issuer's deadline is approaching. Contact the bank for a payment drawn from a bank account or sent by ACH.

You may need to tell more than one provider what happened, but don't assume that opening reports creates a right to two refunds. PayPal's Purchase Protection terms say a buyer can't pursue a Buyer Protection claim and a card-issuer claim for the same purchase at the same time or receive a double recovery. That restriction doesn't mean you should ignore a bank or card deadline. Tell each provider what you've already reported and follow its instructions about which route should handle the final recovery.

If PayPal or another provider gives you a temporary or permanent credit, notify the other provider. Don't keep two credits for the same transaction.

Keep an evidence file

Make a short timeline while the details are fresh. Keep:

• A screenshot of the PayPal transaction and its full details
• The transaction ID, amount, date, currency, and funding source
• The statement showing the charge
• PayPal emails, login alerts, password-reset messages, and security notifications
• A list of unfamiliar account changes
• Messages with the merchant or scammer
• Confirmation numbers from PayPal, the card issuer, and the bank
• Copies of written disputes and proof that they were sent

Don't edit screenshots or overstate what happened. Note what you recognize, what you don't, and when you first noticed the payment. Keep your full card number, passwords, security answers, and one-time codes out of messages and attachments.

Short PayPal report template

I am reporting an unauthorized PayPal transaction.

Transaction ID: [transaction ID]
Date and amount: [date and amount]
I did not make or authorize this payment. I noticed it on [date]. I have changed my password and reviewed my account for additional unauthorized activity. Please investigate the transaction and confirm the next steps.

Credit-card dispute template

Use this wording only when the card payment truly was unauthorized:

I dispute the [amount] PayPal-related charge posted on [date] as an unauthorized billing error. Please treat this as a written billing-error notice and tell me what supporting documents you require. I have also reported the transaction to PayPal.

Send the notice using the issuer's billing-dispute instructions and keep a copy. A phone call creates a record, but it may not replace the written notice required for the federal credit-card billing-error process.

After you report the payment

PayPal may ask questions, request documents, or set a response deadline in the Resolution Center. Check the case itself instead of relying only on an email reminder. Reply through the official case channel and save each submission.

There isn't one dependable refund timeline for every PayPal unauthorized-charge case. The review can take different amounts of time depending on the payment method, account records, and information requested. If PayPal approves a refund, the posting time can also vary depending on whether the money goes to your PayPal balance, card, or bank account.

If PayPal denies the claim:

1. Read the reason and identify the specific fact PayPal relied on.
2. Use the appeal option in the case if one is available, and follow the displayed deadline.
3. Submit relevant new evidence, such as proof of account takeover, a security alert, or information showing that you weren't the person who approved the payment.
4. Ask support to explain the appeal process and keep the case number.
5. After completing PayPal's process, consider using the Consumer Financial Protection Bureau complaint portal for a U.S. financial-services complaint if you still need help.

A CFPB complaint doesn't guarantee a refund and doesn't extend PayPal's or a card issuer's deadline. Send any time-sensitive notice to the bank or credit-card issuer separately.

Extra steps for common situations

Automatic payment or subscription

Cancel the automatic payment in PayPal and, when appropriate, cancel the subscription with the merchant. Cancellation normally addresses future payments; it doesn't by itself reverse a charge that already posted. Report a completed payment separately if you didn't authorize it.

Hacked account

Secure the email account as well as PayPal. Remove unknown devices, apps, and payment methods, then check whether someone changed your phone number, address, or recovery information. Tell PayPal that the account may have been accessed by someone else and provide the timeline of suspicious changes.

Small or test charge

A small unfamiliar charge still belongs in the report. Check for larger or repeated attempts and ask the card issuer whether the card should be replaced.

Payment made after a scam

If you approved a transfer, entered a verification code, or sent money because someone deceived you, report those facts as a scam rather than automatically calling the payment unauthorized. Ask PayPal and the bank whether the payment can be stopped or recovered. Don't send additional money to anyone promising a refund.

Reduce the chance of another PayPal fraud attempt

• Keep PayPal and your email on separate, strong passwords, and use two-step verification or a passkey when available.
• Review automatic payments, connected apps, and saved payment methods regularly.
• Turn on PayPal, card, and bank transaction alerts.
• Sign in through the official app or a manually typed address, not an unexpected email link.
• Never give a caller or message sender your password, security code, or one-time passcode.
• Replace a payment card if its details were exposed.
• Keep screenshots and case numbers until the PayPal dispute and any bank or card review are finished.

If the charge is on your screen now, save its details, secure the accounts, open the appropriate report, and call the provider that funded it before any applicable deadline passes.