How to recover hacked PayPal account
If your PayPal account was hacked, fast action can limit unauthorized payments, protect your linked bank accounts, and help you regain control.
This guide explains exactly what to do, what PayPal checks during recovery, and how to harden your account afterward.
PayPal accounts are common targets because they can be tied to debit cards, credit cards, bank accounts, and online purchases.
The recovery process depends on whether the attacker changed your password, locked you out, or used your account for unauthorized transactions.
First steps to take immediately
Act in this order to reduce damage and preserve evidence for PayPal support and your bank.
- Change your PayPal password if you still have access.
- Change the password on the email address linked to PayPal.
- Review recent activity for payments, refunds, address changes, and new linked cards.
- Remove unknown devices, phone numbers, and bank accounts if you can still sign in.
- Contact your card issuer or bank if a linked funding source was used without permission.
- Enable every available security alert in PayPal and your email account.
What to do if you can still log in
If the attacker has not locked you out, you may be able to secure the account before more damage is done.
Start with password changes, then review every linked recovery method and payment method.
Change your PayPal password
Choose a long, unique password that has never been used anywhere else.
A password manager can generate and store a strong password, which reduces the risk of credential-stuffing attacks.
Update your email password too
Many account takeovers begin with email compromise.
If an attacker can reset your PayPal password through your email inbox, regaining PayPal access alone will not be enough.
Review account settings
Check for changes to the primary email address, phone number, recovery questions, and linked financial accounts.
Remove anything you do not recognize and verify every notification preference.
Turn on two-factor authentication
Two-factor authentication adds a second verification step, usually a code sent to your phone or generated by an authenticator app.
This is one of the most effective defenses against unauthorized access.
What to do if you cannot log in
If the hacker changed your password or recovery details, use PayPal’s account recovery and security support options immediately.
Do not create a new account to ignore the issue; that can make it harder to trace fraud and restore access.
Use PayPal’s password reset flow
Go to the PayPal sign-in page and select the option to recover or reset your password.
Use the email address or phone number originally linked to the account if possible, since that helps PayPal verify ownership.
Contact PayPal support
Use PayPal’s Help Center or customer support channels to report unauthorized access.
Be ready to provide identifying details such as your full name, email address, recent transaction amounts, linked cards, and the approximate time you lost access.
Document the account takeover
Save screenshots of suspicious emails, unknown logins, unauthorized transactions, and any account-change notifications.
This evidence can speed up support review and may be useful for your bank or card issuer.
How to report unauthorized PayPal transactions
Once you regain access, review the Activity page carefully for payments you did not approve.
File disputes quickly, because transaction timelines can affect eligibility for resolution under PayPal’s buyer protection and financial institution policies.
- Open the transaction details and mark the item as unauthorized if that option is available.
- Follow PayPal’s resolution center instructions for the specific payment.
- Notify your card issuer or bank if the money came from a linked debit card, credit card, or bank account.
- Ask whether your payment method needs a replacement card or fraud hold.
If the attacker changed shipping addresses, added new recipients, or used your balance to pay for goods, mention those details in your report.
The more precise your report, the easier it is to trace where the fraud occurred.
How to check whether your email was compromised
Because PayPal security depends heavily on email access, check whether your email account shows signs of compromise.
Look for unfamiliar login alerts, forwarding rules, deleted messages, or recovery-email changes.
Common signs of email compromise
- Password reset emails you did not request
- Messages moved to trash or archived automatically
- New forwarding addresses or filters
- Alerts from a device or location you do not recognize
If your email was compromised, secure it before trying repeated PayPal recovery attempts.
Otherwise, the attacker may continue intercepting recovery links and security alerts.
How PayPal verifies account ownership
PayPal may ask for information that matches the original account profile.
This can include an email address, phone number, billing details, past transactions, or identity verification documents depending on the case.
Use accurate information and avoid guessing.
Inconsistent details can delay recovery, especially if the hacker changed contact information or if the account is being reviewed for suspicious activity.
How to secure your devices after a hack
Account takeovers sometimes happen because malware, browser extensions, or phishing sites captured login credentials.
Securing the device that accessed PayPal is just as important as fixing the account.
- Run a full malware scan using reputable security software.
- Remove suspicious browser extensions and unknown apps.
- Update your operating system, browser, and password manager.
- Clear saved passwords from shared or public devices.
- Log out of PayPal on all devices and sessions if the option is available.
How to protect your PayPal account from future attacks
Once the account is recovered, strengthen every layer of protection so the same issue does not happen again.
Most successful attacks rely on reused passwords, phishing, or weak email security.
Use unique credentials
Never reuse your PayPal password on other websites.
Credential stuffing is common, and a password exposed in one breach can be used to attack multiple services.
Prefer an authenticator app
If PayPal offers authenticator-based two-factor authentication for your region or account type, it is generally stronger than SMS codes.
Authenticator apps are less vulnerable to SIM-swap attacks and text interception.
Watch for phishing messages
Attackers often send emails that look like PayPal notices about failed payments, account suspension, or verification requests.
Always sign in directly through the official PayPal website or app rather than clicking message links.
Review account activity regularly
Check your recent transactions, login alerts, and linked payment methods at least weekly if you use PayPal frequently.
Early detection usually means less financial loss and a faster recovery.
When to involve your bank or card issuer
If an unauthorized transaction touched your bank account or card, contact that financial institution even if PayPal is investigating.
Banks and card issuers may be able to block future charges, issue a new card, or open a fraud case faster than PayPal alone.
Act especially quickly if you see multiple small test charges, cash-like transfers, or unfamiliar recurring payments.
These patterns often indicate that the attacker is testing whether your funding sources are still active.
What not to do during recovery
Some actions make recovery harder or create more risk.
Avoid these common mistakes while you secure the account.
- Do not ignore email alerts that mention account changes or logins.
- Do not share verification codes with anyone claiming to be support.
- Do not reuse a password that was exposed elsewhere.
- Do not keep using a device you suspect is infected.
- Do not wait days before reporting unauthorized transactions.
Recovering a hacked PayPal account is usually a combination of account access recovery, fraud reporting, and device security cleanup.
The faster you secure your email, reset credentials, and document suspicious activity, the better your chance of limiting losses and restoring control.
If you want the strongest protection going forward, combine a unique password, two-factor authentication, clean devices, and regular transaction reviews.
That layered approach is the most reliable way to keep PayPal secure after an account compromise.