Act this weekWhat happenedFake messages that pose as PayPal, some calling themselves a security report or case, try to scare people into tapping a link and giving up their login.
Who is affectedAnyone with a PayPal account who gets an email or text, on iPhone, Android, tablet or computer.
What to do- 1Do not tap any link, button or phone number in the message.
- 2Open the PayPal app or type the PayPal address yourself and check your activity.
- 3Report the message: email to APWG, text to 7726, or either to ReportFraud.ftc.gov.
- 4Delete it, and turn on multi-factor sign-in for PayPal, your email and your bank.
Fake messages that pose as PayPal are circulating by email and text. Some call themselves a security report or a case about your account. Their goal is simple: get you to tap a link and type in your PayPal login.
What these messages do
Phishing is a message that pretends to come from a company you know so that you hand over a password, card number or code. It is not a program on your phone, so there is nothing to uninstall. Harm happens only if you tap the link and sign in on the page that opens. Then the senders can sign in as you.
Official-sounding words such as case number or report ID prove nothing, because anyone can type them. The FTC says real companies do not send links by email or text to update payment details. A real account problem also shows up when you open PayPal yourself.
Anyone with a PayPal account can get one of these, on an iPhone, Android phone, tablet or computer. If you got one and deleted it without tapping anything, you lost nothing. Be wary of any message that only works through its own link, button or phone number. The steps in the alert box above cover what to do.
What is not known
No sample message, list of reported addresses or registration data was available. That leaves it unclear who is behind these messages or how widespread they are. PayPal's own reporting page could not be read, so its instructions are not described here.
The takeawayNever use a link in a PayPal message. Open the app yourself, check your activity, then report and delete the message.