Consumer complaint received 2026-03-16 00:00:00
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Fraud or scam — 
Company: Paypal Holdings, Inc
State: NJ

Complaint narrative:
CFPB Complaint Unauthorized PayPal Account Access and Fraudulent Transfers I am filing this complaint regarding a serious security breach and fraudulent transactions involving my PayPal account. An unauthorized individual gained access to my PayPal account, altered my account contact information, and conducted multiple unauthorized transfers using my connected bank account. The unauthorized user first changed my primary contact email address, which prevented me from receiving notifications about account changes and transactions. Using this new email address, the subject logged into my PayPal account and initiated transfers from my connected XXXX XXXX XXXX account into PayPal without my authorization. Once the funds were transferred into PayPal, the subject quickly moved the funds out using debit card withdrawals and other transfers. According to PayPal representatives, the unauthorized individual also added a XXXX XXXX XXXX account to my PayPal account. After completing the transfers, the subject removed both the fraudulent email address and the XXXX XXXX account from my PayPal account history. The most concerning aspect of this incident is that the PayPal application interface did not clearly indicate that funds were being redirected to a different bank account. When initiating transfers within the PayPal application, the interface displayed my legitimate XXXX XXXX XXXX account with the correct last XXXX digits, which is the same account used for my normal transfers. However, the funds were ultimately routed to XXXX XXXX XXXX account ending in XXXX, which I do not own and did not authorize. Because the PayPal interface displayed my legitimate bank account during the transfer process, I reasonably believed I was transferring funds to my own account as I had done many times previously. Fraudulent Transactions Identified On XX/XX/year>, multiple unauthorized transactions occurred on my PayPal account. Unauthorized Deposits Into PayPal ( from XXXXXXXX XXXX XXXX XXXXXXXX account ) XX/XX/year> {$2900.00} Transaction ID : XXXX {$2900.00} Transaction ID : XXXX {$2900.00} Transaction ID : XXXX {$2900.00} Transaction ID : XXXX Total unauthorized transfers from my bank into PayPal : {$11000.00} Unauthorized Withdrawals From XXXX XX/XX/year> {$1900.00} Transaction ID : XXXX {$1900.00} Transaction ID : XXXX {$980.00} Transaction ID : XXXX {$980.00} Transaction ID : XXXX Total unauthorized withdrawals : {$5900.00} Then an Additional Unauthorized Activity and Large Withdrawal The PayPal transaction history also shows a significant withdrawal that occurred after the earlier fraudulent activity. XX/XX/year> {$31000.00} General Payment : XXXX XXXX XXXX, XXXX XXXX ID : XXXX ( Net after fees : {$30000.00} ) Immediately following that transaction, a large withdrawal occurred : {$33000.00} User Initiated Withdrawal XXXX XXXX XXXX XXXX XXXXXXXX logo and last XXXX digits of my typical account appeared on the PayPal App ) Transaction ID : XXXX This large withdrawal appears in the PayPal transaction history on XX/XX/year> and represents a substantial movement of funds through the compromised account. Because this withdrawal occurred after the earlier fraudulent deposits and withdrawals, it further demonstrates that the account had been compromised and used to move significant funds through PayPal. These transactions were not authorized by me and occurred after the unauthorized individual altered my account contact information. Security and Consumer Protection Concerns This incident raises serious concerns regarding PayPals security controls and consumer protections. Specifically : PayPal allowed an unauthorized user to change my primary email address without effective notification A new external bank account ( XXXX XXXX XXXX ) was added without clear alerts Transfers appeared to show my legitimate bank account during the process while funds were actually redirected The fraudulent bank account and email were removed from the account history after the transfers, making the fraud difficult to detect These failures allowed the unauthorized individual to manipulate my PayPal account and conceal fraudulent activity. Requested Resolution I am requesting that PayPal : Conduct a full fraud investigation of this account compromise Provide a complete audit log of all account changes and login activity Reimburse all funds transferred as a result of unauthorized access Explain how a fraudulent bank account was added and used without clear notification Explain why the PayPal interface displayed my legitimate bank account while the transfer destination was altered Because these failures directly enabled the unauthorized transactions, FAILURE to NOTICE the ORIGINAL EMAIL of an EMAIL ACCOUNT CHANGE, FAILURE to NOTIFY that an UNUSUAL and known fraud BANK ( XXXX XXXX ) was added to my account, and FAILURE to NOTIFY of suspicious activity. I believe PayPal is responsible for restoring the funds taken from my account. I am requesting CFPB assistance to ensure PayPal properly investigates this incident and returns the funds that were transferred without my authorization. These transactions demonstrate a pattern of account takeover and rapid movement of funds through the PayPal platform. PAYPAL Known FRAUD TECHNIQUE - Likely Fraud Technique Used 1. Account Takeover ( ATO ) The attacker first gains access to the PayPal account through one of these common methods : Password reuse from another breached site Phishing email pretending to be PayPal Malware or browser session theft Email account compromise Once they log in, they immediately change notification channels. Typical changes : Add a new email address Make it the primary email Disable or change notification settings Sometimes remove the original email temporarily This prevents the victim from seeing alerts. XXXX. Add a XXXX XXXXXXXX XXXX XXXXXXXX the attacker adds a bank account they control. In your case : XXXXXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX Fraud rings commonly use : XXXX XXXXXXXX XXXX XXXX XXXX linked banks prepaid debit rails These accounts are usually temporary money mule accounts opened with stolen identities. Additionally, I have attached the FTC, IC3 claims and a copy of the PayPal Transactions from XXXX to XXXX.

Company response to consumer: Closed with monetary relief