Consumer complaint received 2026-05-03 00:00:00
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Fraud or scam — 
Company: Paypal Holdings, Inc
State: TX

Complaint narrative:
This complaint concerns a social engineering attack that took place entirely within the official PayPal XXXX mobile application on XX/XX/year>. I have screen recordings and screen shots of the incident showing the legitimate XXXX app, the in-app message center, the SMS from PayPal 's official short code XXXX, and an unauthorized login on my account immediately following the chat. I initiated a customer support session in the PayPal app to ask about a {$110.00} unclaimed payment from a friend. My initial interaction was with PayPal 's generative AI assistant. After a few exchanges, I received a message stating PayPal was " experiencing system issues '' and that my chat was being transferred to a human agent. I was then connected to an individual identifying himself as " XXXX. '' The agent first asked for my address to " complete the payment. '' He then told me he needed to verify my identity and asked me to read back a 6-digit security code PayPal had texted to my phone ( XXXX ). I provided it. He then claimed there was an unverified card on my account ending in XXXX and that PayPal would place a {$1.00} charge on my XXXX XXXX XXXX statement containing a 4-digit verification code. He asked me to read that code back as well. I did. At that point I became suspicious of the pattern of requests, recognized the interaction as a likely social engineering attempt, and closed the chat myself before any further information could be solicited. Shortly after, I observed an unrecognized login session on my PayPal account security page, confirming my suspicion that the codes I provided had been used to access my account. I want to highlight a specific concern with PayPal 's SMS security infrastructure : the authentication code text I received did not contain the standard " PayPal will never ask for this code, do not share with anyone '' warning that is the industry norm for 2FA messages and that PayPal includes on other code types. The message read only : " PayPal : XXXX is your security code. Your code expires in 10 minutes. '' The absence of any anti-phishing warning directly contributed to the success of this attack and represents, in my view, a foreseeable and avoidable failure of reasonable care. Note : this was on the official XXXX app I downloaded from the app store. I am requesting : - A formal investigation into how an individual operating through PayPal 's official in-app support channel was able to solicit authentication codes from a verified customer, including whether this involved a compromised contractor, a rogue agent, or a vulnerability in PayPal 's support tooling. - Written confirmation that my account has been fully secured, all unauthorized sessions terminated, and any account changes made by the attacker reversed. - Reimbursement for time spent on incident response and mitigation, replacement of any compromised payment instruments, and reasonable credit monitoring services. - A commitment from PayPal to update its SMS authentication code template to include standard anti-phishing language consistent with industry norms. I have preserved all evidence including a screen recording, screenshots of the chat transcript, the SMS message, and the unauthorized login activity, and I am prepared to provide them upon request.

Company response to consumer: Closed with non-monetary relief