Consumer complaint received 2025-11-13 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Fraud or scam — 
Company: Paypal Holdings, Inc
State: OH

Complaint narrative:
I am filing a new complaint because PayPal continues to deny my unauthorized transaction claim without performing a legally required investigation under Regulation E ( 12 CFR 1005 ). PayPal is ignoring clear evidence of account compromise, refusing to provide authentication logs, and has not complied with CFPB guidance regarding unauthorized electronic fund transfers. 

Despite my repeated notifications, PayPal has failed to conduct a legally sufficient investigation, has relied on prohibited reasoning to deny my claim, and has refused to provide the evidentiary basis required under federal law. PayPals actions constitute a violation of

the Electronic Fund Transfer Act ( EFTA ) and controlling CFPB guidance. I. Summary of Unauthorized Activity The disputed activity involved a series of unauthorized events, including : 1. The addition of an unknown email address to my account 2. The addition of a debit card I did not authorize 3. Multiple unauthorized withdrawals to that debit card 4. Immediate removal of the card after the withdrawals 5. Subsequent removal of the unauthorized email address This sequence of events is consistent with recognized patterns of account takeover, credential compromise, and remote-access fraud.

II. PayPals Denial Contravenes Regulation E PayPal denied my claim on the basis that login activity appeared consistent and that the email and debit ca
rd had been added before the withdrawals occurred. Neither of these rationales satisfies the institutions burden of proof under 12 CFR 1005.11 ( d ).

The CFPBs Official Staff Interpretation of Regulation E explicitly states that : Use of the consumers access device or login credentials, by itself, does no
t support a determination that the transaction was authorized.

Thus, the justification PayPal is relying on is specifically prohibited.

III. PayPal Has Provided No Evidence Supporting Authorization PayPal has refused to produce any of the documentation necessary to substantiate its conclusion, including : 1. IP address logs 2. Device fingerprinting data 3. Geolocation records 4. Two-factor authentication logs 5. User-agent/session metadata 6. Evidence that the email and card additions were authorized 7. Documentation of its investigative methodology PayPal supplied only a conclusory statement without evidence. This constitutes a failure to conduct a good-faith investigation as required by 12 CFR 1005.11 ( c ).

IV. PayPals Reasoning Conflicts With CFPB Precedent PayPals de
nial contradicts multiple precedential CFPB actions and interpretations, including but not limited to : CFPB Circular 2022-10 ( Unauthorized Transfers ) CFPB v. Wells Fargo ( 2022 ) CFPB v. Green Dot ( 2020 ) CFPB v. UniRush ( 2017 ) Official Interpretation to 12 CFR Part 1005 These actions consistently affirm that : 1. Apparent device consistency does not prove customer authorization 2. Institutions must evaluate the possibility of account takeover 3. Institutions may not rely on assumptions or customer log-ins as evidence The burden of proof lies solely with the financial institution PayPals denial is incompatible with these rulings.

V. PayPal Failed to Provide Provisional Credit Regulation E mandates provisional credit when authorization can not be established within 10 business days. PayPal failed to issue provisional credit, constituting an independent violation of 12 CFR 1005.11 ( c ) ( 2 ). VI. Relief Requested I request that the Consumer Financial Protection Bureau
require PayPal to : 1. Reopen my unauthorized transfer claim 2. Produce all authentication, device, session, and IP logs related to the disputed transactions 3. Provide documentation demonstrating how PayPal concluded the transactions were authorized 4. Conduct a complete and compliant investigation in accordance with Regulation E 5. Issue provisional credit if PayPal can not affirmatively prove authorization as required by law PayPals continued reliance on disallowed criteria and refusal to provide evidence demonstrates a pattern of non-compliance that warrants regulatory intervention. 

Thank you for your attention to this matter.

Company response to consumer: Closed with explanation