Consumer complaint received 2026-01-07 00:00:00
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Unauthorized transactions or other transaction problem — 
Company: Paypal Holdings, Inc
State: CA

Complaint narrative:
On XX/XX/year>, my phone was stolen. During the period in which the thief had access to my device and accounts, my PayPal account was compromised and a PayPal debit card was fraudulently opened and digitally provisioned without my authorization. 

Once I regained access to my email account, I noticed ( and have attached ) an email from PayPal indicating that the PayPal debit card was added to XXXX XXXX during the same timeframe that my phone was stolen and under the thiefs control. I did not request the debit card, did not authorize it to be added to XXXX XXXX, and did not authorize any transactions made using it. 

Using the digitally provisioned PayPal debit card, the thief made unauthorized transactions, including a {$500.00} transaction at XXXX on XX/XX/year>. 

I later physically received the PayPal debit card by mail and still have it in my possession. The disputed transaction occurred before I had possession of or access to the physical card, confirming that the transaction was conducted digitally using the compromised device and PayPal app. 

I promptly reported the unauthorized activity to PayPal, filed a police report, and submitted an FTC Identity Theft affidavit. Despite this, PayPal denied both my original dispute and my appeal. 

In its written denial, PayPal stated that the claim was denied because : - Personal payments were received into the PayPal account shortly before the disputed transaction - The transaction did not exceed the available account balance - The account was accessed using login information consistent with preceding account access - These factors allegedly indicated account holder knowledge and authorization This reasoning is flawed and inconsistent with identity theft protections. 

First, the PayPal debit card itself was opened and digitally provisioned without my authorization. PayPal did not meaningfully address or investigate the unauthorized creation and XXXX XXXX attachment of the debit card during a known account compromise. 

Second, consistent logins do not establish authorization. A stolen phone with saved credentials, session persistence, or biometric/passcode access will naturally generate logins that appear consistent. Treating this as proof of authorization ignores well-established identity theft and device compromise scenarios. 

Third, PayPals reliance on account balance awareness or inbound payments is speculative. Knowledge of an account balance does not prove authorization when an account has been taken over by a third party. 

Finally, PayPal failed to account for the following undisputed facts : - The debit card was created and added to XXXXXXXX XXXX without my consent- The transaction occurred digitally during the period my phone was stolen - I did not possess or control the physical debit card at the time - Police and FTC identity theft reports were filed PayPal concluded that the transaction was processed correctly without demonstrating that I authorized the debit card issuance, the Apple Pay provisioning, or the transaction itself.

I respectfully request that the CFPB review PayPals handling of this dispute, including whether its investigation complied with consumer protection requirements for unauthorized electronic fund transfers and whether its denial improperly relied on assumptions rather than affirmative evidence of authorization.

Company response to consumer: Closed with monetary relief