Consumer complaint received 2025-11-23 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: Paypal Holdings, Inc
State: MS

Complaint narrative:
My nine-year PayPal account was taken over on XX/XX/year>, with transactions made on XX/XX/XXXX while I was abroad in XXXX. I did not log in at any point during the fraud window. All legitimate access to my account is from two devices onlymy phone and my laptop. My login history shows my last access was in XXXX, prior to restoring my account on XX/XX/XXXX after the takeover. During the unauthorized activity period, PayPals device logs show logins from devices I do not own, including multiple XXXX browsers and an XXXX XXXX. I do not use XXXX, and I do not own an XXXX XXXX. PayPal also emailed me a security alert stating that there was a suspicious login from XXXX. I was not in XXXX and have never been. I have accessed my PayPal account only from the U.S., XXXX, and Georgia. Despite this, the intruder was able to unlock my account using PayPals recovery process and continued performing transactions. 

The unauthorized withdrawals were sent to recipients I do not know, including a {$0.00} test deposit from XXXX XXXX, an attempted XXXX transfer to XXXX XXXX, and transfers to a XXXX XXXX user whose name appears partially as XXXX XXXX in PayPals records. 

The intruder attempted withdrawals in an escalating sequence. First, a {$910.00} XXXX transfer to XXXX XXXX ( denied ). Next, Visa transactionssome denied and some successfulsent to individuals I do not know. Then small XXXX XXXX pulls ( {$1.00} {$10.00} ) used to test my PayPal Debit Card. After identifying that the debit card could be used, the intruder performed approximately XXXXXXXX XXXX XXXXXXXX withdrawals routed through a crypto-related merchant. I have never used XXXX. These transactions occurred during periods where all logins originated from unauthorized devices. 

The intruder also added a card I do not own to my XXXX account. I did not add or authorize this card. During the takeover, the intruder added a new trusted browser/device and removed my phone number and changed my password. I removed the unauthorized device only after taking screenshots. 

I am attaching a screenshot showing that PayPal issued a new PayPal Debit Card during the takeover despite the fact that I explicitly selected the option not to have a replacement card sent because I am outside the country. The confirmation email states that the PayPal Debit Card number can be accessed directly from the account interface, which means the intruder would have been able to view the full card number during the takeover. This is consistent with the continued XXXX XXXX attempts made today using the stolen card number. 

After the fraudulent withdrawals, PayPal locked the account. I did not trigger the lock and was not accessing the account. The intruder bypassed at least one of the lockouts without me. I regained access only because XXXXXXXX XXXX autofilled my credentials. Once I filed the claims, the account re-locked multiple times. I avoided logging in entirely until I received the claim-decision emails. 

PayPals internal responses were contradictory. The unauthorized withdrawal from my PayPal Savings balance was approved and refunded. However, the corresponding unauthorized PayPal Debit transactions were handled inconsistently even within the same review team. A few unauthorized debit transactions were restored, but the majority were denied using the same rationale. As a result, my PayPal Savings shows the corrected balance of {$2400.00}, while my regular PayPal balance shows a negative {$2300.00} for the same takeover period. This reflects contradictory decisions within the Debit Review team and conflicts with the conclusion that the activity was authorized. The denial rationale relied on consistent logins and knowledge of the account balance, but those logins originated from an XXXX XXXX and XXXX  browsers that are not my devices. 

I contacted PayPal Executive Support multiple times, provided detailed explanations of the takeover, and explicitly requested a full account-takeover investigation including login logs, device fingerprints, credential-change records, and recovery events. All responses ignored these requests and did not address the unauthorized device logins, the XXXX login alert, the unauthorized recovery actions, or the contradictory claim decisions. 

I am attaching : ( XXXX ) login and device screenshots showing unauthorized access ; ( XXXX ) PayPals suspicious-login warning from XXXX ; XXXX XXXX ) account-takeover alert emails ; ( XXXX ) screenshots showing the contradictory balances ; ( XXXX ) screenshots of the unauthorized transactions ; ( XXXX ) screenshots of the attempted Cash App pull that occurred today ; and ( XXXX XXXX XXXX XXXX XXXX  containing the denial emails. Due to size limits, I was unable to upload the second MBOX containing the takeover alerts, approvals, and my correspondence with PayPal.

The screenshots are provided in two ZIP files due to file-size limits on the CFPB upload system.

Because of the volume of transactions and correspondence involved, I have provided the most relevant screenshots and documents within the CFPB file-size limits. I retain the full email archive, records, and all additional documentation and can provide anything further if required.

Company response to consumer: Closed with monetary relief