PayPal does not send unsolicited messages offering cryptocurrency rewards, refunds, or investment opportunities. If you receive a message claiming to be from PayPal that promises free crypto, asks for your login details, or urges you to “claim” digital assets, it is almost certainly a scam.
Scammers often use fake emails, text messages, or social media posts that appear to come from PayPal. Common tactics include:
- “Claim your Bitcoin/Ethereum” offers: You’re told you’ve received crypto in your PayPal account and must click a link to verify or withdraw it.
- Fake transaction alerts: Messages say a crypto payment was sent to you, but you must log in via a phishing link to “accept” it.
- Impersonation: The message uses PayPal’s logo, colors, and language to look authentic.
- Urgency or fear tactics: “Your account will be locked!” or “Act now or lose your reward!”
Ask yourself:
- Did I expect this message? (If not, be suspicious.)
- Does the sender’s email address end in @paypal.com? (Scammers often use addresses like
paypal-support@randomdomain.com.) - Does the link hover over a non-PayPal URL? (Hover over links before clicking.)
- Is it asking for your password, 2FA code, or to download software?
If any answer is “yes”, do not click, do not reply, and do not enter any information.
What You Should Do
- Do not click any links or download attachments.
-
Report the message:
- In PayPal: Forward phishing emails to spoof@paypal.com.
- On social media: Report the post/profile to the platform.
- Check your account securely: Go directly to www.paypal.com by typing the URL—never via a link in an email.
- Enable two-factor authentication (2FA) on your PayPal account for added security.
- Monitor your account for unauthorised activity.
Scammers are getting more sophisticated—but staying informed is your best defense. Remember: legitimate companies like PayPal will never ask for your password, send unexpected crypto rewards, or pressure you to act immediately.
When in doubt, go directly to the official PayPal website or app, and never trust unsolicited messages.