PayPal under scrutiny: unauthorized transfer attempts, altered activity logs, and what to do if it happens to you

Short version: Over the past several weeks a cluster of PayPal-related problems — a major fraud-filter glitch that caused European banks to block billions in transactions, and widespread claims that huge volumes of PayPal credentials are circulating on dark-web forums — has created the perfect storm for account compromise and payment fraud. That doesn’t mean PayPal’s core systems were definitively “hacked” in a single catastrophic breach, but it does mean individuals and banks are seeing unauthorized or suspicious direct-debit attempts, and fraudsters are trying credential stuffing, phishing, and other attacks en masse. Respond immediately if your bank flags attempted PayPal charges: change passwords, lock cards, report to PayPal and your bank, and gather evidence. Several news outlets and security researchers have documented both the payment-filter outage and claims of leaked credentials. Reuters+1

1) What has happened — the timeline and the facts

a) The payment-filter glitch and frozen transactions

In late August 2025 a wide array of European banks detected a surge in suspicious direct debits coming from PayPal. Multiple German lenders and other European institutions temporarily blocked or halted billions of euros worth of transactions after PayPal’s fraud-filtering systems failed to block a wave of suspicious debits. The banking press and major outlets reported the stoppages and PayPal acknowledged a temporary disruption for a limited number of accounts, saying it had identified and resolved the issue. Reuters+1

What to take from this: a failure or outage in a payments company’s fraud detection can create sudden bursts of unauthorized-looking transfers that banks will react to aggressively. That’s what happened — banks froze or blocked activity to protect customers, but that action created massive disruption for legitimate merchants and customers too, and created alarm for anyone whose bank or card reported attempted PayPal activity. Reuters

b) Claims of large credential dumps on the dark web

Separately, threat actors publicly advertised large batches of purported PayPal credentials (email + password pairs) for sale on dark-web forums. Security vendors and reporting sites documented a listing that claimed to contain millions of PayPal credentials. Vendors and researchers caution that such lists often come from multiple sources — infostealer malware infections, older breaches, phishing, or reused credentials aggregated over time — and that the existence of such a listing does not necessarily mean PayPal’s servers were breached last week. PayPal denied a fresh platform compromise while investigators assessed the claims. Bitdefender+2hackread.com+2

c) Real user impact: attempted charges and “authorized” label confusion

Many banks have reported customers seeing attempted PayPal charges or direct-debit attempts that were flagged and blocked. Consumers commonly report confusion when banks call a charge “authorized” (because fraudsters sometimes use legitimate tokens, or because device/session metadata makes a transaction look valid) or when PayPal shows activity that doesn’t match the customer’s recollection. This confusion is compounded when attackers have access to an account’s session (device cookie) or email inbox: they can sometimes add or hide records, or enroll payment instruments before cashing out. For these reasons, treat any unexplained bank alert seriously and begin incident response immediately. Reddit

2) So — did PayPal “get hacked”?

Short answer: no publicly confirmed single catastrophic PayPal breach today. But two things raise real risk for account compromise:

Operational failure of PayPal’s fraud filters (which allowed suspicious debits to appear) — this is documented and was widely disruptive to European pumps of direct debit traffic. Reuters
Large credential sets circulating in criminal forums (claimed mass dumps of PayPal credentials) — security firms observed listings and samples; such data is often used for credential-stuffing attacks. PayPal and some security analysts deny a single new server breach and point to malware, reuse of leaked credentials, and phishing as likely sources. Bitdefender+1

So while PayPal’s infrastructure wasn’t necessarily “hacked” in the classic sense of a database breach inside PayPal (no confirmed, company-acknowledged system compromise of that scale at publication), the combination of leaked credentials and the fraud-filter outage increases the risk to individual accounts. Attackers don’t need to break into PayPal’s database if they can buy or try reused credentials, or steal session tokens via malware or phishing. Reuters+1

3) How accounts get compromised even with a strong password + 2FA

Many people think a strong password + 2FA is an impregnable fortress. It’s very strong, but it can fail in several realistic ways — and understanding those is crucial to protecting yourself.

a) Credential stuffing and reused passwords

If your PayPal password was used on another site that suffered a leak months or years ago, attackers can test that password on PayPal (automated “credential stuffing”). If the password works, they then try to bypass 2FA or take actions that don’t require it (like requesting small test debits that might bypass certain checks). Large lists of email/password pairs for PayPal have been offered for sale; that increases the odds credential stuffing will succeed against reused credentials. Bitdefender

b) Phishing and account takeover via email compromise

If the attacker compromises your email account — often via phishing, password reuse, or malware — they can reset pay-related passwords, intercept 2FA reset requests, or confirm new payment methods. That’s why PayPal and security vendors stress securing your email as step one when you suspect fraud. PayPal’s own guidance starts with changing passwords and reviewing linked accounts and sessions. paypal.com+1

c) SIM swapping and SMS 2FA failures

If your 2FA is SMS-based, attackers who control your phone number (via a SIM-swap at the mobile carrier) can intercept codes and take over accounts. This is why app-based authenticators or hardware keys are recommended instead of SMS. Many successful account takeovers involve SIM swapping, not PayPal code breaking.

d) Malware / infostealers and session theft

Infostealer malware can exfiltrate cookies, saved sessions, and credentials from an infected PC. With session tokens, attackers can impersonate an already-authenticated user without needing a password. Security researchers specifically called out malware logs as likely sources of the purported PayPal credential lists. hackread.com

e) Social engineering and support-level attacks

Very sophisticated fraudsters use social engineering to convince customer support or bank agents to approve changes or reset controls. These attacks are rarer but possible; keep records and use escalation paths if you suspect social engineering.

f) Authorization semantics and “authorized” vs “unauthorized” confusion

A bank may call a charge “authorized” if the transaction used valid credentials or tokens — even if you didn’t initiate it. Attackers sometimes create low-value test charges or add autopay instruments to make larger withdrawals later. Conversely, banks sometimes call a transaction “unauthorized” when a merchant disputes a charge. The language is confusing; treat any unexpected bank alert as real and act.

4) Why activity logs might appear altered (and what that means)

Users sometimes report that their PayPal activity pages don’t show the full story, or that entries are missing/changed. A few mechanisms explain this:

Delay in reconciliation and logging: When systems are resolving fraud or reconciling chargebacks, transaction entries may be in limbo and not appear in the activity log immediately. Banks blocking direct debits produce states where money is “frozen” but not posted. Reuters
Malicious session access: If an attacker has a session cookie or has temporarily logged into your account, they can adjust some settings (add cards, hide email notifications) before you spot them. They can’t usually wipe long-term historical records from PayPal’s server logs, but they can cause your view of the account to look different locally or remove easy traces like browser-saved entries.
API/automation activity: Fraudsters sometimes use the API in ways that generate non-standard records. In rare cases, integrations or third-party apps (malicious or misconfigured) that have access to your account can create confusing or obfuscated entries.
Support/process adjustments: When PayPal or banks intervene (fraud remediation), they may temporarily suppress certain entries while investigating. That can appear to users as “log tampering.” If you suspect criminal alteration, preserve screenshots and timestamps — they’re vital evidence.

If you think your PayPal activity history was maliciously altered, take screenshots immediately, download any available activity CSVs, and escalate through PayPal’s Resolution Center and your bank.

5) Immediate actions to take if your bank reports attempted PayPal charges or you see suspicious PayPal activity

Do these right now — don’t wait.

1) Preserve evidence

Take screenshots of the PayPal Activity page(s) showing unexpected entries — include the browser address bar and timestamp if possible.
Save any bank alert emails or SMS messages (do not delete).
Note the exact times (with timezone), amounts, and any merchant names.

2) Lock the account and change passwords

Change your PayPal password to a unique, strong password (use a reputable password manager).
Change the password of the email account tied to PayPal immediately and enable 2FA there too. Email compromise is a common pivot. paypal.com

3) Turn on or strengthen 2FA (use app/hardware, not SMS)

If you use SMS 2FA, switch to an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) or better yet, a FIDO2 hardware key. PayPal supports authenticator apps. SMS is vulnerable to SIM swap attacks.

4) Review devices & sessions

Log out of all devices from PayPal’s security/device/session settings and then log back in on a known good device.
In your email account, check active sessions and log out unknown ones.

5) Check and remove linked payment methods / autopays

In PayPal → Payments / Automatic payments, revoke any unfamiliar subscriptions or pre-approved payments. Fraudsters often add a “pre-approved payment” to drain funds later. paypal.com

6) Contact your bank and lock cards

Tell your bank that unauthorized attempts were made via PayPal. Ask them to block or replace the card(s) used or to reverse any posted unauthorized debits. Banks often have emergency hotlines for suspected fraud. Your bank already flagged attempted charges — use that momentum.
If your PayPal account is linked to bank accounts via direct debit, consider contacting the bank directly to block direct debits while you investigate.

7) Report to PayPal immediately

Use PayPal’s Report Fraud / Report Identity Theft pages and the Resolution Center to file an unauthorized activity report. Follow PayPal’s live instructions for account recovery. PayPal’s help pages explain the first steps: change passwords, report, and review account info. paypal.com+1

8) Scan your devices and clean up

Run a full anti-malware scan on any device you used to access PayPal. If you’re not sure the device is clean, use a different device to change passwords and contact support.
Remove saved passwords or autofill for PayPal from browsers until you’re certain devices are secure.

9) Consider a freeze on your credit / additional monitoring

If the incident is severe or involves identity theft, place fraud alerts or freezes with credit bureaus in your country and monitor accounts for new account openings.

10) Document everything and escalate if needed

If your bank or PayPal disputes the unauthorized nature of charges, keep copies of evidence, timestamps, correspondence, and call logs. If necessary, escalate to a financial ombudsman or regulator in your country — Germany and other EU regulators were informed when the recent PayPal outage affected banking rails. Reuters

6) If PayPal says “the transaction was authorized” — what that can mean and your options

Sometimes PayPal or banks tell customers a transaction was “authorized,” leading to the impression the customer clicked “yes.” That may be true in a rigid technical sense (the request used valid credentials or tokens), but can still be the result of fraud (attacker used valid credentials obtained from a leak, reused password, or session cookie).

If you insist it wasn’t you:

File the unauthorized claim with PayPal’s Resolution Center.
Ask your bank for chargeback/reversal options and the bank’s fraud investigation number. Banks have different policies for PayPal because PayPal is a PSP (payment service provider), not a card network — but banks still investigate unauthorized debits.
Provide evidence (screenshots, emails, device logs, times).
Keep following up — these cases sometimes require persistence. If you’re in the EU, regulators and consumer protection bodies can be involved for cross-border issues. The recent payments freeze led to banks and regulators being looped in. Reuters

7) Hardening your PayPal and payments hygiene: practical checklist

Below is an actionable checklist you can implement now to reduce your risk:

Account & authentication

Use a unique password (password manager).
Enable app-based 2FA or a hardware security key; avoid SMS. paypal.com
Set PayPal to logout after inactivity and always log out of public devices.
Check device/session lists regularly and remove unknown devices.

Email and recovery

Secure the email account attached to PayPal with a unique password + 2FA.
Use a separate recovery email for low-risk purposes; avoid reusing your primary email everywhere.

Financial controls

Use virtual or single-use cards for risky merchants (many banks and fintechs offer them).
Keep a separate card for subscriptions and autopay; monitor that card closely.
Consider setting a low daily limit with your bank for online debits, if supported.

Browser & device hygiene

Don’t save passwords in browsers on shared devices.
Use reputable antivirus and an endpoint protection product on PCs you use for finance.
Be careful with browser extensions; malicious extensions can leak tokens.

Transaction posture

Enable notifications on all card/bank transactions for immediate alerts.
Schedule regular audits of PayPal auto-pay and pre-approved payments.

When using public or shared Wi-Fi

Use a trusted VPN or avoid financial actions on public networks.

8) For merchants and small businesses: extra precautions

If you accept PayPal or process payments, the recent incidents have two lessons:

Watch for reconciliation mismatches. If banks block direct debits or refunds are queued by banks, merchants may see gaps or chargebacks — reconcile closely and keep documentation. The August outage required reconciliation over days for some European merchants. TechRadar
Strengthen your fraud rules: work with your processor (PayPal, Stripe, Adyen) to set velocity limits, device fingerprinting, and challenge rules for unusual patterns. Consider mandatory 3DS for high-risk transactions and require additional verification for large transfers.
Consider multi-provider redundancy: Don’t rely on one payments provider for all flows. If PayPal’s rails are temporarily impaired or flagged by banks, an alternate processor can keep revenue flowing.
Keep clear customer communications: if your customers raise issues about failed PayPal authorizations, provide clear guidance and internal references so they can coordinate with banks — the recent pause of transactions created a lot of customer confusion.

9) When to involve law enforcement, regulators, or a lawyer

If large sums were stolen and your bank/PayPal won’t cooperate, file a police report (for many banks this is a requirement for certain fraud reimbursements).
If you’re a merchant with substantial losses from systemic outages or suspicious activity, consult legal counsel about joint actions or regulatory filings. European banks involved in the incident informed regulators (BaFin, CSSF) because of the systemic scale — individual consumers can escalate to national consumer protection agencies if needed. Reuters

10) Frequently asked questions (FAQ)

Q: If I used a strong password and 2FA, how did this still happen?
A: The weak link is often not the PayPal password itself but the email account, a reused password on another leaked site, SMS-based 2FA via SIM swap, or device malware. If attackers can access your email or session tokens, they can circumvent standard protections. hackread.com+1

Q: Should I close my PayPal account?
A: Not necessarily. For most users the correct response is to harden the account (unique password, app-based 2FA, revoke auto-payments) and monitor. Closing an account can be disruptive if you have legitimate recurring payments. However, if you suspect persistent compromise that you cannot remediate, consider closing and reopening under strict controls.

Q: Is PayPal liable for my losses?
A: Liability rules depend on the circumstances, your country, and whether the transactions were authorized or unauthorized. Banks and PayPal both investigate. In many cases with clear fraud and quick reporting, reimbursements are possible — but timelines vary. Document everything and escalate persistently.

Q: Could my data be included in those 15.8M credentials lists?
A: Possibly — security researchers saw listings claiming to contain ~15.8M PayPal-related credentials for sale. Those lists are often aggregated from multiple breaches, older leaks, or malware logs. Always assume leaked credentials could exist and immediately rotate passwords if you used the same password elsewhere. Bitdefender

11) Long-term prevention and the broader picture

Security is a shared responsibility: users must harden credentials and devices; payment platforms and banks must operate robust fraud controls; and regulators must ensure incident transparency and remediation. The PayPal situation shows how fragile payment rails can be when fraud filters fail and how easily aggregated leaked credentials can turn into account takeover attempts.

PayPal said the payment-filter incident was limited and resolved, but it exposed the downstream fragility of bank-level defenses when facing a sudden burst of suspicious debits. Threat actors continue to use stolen credentials, phishing, and malware to bypass protections — often by exploiting the weakest link, which is frequently the user’s email, reused password, or an insecure phone number. Reuters+1

12) Final checklist — immediate 10-step remediation (copy/paste)

Change PayPal password to a unique, strong password (password manager).
Change the email password linked to PayPal and enable app-based 2FA.
Log out of all PayPal sessions/devices; log back in only from a known-clean device.
Revoke all unfamiliar pre-approved payments and linked cards/bank accounts in PayPal. paypal.com
Contact your bank, report the attempted PayPal charge, request card lock/replacement, and open a fraud case.
File an unauthorized transaction claim with PayPal via the Resolution Center and follow their identity-theft guidance. paypal.com
Scan your PC and mobile devices with updated anti-malware; if possible, use a different clean device to change passwords.
Enable device and transaction alerts on your bank and PayPal.
Collect evidence (screenshots, emails, timestamps) and save copies of any correspondence.
If unsatisfied with responses, escalate to a financial ombudsman or consumer protection agency; if money was lost, file a police report.

Sources and further reading

Reuters: “German banks halted 10 billion euros in PayPal payments on fraud concerns” (Aug 27, 2025). Reuters
Bitdefender / HotforSecurity: coverage of alleged 15.8M PayPal credential listing on dark web (Aug 18, 2025). Bitdefender
PayPal Help — Report Identity Theft & Report Fraud pages (official guidance on steps to secure accounts and file reports). paypal.com+1
Malwarebytes: reporting on PayPal-themed phishing campaigns targeting users. Malwarebytes
Payments industry and tech outlets (TechRadar, FinTechNews) — coverage of the fraud-filter outage and impact on European banks and merchants. TechRadar+1

Closing thoughts

The combination of a temporary failure in PayPal’s fraud-filtering systems and the proliferation of credential lists and targeted phishing has left many users and banks on edge. That doesn’t necessarily mean PayPal’s servers were “hacked” in the sense of a single, confirmed massive breach of internal systems — but it does mean your personal account is at higher risk right now. The good news: most compromises happen via known, remediable channels (reused passwords, phishing, compromised email, SMS swap, malware). Taking the immediate steps above — rotate passwords, secure email, adopt app-based 2FA, revoke autopays, and work with your bank and PayPal — will dramatically reduce your risk and give you the best chance of recovery if fraud does occur.

Frequently Asked Questions

Where can I find your cybersecurity and AI books?

You can explore and purchase our full collection of cybersecurity and AI books directly on our Amazon author page. Discover practical guides designed to help businesses succeed with security and AI.

Do you offer free cybersecurity resources?

Yes! We provide free cybersecurity ebooks, downloadable tools, and expert articles directly on this site to help businesses stay protected and informed at no cost.

How can I contact you for cybersecurity or AI questions?

If you have questions about cybersecurity, AI, or need assistance choosing the right resources, feel free to reach out to us through our website's contact page. We are happy to assist you.