PayPal

Is PayPal safe?

For paying an online shop, yes, mostly. The main reason is Purchase Protection: if an item you paid for with goods and services never arrives or is not as described, PayPal can refund you. The risk sits elsewhere. In December 2022 attackers got into 34,942 accounts and saw Social Security numbers, which cost PayPal a $2 million penalty from New York's financial regulator. And since late 2024 PayPal shares US users' shopping data with merchants unless they opt out. We score it 55/100.

Was PayPal hacked in 2022?

Not in the sense of a server break-in. On 6 December 2022 attackers ran a credential-stuffing attack, trying usernames and passwords stolen from other sites. Accounts where people had reused a password opened. According to the New York State Department of Financial Services (NYDFS), the attackers could see names, addresses, Social Security numbers, tax ID numbers and dates of birth of 34,942 people, partly through Form 1099-K tax data that PayPal had exposed during changes made to meet new IRS reporting rules.

NYDFS found that PayPal had not trained the engineers making those changes properly and did not require multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for the affected logins. The $2 million consent order, announced on 23 January 2025, notes that PayPal then made multi-factor authentication mandatory for all US customer logins. That change matters more for you than the fine: a reused password alone no longer opens a US PayPal account.

What PayPal does with your data

PayPal has to collect a lot to meet anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary rules: legal name, address, date of birth, often a Social Security number, and every payment you make. Apple's App Store label shows how much more it does with that. Product interaction and advertising data are listed as used to track you across other companies' apps. Name and usage data are linked to you for third-party advertising. Purchase history, search and browsing history and device IDs go to PayPal's own marketing.

The bigger change came on 27 November 2024. PayPal's US privacy statement now says it shares personal information collected after that date, such as the products you buy, your preferences and sizes, with partners and merchants for "personalized shopping experiences". It is on by default. You can switch it off under Data and Privacy in your account settings, and that is the first setting we would change.

Tracking plus default sharing with merchants is the main reason privacy (48) is its weakest factor.

Scams, and the Friends and Family trap

Most money lost through PayPal is not lost to a hack but to a scam that uses PayPal correctly. PayPal's user agreement lists personal payments, including those sent through Friends and Family, as ineligible for Purchase Protection. So the commonest marketplace scam is simple: a seller asks you to pay with Friends and Family "to avoid fees", then never ships.

Other patterns are fake invoices and money requests sent through PayPal itself, often with a "support" phone number in the note, and phishing emails that copy PayPal's design. Because the invoice is real, the email passes spam filters. The fix is the same for all of them: never call a number written in an invoice, and check your account by opening the app yourself.

Regulators are looking at the merchant side too. PayPal's quarterly filing for mid-2026 says the FTC sent it a civil investigative demand in August 2025 on whether deceptive schemes by merchants were "facilitated or furthered" by PayPal's onboarding and due diligence. That is an investigation, not a finding. New Hampshire went further: in a settlement announced on 22 December 2025, PayPal agreed to pay $1.75 million and to add risk-based scam warnings to PayPal and Venmo that say plainly users may not get their money back. The state had alleged that PayPal advertised Purchase Protection while putting "significant hurdles" in the way of claims, and gave unclear information when it froze accounts.

Is money in PayPal protected like a bank account?

Not by default. PayPal's US user agreement says a balance is an unsecured claim against PayPal, held in pooled accounts kept separate from PayPal's own funds. If you have the PayPal Debit Card, set up direct deposit or hold crypto with PayPal, your US dollar balance goes to Program Banks and may get pass-through FDICDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary insurance up to the usual limits. Even then, FDIC insurance covers a Program Bank failing, not PayPal failing. Moving money you do not need soon to your bank account is the simple fix.

How to use PayPal more safely

1. Pay strangers with goods and services, never Friends and Family. Use Friends and Family only for people you know in person.
2. Turn off personalised-shopping sharing under Data and Privacy.
3. Use a unique password, and add a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or authenticator app where PayPal offers one instead of SMS codes.
4. Do not call phone numbers that appear in PayPal invoices, money requests or emails.
5. Link a credit card rather than a debit card or bank account, so a disputed charge does not drain your current account.
6. Do not leave large sums in the balance unless you know whether the FDICDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary pass-through applies to you.

How we scored it

Security (62) is PayPal's best factor now that multi-factor login is mandatory in the US, held back by the 2022 breach. Privacy (48) is the weakest because of tracking and default sharing with merchants. The regulatory record (48) reflects the 2025 NYDFS penalty and New Hampshire settlement, the 2015 CFPB order over PayPal Credit and open FTC and CFPB investigations. Amazon, another app that ties purchases to advertising, scores 53.