PayPal: The Global Payment Hub
PayPal is a unique target because it often sits as a "middleman" between your bank accounts and the rest of the internet. A compromise of PayPal can ripple out to your checking account, your credit cards, and your connected shopping accounts (like eBay or Etsy). Because PayPal offers "instant" transfers to other users, it is a favorite for attackers who want to liquidate stolen funds quickly.
1. Hardening Your Account
Two-Step Verification (MFA)
PayPal supports Authenticator apps and SMS. Given PayPal's history as a target for social engineering, an Authenticator App is mandatory. Action: Go to PayPal Security Settings and enable an authenticator app. Ensure you have backup methods (like a secondary phone or security key) configured.
Managing Linked Banks & Cards (The Principle of Least Surface)
The more bank accounts you link to PayPal, the larger your attack surface. If you don't need a specific bank account for PayPal transactions, unlink it. The Strategy: Use a "buffer" account—a separate bank account specifically for digital payments with a low balance—to link to services like PayPal. This ensures that even if PayPal is compromised, your primary life savings remain isolated.
Reviewing "Auto-Payments"
PayPal is often used for recurring subscriptions. Over time, these build up, and many services have "permission" to pull money from your PayPal without a fresh login. Action: Periodically review your "Automatic Payments" and cancel any that are no longer needed. This prevents "subscription leakage" and reduces the number of third parties with a direct line to your wallet.
2. Failsafe Recovery Preparation
Security Questions: The Weakest Link
PayPal still uses security questions as a fallback recovery method. These are often easy to find via social media (your high school, your mother's maiden name, etc.). Expert Tip: Do not provide real answers to security questions. Instead, generate a random string in your password manager and store it as the "answer." This treats the security question like a second password.
Mobile App as a Key
Ensure you have the PayPal app installed and that it is secured with biometrics (FaceID/Fingerprint). The app can often be used to verify your identity when signing in from a new computer, bypassing the need for an SMS code.
3. Dealing with Disputes and Fraud
While this playbook focuses on prevention, understanding recovery is key.
- Unauthorized Activity: If you see a transaction you didn't authorize, you have 60 days to report it.
- Friends & Family vs. Goods & Services: Never use "Friends & Family" to pay for an item from a stranger. This method has zero buyer protection and is the primary tool for scammers. If you are tricked into sending a "Friends & Family" payment, PayPal will almost never refund you, regardless of your account security.
For more information on the underlying principles, see our articles on MFA Fundamentals and Password Security.
Why This Matters
The Importance of MFA
Multi-Factor Authentication (MFA) is your strongest defense against account takeover. Even if a physical or digital attacker obtains your password, MFA provides a critical second layer of defense that is much harder to bypass. Learn more about MFA best practices.
Unique, Strong Passwords
Never reuse passwords across different services. If one service is breached, every other account using that same password becomes vulnerable to "credential stuffing" attacks. Every online service should have its own unique, long, and complex password managed by a reputable password manager. Learn why unique passwords are critical.