How do unauthorized charges get on your PayPal account?

In a perfect world, you would recognize every charge on your PayPal account. It’s not a perfect world.

Here’s how unauthorized charges show up on your PayPal account:

Unrecognized but authorized

The most common “unauthorized” charges are actually authorized. Companies will use a third party to process payments, so a recurring payment or a subscription will show up on your PayPal account as a charge from a company that you don’t recognize. People immediately assume that these charges are fraudulent. But a quick search usually reveals that they are legit. Note: Most of these companies list a phone number or email, which allows you to contact them and ask about the charge.

Unauthorized but not disputable

A second category of unauthorized PayPal charges is unauthorized but not disputable. That happens when you give your password to your best friend, spouse or one of your kids, and they make an unapproved charge. Having mediated hundreds of PayPal cases, I’m certain that its fraud detection algorithm ferrets out these types of friendly charges and holds customers responsible for them. Never share your PayPal password — yes, even if the love of your life asks you for it. It’s the only way to ensure you won’t have an unauthorized charge on your PayPal account that you can’t dispute. (Related: PayPal money transfer problem: What should I do if the money never gets there?)

Unauthorized and disputable

A small number of PayPal unauthorized charge cases are truly fraudulent. The customer didn’t share a password with a family member or a scammer. They followed best practices on the internet, changing their passwords often and setting up PayPal’s two-step verification. And somehow, they still ended up with a fraudulent charge on their account. This could happen for any number of reasons, including a data breach or a systems problem on PayPal’s side. Again, in a perfect world, PayPal would quickly own up to such problems and reverse the charges. But — and I’m sorry to repeat myself — it’s not a perfect world. That’s why our advocacy organization exists. And after reviewing Castellano’s case, I believed his problem fell into this category — unauthorized and disputable. 

How do you reverse a transaction on your PayPal account?

The PayPal dispute resolution system is designed to resolve problems with a transaction, such as not receiving an item or receiving an item that is different from what was described. Here’s how to reverse a transation on your PayPal account:

File a formal dispute through your PayPal account

You can do that by logging into your account and opening a dispute in the Resolution Center within 180 calendar days of your purchase. Click on “Dispute a Transaction” under “Report a problem.” Then select the transaction, click “Continue” and then “Item dispute.”

Give PayPal time to review your case

The company may ask for additional information from you or the seller when you’re trying to reverse a transaction on PayPal. That may include receipts, correspondence or photos. But in the case of fraudulent purchases, the process can take just minutes. Unfortunately, that’s because an algorithm determines the validity of the purchase, and it usually comes down on the side of ‘legit.’

Escalate your case to a claim if necessary

If you can’t reverse your PayPal transaction, you may escalate the dispute to a claim. If the dispute is escalated to a claim, PayPal will review the case and make a decision based on the information you provided. But if PayPal agrees that a charge is fraudulent, it will refund the account holder’s money.

File an appeal

If you are not happy with the outcome of the claim, you can escalate the dispute to PayPal’s appeals team. Go to the Resolution Center. Click “Report a Problem” and select “Closed cases” in the drop-down menu; then find the claim you want to appeal. Then click “Appeal” in the action column. The appeals team will review the case and make a “final” decision. PayPal claims this is the final level of appeal, but that’s not quite correct.

How did these unauthorized charges happen on PayPal?

Castellano’s circumstances were unusual. A scammer had apparently gained access to his account and made two payments to a recipient that Castellano didn’t recognize. Although he reported the fraudulent transaction immediately, PayPal quickly affirmed that the charges were legitimate, leaving him to fight his way through the dispute process I just outlined.

By the time I got involved in his case, the dispute had been in progress for nearly a year. PayPal archives its internal chats older than 90 days, so accessing a paper trail was almost impossible. I had almost nothing to go on except a few emails and Castellano’s insistence that he never gave his password to anyone and didn’t authorize the charges.

When I get a case like that, and when it’s impossible to get a paper trail, there’s only one thing to do: I have to ask PayPal about it. I’ll tell you what it said in just a minute. 

What does PayPal say about this disputed charge?

Here’s what PayPal told Castellano after he repeatedly asked for help and then took his case to the Better Business Bureau. It said technically, the payment method he used was ineligible for protection. In other words, PayPal didn’t have to help him.

Our records show that you have contacted us from different sources regarding this, we informed you that a personal payment is not eligible for PayPal Purchase Protection and due to which we are unable to refund this payment.

I have thoroughly researched the facts of this matter and can confirm we are unable to file a claim on this payment and we cannot refund this payment. 

In future, I would recommend [sending] payment as Goods and Service if you are sending payment for any service or for any purchase so that the payment will be protected under PayPal Purchase Protection. Please also note, a payment under PayPal Purchase Protection can only be disputed within 180 days.

PayPal recommended that Castellano file a report online through the Internet Crime Complaint Center (IC3). For the record, I’ve never worked a case in which a report to IC3 yielded a refund of any kind.

PayPal’s response also suggests it hadn’t fully understood the problem. When it recommended sending a payment as Goods and Services — which is covered by PayPal’s Purchase Protection, that suggests someone believes Castellano had intentionally sent money. But he hadn’t.

So — incomplete paper trail, tone-deaf responses by PayPal. I really needed some answers here.

What do PayPal’s terms of service say about your rights to dispute a transaction?

PayPal’s terms of service — the legal agreement between you and PayPal — are dense, complicated and change often. Here’s a summary of your rights to dispute a transaction as of Jan. 4, 2023:

• PayPal’s Purchase Protection program may cover the full purchase price of an item, plus original shipping costs — but only if you encounter certain problems with a transaction made through PayPal and meet the eligibility requirements.

• To be eligible for coverage under the program, you may need to return the item to the seller or another party specified by PayPal.

• PayPal’s Purchase Protection program may cover claims for “Item Not Received” (you didn’t receive your item) or “Significantly Not as Described” (the item you received is not what you ordered).

• The Purchase Protection program does not cover claims for unauthorized transactions or errors, which it handles differently. (Or not at all.)

• Transactions made in person using a PayPal goods and services QR code may be eligible for the Purchase Protection program.

• An “Item Not Received” claim may not be eligible if you collected the item in person or arranged for it to be collected on your behalf (except for in-person PayPal QR code transactions), or if the seller has provided proof of shipment or delivery.

• An item may be considered “Significantly Not as Described” if it is materially different from the seller’s description, a completely different item, misrepresented in terms of condition, advertised as authentic but is not, missing major parts or features that were not disclosed, or damaged during shipment.

• Certain items and transactions are not eligible for the Purchase Protection program, including real estate, vehicles, custom-made items, or items that violate PayPal’s policies.

Under PayPal’s terms of service, you can dispute a claim under the Purchase Protection program through your PayPal account within 180 days of the transaction, and PayPal’s original decision is considered final, but you may be able to appeal if you have new information or believe there was an error in the decision-making process.

What are your rights when you send money through PayPal?

PayPal’s Purchase Protection guarantee, which provides financial protection to buyers when they purchase goods or services using PayPal, seems to work well most of the time.

The program is similar to a credit card chargeback, resolving disputes between buyers and sellers for problems that include products that are not as advertised or that are not delivered.

But as I’ve already mentioned, there are significant restrictions in PayPal’s terms of service. It doesn’t cover a long list of items, including real estate, motor vehicles and prepaid cards. To be eligible for Purchase Protection, you have to pay for the product or service in full with PayPal and file a claim within 180 days of your purchase.

What PayPal won’t tell you — but you need to know — is that you have other rights outside of PayPal’s policy. First, you can dispute a charge made through PayPal on your credit card. (Castellano couldn’t do this because he waited too long to file a dispute, according to his bank.)

Does PayPal have to play by the same rules as a bank?

Technically, PayPal is not a bank, but it is still governed by the same consumer protections in the U.S. There’s a little-known rule called Regulation E, which allows you to dispute an ATM withdrawal, debit card purchase or electronic funds transfer. The regulation, authorized under the Electronic Fund Transfer Act (EFTA), protects consumers when they transfer funds electronically. I have more on this in my guide to accidental money transfers.

It appears the Consumer Financial Protection Bureau, which enforces Regulation E, has taken a broad interpretation of the regulation. That may mean that in the future, transfers like Castellano’s would be protected under U.S. law. For now, unfortunately, it’s still a gray area. 

You also have the option to take PayPal to small claims court to recover your lost money. You don’t have to hire a lawyer to file a small-claims case, and many companies don’t bother to show up for smaller claims, which means you would win by default. PayPal’s latest user agreement allows you to go to small claims court as long as you’re not part of a class-action suit. 

Will PayPal remove $1,180 in unauthorized charges — or not?

Remarkably, there’s even more to this story. As I reviewed Castellano’s records, it became clear that there were even more unanswered questions. For example, his account had been targeted in 2021, when someone made $250 in unauthorized purchases. Back then, PayPal apparently agreed that someone had gained access to his account and promptly refunded his money.

Why didn’t PayPal help him fix his account then? Or did it do everything it could, but maybe Castellano failed to activate a necessary security feature like two-factor authentication, or maybe he shared his password? (He says he didn’t.)

In this instance PayPal did not freeze the account, luckily. I needed answers. So I asked PayPal. 

Shortly after that, I heard from Castellano with some good news. PayPal had agreed to reopen his case. They reviewed all the evidence, including transaction records and IP addresses of the logins, which show that Castellano couldn’t have possibly made these purchases. I heard nothing from PayPal.

Still, PayPal turned Castellano down — again.

Here’s the final outcome of this PayPal unauthorized charge case

I was not happy with that resolution. If Castellano had been negligent, then he deserved to take the $1,180 loss. But I had seen no evidence of that, and PayPal hadn’t provided him or me with any evidence, either.

I asked PayPal for an update on the case. A few weeks later, I Castellano sent me an email:

“Great news,” he wrote. “PayPal reopened both the cases and deemed them as unauthorized and PayPal refunded me.”

And what did PayPal have to say for itself? Nothing. No explanation. Not even an email to say it would help the customer. Just silence.

I can’t take all the credit for this resolution. Castellano was on the phone with PayPal almost every day, pressuring the company to reverse these fraudulent charges. He appealed to the highest level at PayPal — I list the contacts on this site — and didn’t take “no” for an answer.

So did someone hack into Castellano’s PayPal account, and was PayPal to blame for it? Or did he inadvertently share his password with a scammer, which compromised his account? It’s impossible to know. Castellano’s records suggest he did nothing wrong. PayPal won’t show me its records but has undone the $1,180 in unauthorized charges.

And in the end, maybe that’s all that matters.