Fake PayPal emails: Refunds and debits used as bait
Summary
Why is this warning issued?
This warning was included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.
How the scam works
- Criminals send fake PayPal emails to unsuspecting recipients
- Variant 1: They claim that an amount has been debited twice and that a refund of 95.66 euros is pending
- Variant 2: They warn of an alleged debit of 909 euros to the payment provider Digistore24 and use real merchant data as proof
- The emails contain realistic details such as the current date and order numbers to appear legitimate
- Recipients are supposed to click on buttons such as 'Receive refund', 'View payment details' or 'Cancel transaction'
- Clicking leads to a fake PayPal phishing page that harvests login and bank details
- With the stolen data, criminals take over the account or steal bank information
How to recognise it
- Unexpected email about a refund or debit you do not recognize
- Specific amounts such as 95.66 euros (refund) or 909 euros (debit) are mentioned
- Real merchant data such as Digistore24 is used as supposed proof
- The email contains a current date and an order number to appear genuine
- Links do not lead to real PayPal pages (paypal.com), but to fake phishing pages
- You are urged to log in immediately or cancel a transaction
- Request for TAN/PIN/card details
- Link to a fake login page
How to protect yourself
- Hover over the links in the email without clicking and check whether they lead to real PayPal pages (paypal.com)
- Consider whether the refund or debit is plausible: Did you really order something from the named merchant?
- Always log in to PayPal directly via your usual address or app, never via links from emails
- Only react if you see the same message in your real PayPal account
- If you have entered data on a phishing page: change your PayPal password immediately and contact PayPal customer service
- If financial damage has already occurred, file a report with the police and contact your consumer protection agency
What you should never do
- Do not click on links or buttons in suspicious PayPal emails
- Do not enter login or bank details on pages you have accessed via an email link
- Do not let yourself be pressured when a debit is announced, and do not react in panic
- Do not pay anything or give any confirmations before you have checked the claim yourself in your PayPal account
Frequently asked questions
Do I have to pay or stop the alleged debit of 909 euros?
No, do not reply to the email and do not click any link. Log in to PayPal directly and check whether a transaction actually appears there. Only if the debit appears there is it genuine.
Where did the fraudsters get my data and why does the email look so real?
Criminals use real merchant data such as the name Digistore24 to make the email appear credible. Your email address may come from data breaches. This does not mean that anyone has actually attacked your account.
I have already entered my data on the linked page – what now?
Change your PayPal password immediately, contact PayPal customer service and check your account for unknown payments. If money is missing, file a report with the police.
How can I tell whether a PayPal email is genuine?
Genuine PayPal emails inform you about activities that you also see in your account. Legitimate links begin with paypal.com. When in doubt, always log in to PayPal directly instead of following links.
What can I do to generally protect myself from phishing?
Where possible, enable two-factor authentication for your PayPal account and use secure, unique passwords. If you are unsure, your consumer protection agency can help.
Affected data
Comments
No comments yet. Registered users can share their experiences.
Related warnings
Original source
Find more information in the original source.
Watchlist Internet ↗Update history
- 31/07/2026Description updated
- 30/07/2026Warning added from an official source