"New registration" with PayPal is a warning sign for all citizens.

A message claiming that a “new registration” or unfamiliar sign-in has been detected on your PayPal account can be alarming, particularly if it threatens to limit your account within 24 hours. That pressure is often deliberate: phishing messages are designed to make you react before you have time to check.

The safest approach is simple. Do not use a link, button or telephone number in an unexpected email or text. Instead, open the PayPal app yourself or type the address you normally use into your browser. If there is a genuine problem, you should be able to see it after signing in through the official service.

Why a “new registration” message can be convincing

PayPal is widely used for online shopping, subscriptions and sending money, so an alert about a new device or sign-in can sound believable. Criminals often copy the style of security notifications and use subject lines such as “New registration detected”, “Unusual activity” or “Action required”.

The message may claim that:

• a new device has accessed your account;
• your details need to be confirmed;
• a payment has been paused;
• your account will be restricted or suspended;
• you must act within a short deadline.

A familiar logo, polished wording or a convincing blue button does not make a message safe. Phishing emails and texts can closely imitate genuine brands while leading to a fake sign-in page.

A security alert should prompt you to check your account through a trusted route, not rush into a link sent unexpectedly.

Warning signs that suggest phishing

One detail on its own may not prove an email is fraudulent. Several warning signs together, however, are a good reason to stop and check independently.

1. It tries to hurry you

Phrases such as “act now”, “final warning” and “within 24 hours” are common pressure tactics. A genuine company may sometimes ask you to take action, but a sudden threat of deletion or suspension is a reason to be cautious.

2. The greeting is vague or unusual

“Dear customer”, “PayPal user” or an oddly formal greeting can be warning signs when the message asks you to sign in or share details. A generic greeting is not conclusive by itself, but it should not be ignored.

3. It asks for sensitive information

Do not enter a password, one-time passcode, card number or bank details after following a link in an email or text. Fraudsters can use a fake page to collect details and try to access your real account immediately.

4. The sender is not what it appears to be

The name in your inbox can say “PayPal” even when the actual email address is unrelated. On a computer, inspect the sender details; on a phone, tap the sender name to reveal the full address.

Misspellings, unusual domains and long strings of random characters are all reasons for concern. Equally, a plausible-looking address does not guarantee that a message is genuine, so it is still safer to avoid its links.

5. The wording or design feels slightly wrong

Poor grammar can expose a scam, but polished writing is not proof of legitimacy. Look for unfamiliar terminology, awkward spacing, inconsistent branding or references to services you do not use.

6. The link leads somewhere unexpected

On a desktop computer, you can hover over a button without clicking to see where it appears to lead. If the address is not clearly an official PayPal web address, do not proceed. On a phone, it is usually safest not to press and hold a suspicious link at all.

The padlock icon does not prove a site is genuine

A fake website can display a padlock in the browser bar and use https://. This means the connection to that particular website is encrypted; it does not prove that the website belongs to PayPal or another trusted business.

Check the full web address rather than relying on the padlock. Scammers may use addresses containing familiar words alongside extra words, hyphens or misleading subdomains.

For example, a web address may contain the word “paypal” but still have no connection to the genuine service. If you are unsure, close the page and use the app or a saved, trusted web address instead.

How to check your account safely

If the message has worried you, checking your account is sensible - but do it independently of the message.

1. Leave the email or text alone

Do not tap its button, open an attachment, reply or call a number included in it. Replying may also confirm that your email address is actively monitored.

2. Use a route you already trust

Open the PayPal app installed on your phone, or type the website address you normally use directly into your browser. Avoid using search results to find a sign-in page if you can.

3. Review recent account activity

Once you are signed in through the genuine service, check notifications, recent transactions, linked cards and bank accounts, delivery addresses and contact details. Look for anything you do not recognise.

4. Secure the account if needed

If you spot unfamiliar activity, change your password through the official app or website. Choose a long, unique password that you do not use for email, shopping accounts or banking. Enable two-step verification if it is available, and check that your recovery email address and mobile number are correct.

The most reliable test is not trying to judge an email at a glance. It is bypassing the message and checking your account directly.

Reporting a suspicious message in the UK

Do not forward a suspicious email to friends or relatives if that could encourage them to open it. Report it through the appropriate channels, then delete it.

In the UK, suspicious emails can be forwarded to the National Cyber Security Centre’s Suspicious Email Reporting Service at [email protected]. Suspicious text messages can be forwarded to 7726, which spells SPAM on most keypads.

You can also follow PayPal’s reporting guidance in its official Help Centre. If money has been taken, or you believe you have been defrauded, report it to Report Fraud, the UK’s national fraud and cybercrime reporting service, at reportfraud.police.uk.

Useful housekeeping steps include:

• mark the email as phishing or junk in your email provider;
• block the sender where your email or messaging app allows it;
• delete the message after reporting it;
• warn people in your household about the scam without forwarding the original link.

If you clicked the link or shared details

A click alone does not necessarily mean that an account has been compromised, but it is worth taking prompt, calm action. Phishing is designed to catch people when they are busy, tired or concerned about money.

If you only opened the page

Close it without entering anything or downloading files. Update your phone, tablet or computer. If you downloaded an attachment, app or software, run a security scan using reputable security software and seek technical help if you are unsure what was installed.

If you entered your password

Change your PayPal password immediately through the official app or website. If you used that password elsewhere, change it on those accounts too - especially your email account, which may be used to reset passwords for other services.

If you shared a one-time code, card or bank details

Contact PayPal using its official support route. Then contact your bank or card provider using the number on the back of your card or the contact option in your banking app. Ask what steps they recommend for your account and query unfamiliar transactions promptly.

Keep screenshots, emails and transaction details for a report, but never include passwords, one-time codes or full card details when sending evidence.

Common mistakes to avoid

Scammers exploit ordinary habits, and even careful people can be caught out.

• Trusting the name displayed in the inbox: display names are easy to copy.
• Calling the number in the email: it may lead to a fraudster rather than genuine support.
• Reusing passwords: one stolen password can put several accounts at risk.
• Approving an unexpected sign-in request: never approve or share a code you did not request.
• Assuming correct spelling means a message is safe: many scam messages are well written.
• Delaying after sharing details: changing passwords and contacting providers quickly can help limit further misuse.

Make future alerts easier to handle

A password manager can help you create and store different passwords for each account. Keeping your devices updated and enabling two-step verification where available are sensible extra layers of protection. Transaction alerts in payment and banking apps can also help you spot genuine activity without relying on an unexpected email.

Treat a “new registration” warning as a reason to pause, not a reason to click. Open your account independently, report the suspicious message and use official contact routes if you find anything genuinely wrong.