Scammers are claiming a new 2026 security rule requires PayPal users to activate protection immediately, in an attempt to harvest login details and one-time codes.
A fresh wave of phishing emails is targeting PayPal users with a familiar mix of urgency, fear and false authority. The messages claim that a new security rule for 2026 requires account holders to activate a protection module, then pressure recipients to act within 24 hours or risk having their accounts restricted, according to consumer advisers in Germany. The aim is not routine verification, but to trick people into handing over one-time security codes and other login details that could be used to bypass two-factor authentication.
The fake messages are designed to look convincing at first glance. They use a subject line that suggests a security check is needed, highlight the supposed deadline in red and include a button inviting users to “activate” protection immediately. Consumer groups say several warning signs should stand out: a dubious sender address, no personalised greeting and a link that leads away from PayPal’s official systems. According to PayPal’s own anti-fraud guidance, similar scams often rely on generic language, urgent demands and requests for sensitive information that a legitimate company would not ask for in this way.
The safest response is to ignore the email, move it to the spam folder and avoid clicking any links or entering any data. PayPal says customers should check account activity only through the official app or by typing the known website address directly into a browser, rather than following links in messages. The company also advises users to forward suspicious emails to phishing@paypal.com and delete them from the inbox. In Germany, the Verbraucherzentrale NRW asks recipients to send doubtful PayPal messages to its own phishing radar at phishing@verbraucherzentrale.nrw.
The warning fits a broader pattern identified by Germany’s Federal Office for Information Security, which says a significant share of unwanted emails are phishing attempts and that many people have already received such messages. Security experts also note that stolen details from phishing campaigns are frequently reused in other scams, including fraudulent phone calls posing as banks or public bodies, a tactic known as vishing. PayPal says it never asks for sensitive information through unsolicited email and encourages customers to report suspicious messages rather than reply to them or open attachments.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
