How do I report a PayPal phishing email?

Forward the email as an attachment (not inline text) to spoof@paypal.com. Also submit the included URL to Blackwall: that's the only way to get the phishing page taken offline.

How do I recognize a fake PayPal email?

Impersonal greeting ('Dear customer'), urgency ('account suspended in 24h'), spelling mistakes, and suspicious links (hover to check: real links only go to paypal.com).

I clicked the link: what now?

If you entered data: change your PayPal password immediately, enable 2FA, and check your recent transactions. Report the incident to PayPal by phone and to your bank.

Can SMS-based PayPal phishing (smishing) also be reported?

Yes. Forward the SMS to your carrier's spam-reporting service (free, works with all major carriers). Also submit the included URL to Blackwall.

What does Blackwall do differently from PayPal's own report?

PayPal analyzes the email and updates spam filters, but the phishing page stays online. Blackwall contacts the host and registrar so the page actually disappears.

Can I report anonymously?

Yes. Blackwall accepts anonymous reports. Your identity is never shared with the host or the operator of the phishing site.

Report PayPal Phishing & Take the Fake Site Offline

A complete guide: document a fake PayPal email, forward it to PayPal's fraud team, and get the phishing URL taken down at the host.

Report the URL now General phishing guide

5 steps to a PayPal phishing takedown

Step 1

Don't click the PayPal email: check the header

Open the email in preview mode only. Check the sender address: real PayPal emails come exclusively from @paypal.com. Anything else (paypa1.com, paypal-service.info) is phishing.

Step 2

Save a screenshot + the original header

Take a screenshot of the email and export the full header (in Gmail: 'Show original'). The header contains the return path and authentication results (SPF/DKIM/DMARC) that prove it's phishing.

Step 3

Check the phishing URL in WHOIS

Never click links directly. Copy the URL and check WHOIS to see who hosts the domain. PayPal phishing often runs on Cloudflare, Namecheap, or OVH: every host has an abuse address.

Step 4

Report it to PayPal + Blackwall + the BSI

Forward the original email to spoof@paypal.com (PayPal's fraud team). In parallel, submit the URL to Blackwall (hosting takedown) and to phishing@bsi.bund.de (national warning).

Step 5

Wait for takedown confirmation

Blackwall checks the phishing domain hourly and confirms once the host takes the page offline. Typical duration: 2-24 hours. You'll receive a status email.

Where to report PayPal phishing

Reporting to multiple channels works best: the fraud team, a hosting takedown, and a national warning.

BlackwallTakedown

Submits the URL to the host and registrar, monitors the status hourly, and confirms removal. GDPR-aligned, operating globally.

Submit URL

PayPal Fraud

spoof@paypal.com: forward the original email as an attachment. PayPal updates its spam filters and warns other users.

paypal.com/security

BSI Citizen CERT

phishing@bsi.bund.de: national analysis and warnings from Germany's federal cybersecurity agency (BSI). Combining this with Blackwall is recommended.

bsi.bund.de

Verbraucherzentrale Phishing Radar

phishing@verbraucherzentrale.nrw: Germany's consumer protection agency documents phishing waves and publishes weekly warnings.

verbraucherzentrale.nrw

Frequently asked questions about PayPal phishing

Report the PayPal phishing site now

One report, one complete takedown workflow. Blackwall handles the communication with the host.

Report the URL now Found a fake shop? →