Signs your account has been compromised

Your account is likely compromised if you see transactions you did not make, if your password no longer works, if your email address or phone number changed without your action, or if friends say they received money requests from you that you never sent. These are the clearest signals that someone else has access to your account.

Less obvious signs include login notifications from places you do not recognize, a sudden change in your account settings (like a new recovery email or phone number), or friends telling you they received suspicious messages that appeared to come from you. If your account is locked and you cannot log in, that is also a red flag — it may mean someone changed your password or triggered security protections.

Key Takeaways

  • Check your transaction history immediately for any payments you did not authorize, and look for changes to your email, phone number, or password.
  • If you spot unauthorized activity, change your password from a different device and contact the payment app's support team the same day.
  • Notify your bank or credit card company if money was taken from your account, because they may reverse fraudulent charges within a set window.
  • Enable two-factor authentication on your account and on the email address linked to it, so a hacker cannot lock you out even if they know your password.
  • If you cannot regain access to your account, file a report with the Federal Trade Commission at IdentityTheft.gov so you have documentation for your bank and creditors.

What to do right now if you think you are hacked

Stop using the account and log out from all devices. Open a different device (a phone, tablet, or computer the hacker is unlikely to have access to) and try to log in with your current password. If you cannot log in, try the "Forgot Password" option — if that does not work either, the hacker may have changed your password and your recovery email.

If you can log in, change your password immediately to something you have never used before. Make it at least 16 characters long and use a mix of uppercase, lowercase, numbers, and symbols. Do not reuse a password from any other account. Then check your account settings: look at the email address, phone number, and recovery options listed. If any of these have changed, change them back right away.

Next, review your transaction history for the past 30 to 90 days. Look for any money sent to people you do not know or to accounts you do not recognize. Write down the date, amount, and recipient of each unauthorized transaction — you will need this information when you contact support.

Contacting PayPal, Venmo, or Zelle support

Call or message the payment app's support team on the same day you discover the problem. Do not use a phone number or link from an email — go directly to the app or the official website to find the contact information. Scammers often send fake support emails with links that look real but lead to phishing pages where they steal more information.

Tell support exactly what happened: which transactions were not yours, when you first noticed the problem, and whether you can still access your account. They will ask you to verify your identity by answering security questions or confirming recent transactions you did make. Be ready to provide your full name, the phone number or email linked to your account, and the last four digits of any payment method on file.

PayPal, Venmo, and Zelle all have fraud departments that investigate unauthorized transfers. They may freeze your account while they look into it — this is normal and protects you. Ask support for a case number and when you can expect an update. Write down everything they tell you, including the name of the person you spoke with and the date and time of the call.

Protecting money that was already sent

If a hacker sent money from your account to someone else, contact your bank or credit card company immediately if the money came from your bank account or card. Tell them the transaction was unauthorized. Banks and card companies have different windows for reversing fraud — some allow 30 days, others allow 60 — so call as soon as you realize what happened.

The payment app itself may also reverse the transaction if it was sent to a new recipient or if the receiving account has not withdrawn the money yet. This is why speed matters: the sooner you report it, the better the chance the money can be stopped before it leaves the recipient's account.

If money was sent to someone you know (a friend or family member), contact them directly and explain what happened. Ask them to return the money or to contact the payment app to report that they received a fraudulent transfer. Many people will cooperate once they understand the situation.

Securing your account so it does not happen again

Turn on two-factor authentication in your account settings. This means that even if someone knows your password, they cannot log in without a code sent to your phone or generated by an authenticator app. PayPal, Venmo, and Zelle all offer this feature — it is usually called "two-factor authentication," "two-step verification," or "security key."

Use an authenticator app like Google Authenticator, Microsoft Authenticator, or Authy rather than text message codes if the payment app offers it. Authenticator apps are harder for hackers to intercept than SMS messages. If you must use text messages, make sure your phone number is not shared across multiple accounts and that your phone carrier has a strong password protecting your account.

Enable two-factor authentication on the email address linked to your payment account as well. If a hacker gains access to your email, they can use the "Forgot Password" option to reset your payment app password and lock you out. Protecting your email is just as important as protecting the payment app itself.

Check your connected accounts and payment methods. In your payment app settings, look for any bank accounts, credit cards, or linked services you do not recognize. Remove anything that is not yours. Also check which apps or websites have permission to access your payment account — remove any that you no longer use.

If you cannot regain access to your account

If the hacker changed your password and your recovery email, you may not be able to log back in on your own. Keep trying to contact support through the app or website, but also file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record that you are a victim of fraud, which you can show to your bank, credit card company, or other creditors if they question charges later.

If the hacker used your account to take out a loan, open a credit card, or commit other fraud in your name, you may need to place a fraud alert or credit freeze on your credit file. You can do this through any of the three major credit bureaus: Equifax, Experian, or TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts. A credit freeze blocks access to your credit file entirely until you lift it.

What the payment apps will and will not do

PayPal, Venmo, and Zelle have different policies about refunding unauthorized transfers. PayPal generally covers unauthorized transactions if you report them within 180 days. Venmo's policy depends on whether the transfer went to a verified user or an unverified account — transfers to unverified accounts are easier to reverse. Zelle is the most restrictive: it only refunds money if the receiving bank agrees to reverse it, which happens less often than with the other two apps.

None of these apps will refund money you sent to a scammer if you were tricked into sending it yourself — that is different from a hacked account. If you sent money because someone pretended to be a company or a person you trust, that is fraud, but the payment app may not cover it. This is why it is important to verify requests before sending money, especially if someone asks you to send it quickly or to keep it secret.

Frequently Asked Questions

How long does it take to get my money back?

It depends on the app and the situation. PayPal typically investigates within 10 business days but may take up to 180 days to make a final decision. Venmo and Zelle can take longer, especially if the money has already been withdrawn from the receiving account. Ask support for a timeline when you file your report.

Can the hacker see my bank account information?

Not usually. Payment apps do not store your full bank account number or routing number in a way that hackers can see. However, if the hacker has access to your email or phone, they may be able to reset your bank's password and access your account directly. Change your bank password immediately if you think your email or phone is compromised.

Will the payment app tell me how the hacker got in?

Sometimes. If your password was weak or reused from another site, support may tell you that. If your email was phished or your phone was compromised, they may not know the exact cause. Focus on securing your account now rather than understanding how it happened — the payment app's investigation may reveal more later.

Should I close my account after being hacked?

Not necessarily. Closing the account does not undo the fraud and may make it harder to dispute charges later. Keep the account open while you work with support to resolve the issue. Once everything is settled and you have secured it with two-factor authentication, you can decide whether to keep using it.

What if the hacker is still accessing my account?

Change your password from a different device and enable two-factor authentication immediately. If you cannot log in or if you keep seeing new unauthorized transactions, contact support and tell them the account is still being actively used by someone else. They may freeze the account to prevent further damage while they investigate.