Fake PayPal email threatens account closure in 90 days due to inactivity to harvest login credentials

What is this scam?

Phishing emails impersonating PayPal warn recipients that their account will be permanently closed within 90 days due to inactivity, and that they must create a new account via an embedded link to preserve their balance and payment history. The link leads to a fraudulent PayPal sign-in page designed to steal login credentials and personal details. Which? flagged this as newly active in early September 2026. PayPal does not close accounts for inactivity via unsolicited email — any genuine notification would direct users to log in independently at paypal.com.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not call any numbers or click any links in the message.
2. Log in to your account directly via the official website or app to check for any real alerts.
3. Forward the message to 7726 or email report@phishing.gov.uk.
4. Report it to Action Fraud at actionfraud.police.uk.