What PayPal can and cannot do with your checking account
PayPal cannot make withdrawals from your checking account unless you have explicitly authorized them to do so. Once you link a bank account to PayPal, you control what happens next—PayPal does not have blanket permission to pull money whenever they choose. The authorization you give is specific: you allow PayPal to withdraw funds only when you initiate a transaction, send money, or set up a recurring payment that you approve in advance.
If money has left your account without your knowledge, one of three things happened: someone else used your PayPal account with your linked bank account, PayPal is withdrawing funds on behalf of a recurring payment you set up and forgot about, or a third party (not PayPal) initiated the withdrawal using your bank details. Each situation has a different recovery path.
Key Takeaways
- PayPal can only withdraw from your bank account when you authorize a specific transaction or recurring payment—they cannot pull money on their own initiative.
- If unauthorized withdrawals appear, check your PayPal transaction history first to see whether the withdrawal came from PayPal or from a different company using your bank account number.
- Unauthorized PayPal transactions should be reported through PayPal's Resolution Center within 180 days; unauthorized bank withdrawals by other parties should be reported to your bank within 60 days.
- Your bank can reverse unauthorized ACH withdrawals, but the timeline and your liability depend on how quickly you report the fraud.
- Linking a debit card instead of a bank account to PayPal gives you stronger fraud protections under Regulation E.
How to check whether PayPal actually made the withdrawal
Start by looking at your bank statement. The withdrawal description will tell you who initiated it. If it says "PayPal" or "PAYPAL *" followed by a transaction ID, PayPal processed the withdrawal. If it says something else—a company name you do not recognize, or initials like "ACH DEBIT" with no company identifier—then a different entity pulled the money using your bank account number, and your bank is the right place to report it.
Log into your PayPal account and go to your transaction history. Search for the date and amount of the withdrawal. If the transaction appears in your PayPal history, PayPal moved the money. If it does not appear, PayPal did not initiate it. This distinction matters because the reporting process and your protections are different.
Check your PayPal settings for recurring payments or subscriptions. Go to Settings > Payments > Manage automatic payments. You may have set up a subscription years ago and forgotten about it—streaming services, software trials, or donation programs sometimes renew automatically. If you find an active recurring payment you did not authorize, you can cancel it when ready, and PayPal can often reverse recent charges.
If PayPal made the unauthorized withdrawal
Report it through PayPal's Resolution Center. Log in, go to Resolution Center, and select "Report a Problem." Choose the transaction and explain that you did not authorize it. PayPal will ask you to confirm your account details and may request documentation. The company investigates claims of unauthorized access and can reverse the transaction if they determine it was fraudulent.
PayPal's investigation typically takes 10 business days, though complex cases can take longer. During this time, the money remains in dispute. If PayPal finds in your favor, they will return the funds to your PayPal balance, and you can transfer that balance back to your bank account. If they find against you—for example, if the transaction matches a pattern of authorized activity on your account—you can appeal within 20 days.
If someone else accessed your PayPal account, change your password when ready and enable two-factor authentication. Check whether your email address or phone number has been changed in your account settings. If they have, a third party may still have access. You can also review your login history in Settings > Security to see where your account was accessed from.
If another company made the withdrawal using your bank account
Contact your bank when ready. Report the transaction as unauthorized and ask the bank to reverse it as an ACH (Automated Clearing House) debit. Your bank can file a dispute with the originating company and recover the funds. The bank must investigate within 10 business days and either reverse the charge or explain why they will not.
Your liability for unauthorized ACH withdrawals depends on how quickly you report them. If you report within two business days of discovering the fraud, your liability is capped at $50. If you report between two and 60 days, your liability can be up to $500. If you wait longer than 60 days, you may lose the right to dispute the charge entirely. Report when ready, even if you are not sure whether the withdrawal was truly unauthorized.
Ask your bank for a written confirmation of the dispute and the case number. Keep this documentation. The bank will contact the company that initiated the withdrawal and demand proof that you authorized it. If the company cannot provide authorization, the bank will reverse the charge within 5 to 10 business days.
Why linking a debit card is safer than linking a bank account
When you link a debit card to PayPal instead of a bank account, your fraud protections change. Debit card transactions are covered under Regulation E, which limits your liability to $50 if you report fraud within two business days. Bank account withdrawals (ACH debits) have the same liability cap, but the process is slower and the window to report is longer.
More importantly, if someone fraudulently uses your debit card through PayPal, the card issuer can reverse the charge quickly—often within 24 hours—while you still have access to your bank account. With a linked bank account, the money is pulled directly from your checking account, and you lose access to it when ready while the dispute is being investigated.
If you currently have a bank account linked to PayPal and you are concerned about fraud, consider unlinking it and using a debit card instead. You can link multiple payment methods to PayPal and choose which one to use for each transaction.
What to do if your PayPal account was hacked
Change your password to something long and unique—at least 16 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used elsewhere. Enable two-factor authentication by going to Settings > Security > Two-Step Verification. PayPal will send you a code via text or email every time someone logs in from a new device.
Review your linked payment methods. Go to Settings > Payments > Manage your payment methods and remove any cards or bank accounts you do not recognize. Check whether your email address or phone number has been changed. If they have, change them back when ready and find the email account itself—if someone has access to your email, they can reset your PayPal password.
If the hacker made purchases or sent money, report each transaction in the Resolution Center. PayPal investigates account takeover cases separately from individual transaction disputes and may be able to reverse multiple charges at once. Document everything: screenshots of unauthorized transactions, the date you discovered the fraud, and the date you changed your password.
Timeline for getting your money back
| Situation | Where to Report | Investigation Time | Reversal Time |
|---|---|---|---|
| Unauthorized PayPal transaction | PayPal Resolution Center | 10 business days | 3–5 business days after decision |
| Unauthorized ACH withdrawal (bank account) | Your bank | 10 business days | 5–10 business days after investigation |
| Unauthorized debit card charge | Card issuer | 1–3 business days | 24 hours to 5 business days |
| Account takeover (multiple transactions) | PayPal + bank (if needed) | 10–30 days | Varies by case |
The fastest path is usually through your bank if the withdrawal came from a source other than PayPal. Banks can reverse ACH debits quickly once they confirm the withdrawal was unauthorized. If PayPal made the withdrawal, expect the process to take longer because PayPal must investigate whether you actually authorized it.
Keep records of all communications with PayPal and your bank during the dispute process. Save confirmation numbers, case IDs, and copies of emails. If either organization denies your claim, you will need this documentation to appeal or escalate the dispute.
Frequently Asked Questions
Can PayPal charge me fees for disputing an unauthorized withdrawal?
No. PayPal does not charge you to file a dispute in the Resolution Center. However, if you dispute a transaction and PayPal finds that you actually did authorize it, they may close your account. Your bank also does not charge you to dispute an unauthorized ACH withdrawal, though some banks charge a fee if you file multiple disputes in a short period.
What if PayPal says I authorized the withdrawal but I did not?
You can appeal PayPal's decision within 20 days of their ruling. Provide any evidence that you did not authorize the transaction: screenshots showing you were not logged in, proof that you were in a different location, or documentation that your account was compromised. If PayPal still rules against you, you can file a chargeback through your bank or card issuer, though this may result in your PayPal account being closed.
If I unlink my bank account from PayPal, will that stop the unauthorized withdrawals?
Yes, unlinking your bank account will prevent PayPal from making any future withdrawals. However, if someone else still has access to your PayPal account, they can link a different payment method. Change your password and enable two-factor authentication before unlinking your bank account to make sure the hacker cannot re-link it.
How long do I have to report an unauthorized withdrawal to my bank?
You have up to 60 days from the date the withdrawal appeared on your statement, but your liability is capped at $50 only if you report within two business days. Report when ready to protect yourself fully. Some banks allow you to report fraud through their app or website, which creates an when ready record of your report.
Can I get my money back if I wait more than 60 days to report?
Possibly, but you lose your legal protections. After 60 days, your bank is not required to investigate or reverse the charge. However, some banks will still help you if you can prove the withdrawal was fraudulent. Contact your bank and explain the situation—they may reverse it as a courtesy, especially if you have been a customer for a long time.