Two very different problems share one scary email subject. A limited PayPal account means PayPal has restricted what you can do. A hacked account means someone else is using it. Mixing them up wastes days, and clicking the wrong 'fix it now' link can turn a limitation into a real theft. This guide shows how to tell them apart and what to do in Canada.
Every step below comes from PayPal's own help pages, checked on October 30, 2026. Where the rules differ by country or situation, we say so.
Most 'your account is limited' emails are fake
PayPal tells you to check the Resolution Center directly. If you received an email about a limitation but see none there, forward the email to phishing@paypal.com and delete it. Never log in through a link in the email.
Limited vs. Hacked: How to Tell Which One Happened to You
| Sign | Likely limited | Likely hacked |
|---|---|---|
| What you see | A notice in the Resolution Center or Dashboard bell | Payments, logins or changes you did not make |
| Can you send or withdraw? | Often blocked until steps are done | Usually yes, which is how money leaves |
| A limitation notice that matches the Resolution Center | Password, email or payment alerts you did not cause | |
| Money | May be held while PayPal reviews | Missing or spent without your approval |
| Correct first step | Complete the steps in the Resolution Center | Change the password and report the payments |
It can also be both: PayPal may limit an account when it suspects someone could be using it without your knowledge and investigate the activity it detected. In that case, report the unauthorized payments and complete the limitation steps in the same place.
How PayPal Accounts Actually Get Compromised
Phishing emails and texts. They claim a limitation, a payment, a dispute or a security alert, and send you to a copy of the PayPal login page. Enter your details there and the attacker has them in seconds, along with the code if you type it in.
Password reuse. A password from a breached site is tried on PayPal automatically. A unique password and two-step verification stops this.
A compromised email account. Anyone who controls the inbox can click 'forgot password' on PayPal. Secure the email first.
Fake support calls and remote access scams. Callers pretend to be PayPal or a bank, ask you to install a remote tool and 'verify' the account. PayPal does not ask you to share a code or give control of your computer.
Malware on the device. Keyloggers and browser-session stealers capture logins. If the computer is infected, a new password will be taken again.
Clicked something and not sure what it did?
If you opened a link, installed a tool or entered your login on a page you doubt, our certified bilingual technician checks the device for malware, secures your email and PayPal and sets up 2-step verification correctly.
If the Account Is Limited: What PayPal Says to Do
PayPal's official page explains that a limited account means you cannot do certain things, for example send or withdraw money, and that you usually need to complete some steps to remove it. Those steps appear in your Resolution Center or under the bell icon on your Dashboard.
- Complete every item listed, and upload requested documents using PayPal's tips for clear submissions
- If all steps are done and the account is still limited, PayPal is either reviewing your information or has emailed you asking for more
- Check your email, spam folder and the Message Center for follow-up requests
- Do not open a second case for the same limitation; add information to the existing one
PayPal says the time to resolve a limitation depends on the complexity of your specific case, and it does not give a single guaranteed turnaround. Be wary of any site that promises a fixed number of days.
If You Were Hacked: Reporting Unauthorized Activity
PayPal's reporting steps are: Resolution Center, Report a problem, choose the payment, Continue, then 'I want to report unauthorized activity'. After you file, PayPal investigates and emails you within 10 days. For wider scams there is also PayPal's report fraud page.
Before you file, make sure the charge is not authorized by someone in your household or an automatic payment such as a subscription. PayPal itself asks you to check this first, and filing false reports can create problems for you.
How long do you have in Canada?
Report immediately. PayPal Canada's terms generally expect unauthorized transactions and errors to be reported within 60 days of the statement that shows them, and that window is tied to eligibility for full protection. You may see 180 days quoted online. That longer figure relates to other situations, such as reporting an error on a payment receipt or a balance hold, so do not rely on it for unauthorized activity. Read the current PayPal Canada User Agreement for exact wording in your case.
Held funds
PayPal's User Agreement says it may hold a balance for up to 180 days in specified circumstances, for example to protect against liability or because of an Acceptable Use Policy violation, and certain legal processes can extend this. Check the Resolution Center for the reason, and keep your documents ready.
Never pay to 'unlock' a PayPal account
No one but PayPal can remove a limitation or reverse a hack. If a caller, email or chat asks for a code, a remote session, gift cards or an upfront fee to 'release your funds', end the contact and use the Resolution Center only.
What to Gather Before You Contact Anyone
- The email address and phone number on the account
- Dates, amounts and recipients of any payments you did not make
- Screenshots of the limitation notice, login alerts and any suspicious email
- Government ID and proof of address, since limitations often ask for them
- Business registration or invoices if it is a business account being reviewed
- A short timeline of what you clicked, installed or told a caller
If money also left your bank account or card through PayPal, tell the bank at the same time and ask it to watch for further unauthorized activity.
Keeping the Account Safe Afterwards
- Two-step verification or a passkey on PayPal and on the email account
- A unique password stored in a password manager
- Never click links in payment or limitation emails. Open the app or type the address
- Never share a code or give someone remote access to 'verify' an account
- Review linked banks, cards and automatic payments every few months
- Keep the computer clean. Run a full malware scan and keep the system updated
7 Steps to Fix a Limited or Hacked PayPal Account
Log in directly and check the Resolution Center
Type paypal.com yourself or open the app. Do not use links in any email. Open the Resolution Center or tap the bell icon on your Dashboard. PayPal's limitation help page says this is where it shows what is restricted and what it needs from you.
Decide: limited, hacked, or a fake email
If the Resolution Center lists a limitation, you are limited. If it shows nothing but you received an email saying you are, the email is probably fake. If you see payments or changes you did not make, the account may be compromised. Each case has a different next step, covered below.
If it is a fake email, forward it and delete it
Per PayPal, forward the email to phishing@paypal.com, then delete it from your inbox. If you clicked a link or downloaded an attachment, log in to PayPal directly, review your payments and change your password. Also change the password on any other site that shared it.
If you were hacked, change your password and secure the email
Change your PayPal password and security questions promptly, then secure the email account tied to PayPal, since that inbox can reset your password. Turn on two-step verification or a passkey in PayPal's security settings, and sign out of devices you do not recognize.
Report unauthorized payments in the Resolution Center
Follow PayPal's steps to report an unauthorized transaction: Resolution Center, Report a problem, choose the payment, Continue, then 'I want to report unauthorized activity'. PayPal says it will investigate and email you within 10 days. Report right away and do not wait.
If it is a limitation, complete the steps PayPal lists
Do what the Resolution Center asks and upload any documents it requests. PayPal has tips for submitting documents. If everything is done and the account is still limited, PayPal says it is either reviewing what you sent or has emailed you for more. How long it takes depends on the complexity of your case.
Cancel automatic payments and stop other leaks
If the attacker or an old subscription is charging you, cancel it under Settings, Payments, Automatic payments. Check your linked bank accounts and cards for anything unfamiliar, and tell your bank if you see it. For a completed purchase you want refunded, contact the seller.
Want a person to check everything with you?
Our technician can join you on a remote session, verify the email is real or fake, scan the device and walk you through reporting and securing the account.
Worried you clicked a fake PayPal link?
PayPal can fix the account but cannot check your computer. IT Cares scans for keyloggers and phishing leftovers, secures your email and payment accounts and sets up 2-step verification correctly.
Frequently Asked Questions
What does a limited PayPal account mean?
A limitation restricts what you can do, for example sending or withdrawing money. It does not by itself mean your account was hacked. PayPal usually asks you to complete steps in the Resolution Center, and it may also limit an account if it suspects someone is using it without your knowledge.
How do I know if the 'your account is limited' email is real?
Do not click it. Log in to PayPal directly and check the Resolution Center. If there is no limitation listed, you may have received a fake email, so forward it to phishing@paypal.com and delete it.
How do I report an unauthorized PayPal payment?
Go to the Resolution Center, choose Report a problem, select the payment, click Continue and choose 'I want to report unauthorized activity'. PayPal says it will investigate and email you within 10 days. Report as soon as you notice it.
How long do I have to report an unauthorized PayPal transaction in Canada?
Report it immediately. PayPal Canada's terms generally expect unauthorized transactions to be reported within 60 days of the statement that shows them to qualify for full protection, and a longer 180-day figure you may see online applies to different situations. Check the current PayPal Canada User Agreement for the exact wording.
How long will PayPal hold my money?
PayPal's User Agreement says it may hold a balance for up to 180 days in specified circumstances, such as protecting against liability or an Acceptable Use Policy violation, and certain legal processes can extend a hold. The Resolution Center and PayPal's notice give the reason and instructions for your case.
Can someone unlock a limited PayPal account for a fee?
No. Only PayPal can remove a limitation, and it does so when you complete its steps and it finishes reviewing. Anyone offering to unlock the account, asking for a code, a login or an upfront fee is a scammer.