A PayPal debit you never made (guest-payment fraud)

You don't have to click anything wrong to be hit by this one. PayPal's guest checkout ("pay without an account") lets anyone pay by typing a name and an IBAN — and nobody checks that the direct debit was authorised. Criminals feed in IBANs from old data leaks — possibly yours — and go shopping.

The first you hear of it is a PayPal direct debit (Lastschrift) on your bank statement for something you never ordered, or a payment reminder or debt-collection letter from PayPal. Consumer protection authorities warned about a wave of these unlawful guest payments in 2025. Many people assume "it must be my own mistake" — it usually isn't.

What to do: check your bank statement monthly. A direct debit can be returned free of charge within 8 weeks at your bank — do that, dispute the claim in writing with PayPal, and file a police report. Never just pay an unknown claim to make the letters stop.