Will PayPal or Cash App Refund an Unauthorized Payment?

Usually yes, if someone else sent your money and you report it fast. Usually no, if a scammer talked you into sending it yourself.

Here is an example. Marcus leaves his phone in a gym locker on a Saturday. It is gone when he comes back that evening. He has no screen lock. That night the thief opens his money app and sends $300 to a stranger. On Thursday the thief sends another $900.

What Marcus gets back depends on one thing: how fast he reports it.

• If he reports on Monday, the thief got $300 before he called. Under federal law he owes at most $50. He gets at least $250 back.
• If he waits until Friday, the thief got $1,200. He can owe up to $500. He gets at least $700 back.

That is the good news. PayPal and Cash App must follow a federal rule called Regulation E for payments you did not make. The bad news is about scams. If someone fooled Marcus into pressing send himself, that rule usually would not help him. This guide shows the difference, and what to do in each case.

Do federal rules really apply to PayPal and Cash App?

Yes, for personal accounts. Regulation E covers any company that holds your account or gives you a way to move money, not only banks. A 2016 rule also added prepaid accounts (accounts you load with money ahead of time) that are used mainly to send money to other people.

The CFPB has said payment apps that hold consumer accounts count as financial institutions under Regulation E. Both PayPal's user agreement and Cash App's terms include the Regulation E rules for errors and unauthorized payments. The same rules cover Venmo, which PayPal Holdings owns.

What counts as an unauthorized payment?

A payment is unauthorized when someone else sends your money without your permission, and you get nothing from it. The simple test is: who pressed send?

Note the third row: being tricked into sharing a code is different from being tricked into paying. The official notes that explain Regulation E say a transfer is unauthorized if someone got your access from you "through fraud." The CFPB has said the same about people tricked into sharing login details.

Being careless does not change this. Those official notes say your own carelessness, such as having no screen lock, cannot raise what you owe.

How much can I lose if someone else sent the money?

It depends on how fast you report. If a phone, card, PIN or login was lost or stolen, three limits apply.

The day you find out does not count toward the 2 business days. Cash App's terms count every day except weekends and federal holidays as a business day. In Marcus's case, he found out Saturday. His 2 business days were Monday and Tuesday, so his deadline was the end of Tuesday.

If nothing was lost or stolen, for example a hacker got in from far away, the $50 and $500 tiers do not apply. If you report within 60 days after the statement shows it, you owe nothing for those payments.

PayPal's agreement goes further than the law in one way. It says that when its protection applies, PayPal will cover the full amount of unauthorized activity, as long as you cooperate.

How fast must PayPal or Cash App act?

Once you report, a timer starts.

• 10 business days to decide. The company must decide within 10 business days whether there was an error.
• Up to 45 days with a temporary credit. If it needs longer, it can take up to 45 days. But it must put the money back in your account within 10 business days while it looks. You can use that money. This is called a provisional credit.
• Written confirmation. If you report by phone, the company can ask you to confirm in writing within 10 business days. If you do not, it can skip the temporary credit.
• Longer for new accounts. If the account is less than 30 days old, it can take 20 business days and up to 90 days. Some in-store purchases made with the app's debit card also get up to 90 days.
• Results in writing. It must tell you the result within 3 business days after it finishes. If it finds no error, it must explain why in writing. You can ask for copies of the documents it used.

What if a scammer talked me into sending the money?

This is the case where you are least likely to get your money back. If you pressed send, the law usually treats the payment as authorized, even though you were tricked. Regulation E's error rules then do not require a refund.

The apps say this plainly. Cash App's terms warn that scams "may result in the loss of your funds with no recourse," meaning no way to get it back.

PayPal has one more tool. Its Purchase Protection program can refund an eligible purchase from a seller that never arrives, or that is significantly not as described. But it has limits:

• Friends and family payments are not covered. If a seller asks you to pay this way, that is a warning sign.
• Item never arrived: open a dispute within 180 days of paying.
• Item not as described: open a dispute within 30 days of delivery, or 180 days of paying, whichever comes first.

PayPal also notes that if you paid with a credit or debit card, your card's dispute rights may be broader. That is a good reason to pay strangers with a credit card.

Report a scam to the app anyway, right away. A payment can sometimes be stopped before the other person gets it.

What do the CFPB complaint numbers show?

We pulled counts from the CFPB's public complaint database for money transfer and money app complaints. The topic was "unauthorized transactions or other transaction problem." We compared June 26 to September 23, 2026, with the same dates in 2025.

That is a rise of 64%. PayPal Holdings and Block together had 1,475 of the 1,865 complaints, or 79%.

A complaint count is not proof that a company did anything wrong. The CFPB says its database is not a statistical sample. These are large apps with many users. The numbers show that many people are having trouble getting these payments fixed right now.

Deadlines at a glance

What should I do right now?

1. Report it today, inside the app. Or call the number in the app's own terms: (888) 221-1161 for PayPal and 1-800-969-1940 for Cash App. Cash App says that number is its only support line. Never call a "support" number from a search ad or a text.
2. Lock things down. Change your password, turn on a PIN or face lock, and sign out of other devices.
3. Write down two dates. When you found out, and when you reported. These decide how much you can lose.
4. Confirm in writing if asked. Do it within 10 business days, or you can lose the temporary credit.
5. Check your balance by business day 10. If the review is still open, the money should be back by then.
6. If you are denied, ask for the documents. Then file a complaint at consumerfinance.gov/complaint. The company has 15 days to respond.

If the money came out of a credit card, the rules are different and usually stronger. See what to do when a credit card dispute is denied. For bank transfers through Zelle, see will your bank refund a Zelle scam.