Short answer: To set up 2FA on PayPal, sign in and go to Settings → Security → 2-step verification, then choose Use an authenticator app. Scan the QR code, enter the six-digit code to confirm, and save your backup information. PayPal defaults to SMS — switch away from it, because a hijacked phone number gives an attacker access to your linked bank account and cards.
Why PayPal deserves your strongest setup
PayPal is not just a login. It is typically connected to a bank account, one or more cards, and possibly a balance. An attacker who gets in can send money, change your linked bank details, or use the account to make purchases.
PayPal’s buyer and seller protections are genuinely good, and unauthorised transactions are often recoverable — but recovery means weeks of disputes, a frozen account, and no access to your money in the meantime. Prevention is considerably cheaper than the claims process.
Step 1: Open your security settings
- Sign in to PayPal on a desktop browser — the full settings are easier to reach there.
- Click the gear icon in the top right.
- Open the Security tab.
- Find 2-step verification and click Set Up or Update.
Step 2: Choose the authenticator app
PayPal offers a few options. In order of strength:
- Security key — a physical FIDO2 device. Strongest available, and worth it here. See hardware security keys explained.
- Authenticator app — offline codes on your device. The right default for most people.
- SMS or automated call — the fallback PayPal pushes hardest, and the weakest.
Select Use an authenticator app. PayPal displays a QR code along with a text key.
Step 3: Scan and confirm
- Open your authenticator app and add a new account.
- Scan the QR code, or copy the text key if you are setting up on the same device.
- Enter the six digits your app shows.
- Confirm.
Never screenshot the QR code. It contains your secret key in plain form, and screenshots sync to cloud photo libraries. Anyone who obtains that image can generate valid PayPal codes indefinitely.
If you want redundancy, scan the same code into a second app while it is still on screen — PayPal will not show it again. Our Authy vs Google Authenticator comparison covers which apps make backup easier.
Step 4: Deal with SMS
PayPal often keeps a phone number registered as a backup verification method, and in some regions will not let you remove it entirely.
Do what you can: make the authenticator app your primary method, remove any phone number that is not needed, and call your mobile carrier to add a port-out PIN. That PIN is the practical defence when a service will not let you drop SMS. The attack it blocks is explained in what a SIM swap attack is.
Step 5: Audit the rest of the account
While you are in Security settings:
- Automatic payments — review every merchant with a standing agreement and cancel what you no longer use.
- Linked cards and banks — remove anything stale. Fewer funding sources means less exposure.
- Permissions you’ve given — revoke third-party apps and sites with API access.
- Your email address — whoever controls it can reset PayPal. Secure it first; see our Google account 2FA guide.
- Notifications — enable alerts for payments sent and account changes, so you notice fast.
The scam 2FA will not stop
PayPal phishing is relentless and convincing — fake invoices, fake “unauthorised transaction” alerts, fake refund requests, each with a link to a login page that looks right.
If you type your password and your six-digit code into that page, an attacker relays both to the real PayPal within the 30-second window. Your 2FA worked exactly as designed and you are still compromised. This limitation applies to every TOTP app, as covered in how TOTP codes work.
Never log in through a link in an email. Type paypal.com yourself, or use the app. Real notifications will be waiting for you inside the account. A security key, which refuses to sign for lookalike domains, is the only structural fix — see passkeys vs 2FA.
Frequently asked questions
Can I use Google Authenticator with PayPal?
Yes. PayPal supports standard TOTP, so any authenticator app works.
What if I lose my phone?
Use your saved backup information, or PayPal’s account recovery, which involves identity verification. Expect it to take time — financial services are deliberately cautious. See recovering accounts after losing a 2FA phone.
Can I remove my phone number entirely?
It varies by region and account type. Where PayPal insists on keeping one, add a carrier port-out PIN to protect it.
Does 2FA protect my linked bank account?
It protects access to PayPal, which is the route to those funds. It does not protect your bank account directly — secure that separately with its own 2FA.
Why won’t PayPal accept my code?
Usually clock drift on your phone. Enable automatic network time. Other causes are listed in why 2FA codes get rejected.
Is PayPal’s 2FA available everywhere?
Availability of specific methods varies by country and account type. If you do not see the authenticator option, check whether your account is fully verified.
The bottom line
Get PayPal off SMS, onto an authenticator app, and add a security key if you keep a balance or run a business account. Then adopt the one habit that beats every setting: never reach PayPal through a link someone sent you.
2 Responses