Texts and calls

The PayPal Friends and Family scam, and why the money is almost gone

Updated 6 October 2026

You agreed to the small thing. The button said Friends and Family, the person on the other end said it was the only way, and the amount felt small enough to be safe. That is the costly assumption, because the toggle you tapped is the reason PayPal will not refund you, your bank will not refund you, and the person you sent the money to can withdraw it in seconds. The scam is not the lie they told you about a deposit, a sick relative, a sick dog, a found wallet, or a missing parcel. The scam is the button.

What the Friends and Family button is, and why it exists

PayPal runs two rails. Goods and Services is the commercial rail: it charges the seller a fee, it offers you Purchase Protection, and it lets PayPal hold the money while a dispute is open. Friends and Family is the personal rail. It is meant to send your sister rent for last weekend, to split a dinner, or to pay a school friend back. There is no fee, no protection, no holding period, and no chargeback right built into the contract. The instant the transfer lands, the recipient can tap Withdraw, the funds hit their bank, and the only person with a copy of the receipt is you.

That is the entire product. A scammer is not hacking anything technical when they push you to that button. They are walking you to the one door in the building without a lock, and asking you to open it yourself.

The four stories that end at the same button

By October 2026, the Friends and Family push travels in four stock outfits.

First, the rental deposit. A landlord or roommate on Facebook Marketplace, Craigslist, or Zillow insists the holding deposit must go by Friends and Family to skip the fee, often with a sob line about a child in hospital. The keys never arrive. Second, the online sale that pretends to be a sale. A buyer pays you Friends and Family for an iPhone, a used car deposit, a puppy, or a concert ticket, then disputes it at their own bank days later, or simply never collects. You have already shipped the item, and the money has already gone. Third, the romance tail. After weeks of chats on WhatsApp, Instagram, or a dating app, the new partner needs help with a medical bill, a flight, a customs charge, or a stranded courier. The button is framed as a trust test. Fourth, the fake refund or prize. A "PayPal agent" calls about a hacked account and tells you to send a small amount to yourself, or to a verification account, to release a larger payment. You are not sending it to yourself.

Strip the costume and the action is identical. Someone you have only met through a screen is steering the payment towards the rail with no lock on the door.

Why your bank will not save you this time

If you paid a stranger by debit card through Goods and Services, your bank can reverse the payment. If you paid by credit card, the Consumer Credit Act in the UK and the Fair Credit Billing Act in the US give you a direct route through your card issuer. The moment the payment is Friends and Family, that lever is gone. You did not pay a merchant. You personally transferred money to a named account, with a memo that the bank recorded as personal. The bank treated it as a transfer, not a purchase, and most transfers settle in minutes and are not reversible once they are sent.

You can still call the bank, open a fraud case, and ask. You should. But go in knowing the answer, because the script your bank's fraud team will read back to you is the same script every other victim heard. They will tell you to contact PayPal. PayPal will tell you to contact your bank. That is the dead ground this scam is built on.

The two paths for actual recovery, ranked

Path one is PayPal's Buyer Complaint, opened inside the Resolution Centre. PayPal will tell you, in writing, that Friends and Family is not covered by Purchase Protection. They are right, under their own rules. What they will sometimes do is hold the recipient account, freeze the balance, and refund the sender if the money is still there. This works when the scammer is sloppy, when they have left funds in the PayPal wallet, or when the same account is being used across many reports. It will not work if the money was withdrawn inside an hour, which is the common case.

Path two is a bank recall, also called a trace. A recall is a formal request from your bank to PayPal, then from PayPal to the recipient bank, asking the funds to be returned. It is not a chargeback, and the recipient bank can refuse. But a recall filed within twenty four hours, with a police report reference attached, has a non trivial chance of catching the money before it is spent. The longer you wait, the more this drops to near zero.

The one move you make in the first hour

Screenshot everything. The chat thread. The profile. The phone number. The PayPal transaction ID. The bank account the money was sent to if PayPal lets you see it. The email, the username, the listing URL, the search history you used to find them. Save it twice, in two places, because once a platform removes an account you may not get another look at it.

The legal hooks that still apply

Friends and Family does not put a fraud outside the law. It just means PayPal's own consumer rules are not on your side. The Unfair Trading Act 2014 in Northern Ireland and the Consumer Protection from Unfair Trading Regulations 2008 in the rest of the UK make misleading commercial practices a civil offence, even when the button is labelled personal. In the US, the FTC Act Section 5 covers unfair or deceptive acts, and most states add their own computer crime, wire fraud, and theft statutes. Sending you to a button that you were told would unlock a refund, a release, a prize, or a rental is misrepresentation in the legal sense, not a personal payment in the consumer sense.

That is why the police report matters. A report turns the case from a transfer into a criminal matter, which is the language banks and platforms respond to. Without a report, the platform will treat it as a private dispute between two people who both said the word personal. With a report, the platform is talking to a suspect's account that is linked to a recorded crime.

What to do about the messages, the account, and the listing

Report the profile. On Facebook, Marketplace, Instagram, and TikTok, the in app Report menu has a category for scams and for fake accounts, and the in app Report button is the only report that counts toward a platform takedown. Email the long version, with the screenshot bundle, to the platform's abuse address. On X, the in app report is enough, but you can also email safety@x.com if you have a verified loss.

If the money did come from a credit card

Even on a Friends and Family transfer, some card networks will let the issuer open a chargeback if the underlying transaction is fraudulent. American Express has the strongest record here, with a process that treats misrepresentation as fraud regardless of the rail. Visa and Mastercard depend on the bank's posture. The bank will look for a police report, a clear misrepresentation, and a pattern. If you paid by credit card, the bank can also pull a chargeback in parallel with the PayPal case, and you should ask them to do so.

If the money came from a debit card, you can ask the bank to invoke Regulation E in the US or the Banking Conduct of Business rules in the UK, which require a refund for unauthorised transactions. Friends and Family is not unauthorised in the technical sense, because you tapped the button, so this is a harder fight. It is still worth the phone call, because a good fraud analyst can route the case into a network level recovery that you cannot trigger from the app.

If you paid through Zelle, Cash App, or a bank transfer

Friends and Family on PayPal is the most common version, but the same rail logic applies to other apps. Zelle and Cash App were designed for people who already trust each other, and their refund process is thin. The bank's standard line is that authorised payments are not refundable. Like PayPal, the only reliable lever is a bank recall with a police report, opened within hours.

If you sent money directly from your bank to a stranger's account, the same recall process applies, with the same drop off in success over time. UK readers can also ask their bank to apply the Authorised Push Payment voluntary code, which makes a refund likely if the receiving bank has signed up and the case meets the criteria. US readers can ask whether their bank has signed the Consumer Financial Protection Bureau's October 2024 reimbursement expectation, which by October 2026 is the working standard for many large banks.

How to spot the next push before you tap

Any stranger who tells you to use Friends and Family is a stranger who is telling you the refund will not happen. The rule is the same for any personal rail. If the person is not a real person in your real life, the rail is not for them. The exception that proves the rule is the seller who agrees to pay your fee for using Goods and Services. The fee is a price, not a tax, and the seller paying it is the legitimate way to trade with a stranger on PayPal.

You can also switch the default. In the PayPal app, go to Settings, then to Payments, and turn off the Friends and Family default for non contacts. That is not a guarantee, but it puts friction back on the dangerous button, and friction is the friend of people who are in a hurry, and the enemy of people who are in a hurry to take your money.

What to expect from the next ten days

The first twenty four hours matter most. If a bank recall, a PayPal case, and a police report are all opened in that window, the chance of partial recovery is real. After three days, the chance drops sharply. After a week, the money is almost certainly gone, the platform account has been emptied, the profile has been renamed, and the scammer is onto the next person with the same script.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.