Venmo and PayPal takeovers · FloridaYour Venmo or PayPal login was stolen and your bank account went with it. Two sets of federal duties apply.

Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney

Short answer: If a thief logged into your Venmo or PayPal account and sent your money, the payments are unauthorized transfers under Regulation E, and PayPal, Inc. must investigate them on the federal timeline. Every dollar the app pulled from your linked bank account is also an unauthorized transfer from that account, so your bank must investigate those debits too.

What happens when a Venmo or PayPal login is stolen?

A stolen login turns the app into the thief's wallet. Once inside, the thief sends your balance to accounts they control, then uses the app's funding feature to draw on the bank account or debit card you linked, sometimes in a burst of payments over an hour, sometimes in smaller amounts spread across days so the alerts blend in.

The login gets stolen through a phishing page that mimics the sign-in screen, a reused password exposed in a breach, a caller posing as the app's fraud team who asks for a verification code, or a SIM swap that routes the codes to the thief. In the app's records, every one of those looks like you.

Then come the two denials. The app reports that the activity was authorized, often noting a recognized login or recipients added from inside the account. Your bank, seeing debits initiated by Venmo or PayPal, tells you the app is the place to dispute them. Each points at the other, and neither answer is the law.

Who runs Venmo and PayPal, how do I report fraud, and what do the agreements say?

Venmo is a service of PayPal, Inc., the wholly owned operating subsidiary of PayPal Holdings, Inc. PayPal, Inc. is a state-licensed money transmitter (NMLS ID 910457), not a bank; its agreements say "PayPal is not a bank, does not take deposits and is not FDIC insured." A Venmo dispute and a PayPal dispute both end up with the same company.

Your balance is not a bank deposit. Unless you have a PayPal Debit Card, Direct Deposit, or a crypto account on PayPal, or a Venmo Debit Card, Direct Deposit, the cash-a-check feature, or crypto on Venmo, the balance is, in PayPal's own words, an "unsecured claim against PayPal" that is "not eligible for FDIC pass-through insurance."

What matters more here: PayPal and Venmo publish the Consumer Financial Protection Bureau's prepaid-account disclosures for their balances, and both agreements set out the federal Regulation E error-resolution timeline, with reports due within 60 days of the first statement showing the error, a decision within 10 business days or a provisional credit within 10 business days when the investigation runs up to 45 days, and up to 90 days for new accounts or point-of-sale transactions. Regulation E's definition of "account" includes prepaid accounts, meaning an account that can be loaded with funds and is used mainly to pay unaffiliated merchants or send money to other people and that is not a checking account. On that footing the federal rules apply to unauthorized transfers from a PayPal or Venmo balance.

Reporting channels. For PayPal: call (888) 221-1161, use the Resolution Center ("Report a problem," then "I want to report unauthorized activity"), or write to PayPal's Error Resolution Department in Omaha; PayPal says you will receive an email within 10 days. For Venmo: call 855-812-4430, use the Help Center, or write to the mailing address in the Venmo agreement. For a Venmo Debit Card, Venmo says to lock the card in the app and, if you cannot use the app, call 855-204-4090. The Venmo Debit Card is issued by The Bancorp Bank, N.A., a national bank supervised by the Office of the Comptroller of the Currency (OCC).

The arbitration terms. Both the PayPal User Agreement (last updated September 14, 2026) and the Venmo User Agreement (effective August 24, 2026) require binding individual arbitration administered by JAMS, waive class actions and jury trials, and allow you to opt out only by mailing a signed notice to PayPal's Litigation Department in San Jose, postmarked within 30 days after you first accept the agreement. There is no online, email, or phone opt-out. Small claims court remains available for individual claims.

That clause is a hurdle to plan around, not a reason to give up. It moves the dispute from a courtroom to an arbitrator and takes class actions off the table, but the arbitrator applies the same Regulation E rules, and the regulation itself says an agreement cannot increase your liability for unauthorized transfers beyond what the rule allows. The clause binds you and PayPal; it says nothing about your separate claim against your bank.

McMillan Law PLLC is not affiliated with Venmo or PayPal and does not represent it. Venmo or PayPal is named here because people search for help with its decisions.

Does my bank owe me anything when the app drained my linked account?

Yes. When Venmo or PayPal pulled money from your linked checking account at a thief's command, each debit was an electronic fund transfer from your bank account that you did not initiate or benefit from. That is an unauthorized transfer from the bank's side too, and the bank owes you its own Regulation E investigation, provisional credit, and written answer.

The Electronic Fund Transfer Act (EFTA) covers online and app-initiated transfers from a consumer's bank account, and Regulation E's definition of an unauthorized transfer looks at who initiated it, not at which company's system carried it. A debit that Venmo or PayPal requested from your checking account on a thief's instruction was initiated by the thief, and "dispute it with the app" is not one of the answers the regulation allows.

Report both legs, to both companies, and keep the dates separate. The app investigates the payments sent from the app; the bank investigates the debits that left the bank account. The bank's deadlines run from your report to the bank, not from your report to the app.

What does Regulation E require of the app and the bank after I report?

Each institution must investigate and decide within 10 business days, or credit your account provisionally within that time and finish within 45 days. Each must report its result within 3 business days, explain any denial in writing, hand over the documents it relied on when you ask, and prove the transfers were authorized. Neither may demand a police report first.

The definition comes first. An unauthorized electronic fund transfer is one initiated by a person other than you, without actual authority, from which you receive no benefit (12 C.F.R. § 1005.2(m)). The official commentary adds that transfers made by a person who obtained your access device through fraud or robbery are unauthorized (comment 2(m)-3). "Access device" means a card, code, or other means of access, which includes your app login and a one-time passcode. A phished password or a code read to an impostor is an access device obtained through fraud. Your own carelessness, like reusing a password, cannot be used to increase your liability (comment 6(b)-2).

The exclusion that matters: a payment you sent yourself because someone lied to you is generally not unauthorized, because you initiated it.

Your share of the loss when a login or card was stolen. Reported within 2 business days after you learn of the theft, your liability is capped at $50, or at the amount taken before notice if that is smaller (§ 1005.6(b)(1)). Reported later, the cap can reach $500, but only for transfers the institution proves a prompt report would have prevented (§ 1005.6(b)(2)). If a transfer shows on a statement and you wait more than 60 days after it was sent, you can be responsible for transfers made after those 60 days and before your report that a timely report would have stopped (§ 1005.6(b)(3)). The first unauthorized transfers have no reporting deadline at all; what limits them in practice is the one-year period to sue.

Prepaid-account timing for the app balance. Where a prepaid account does not send periodic statements, the regulation runs the 60-day window from when you electronically access your account history showing the transfer, or from when the company sends you a written history, and lets the company use a 120-day window instead (§ 1005.18(e)(1), (2)). If you never completed the app's identity verification, the liability limits and error-resolution rules may not apply to the app balance until you do (§ 1005.18(e)(3)). That exception does not reach the debits from your bank account, which stay protected through your bank.

The investigation rules are the same for the app and the bank (§ 1005.11). "Provisional credit" is a temporary refund you can spend while the review continues. An institution may ask you to confirm a phone report in writing within 10 business days and may withhold provisional credit if the writing never comes, but it cannot pause the investigation while it waits. It may not require a police report, a notarized affidavit, a branch visit, or a call to the recipient, and may not charge a fee. If it finds an error, it must fix it within 1 business day. If it finds none, it must explain in writing and tell you about your right to the documents it relied on, then provide them promptly (§ 1005.11(d)). And when your liability is disputed, the statute puts the burden on the institution to prove the transfer was authorized or that the conditions for consumer liability were met (15 U.S.C. § 1693g(b)).

Why do Venmo and PayPal claims get denied?

Denials in takeover cases, in my experience with denial letters generally, rest on records that show a recognized device, a successful password, a passed two-step check, or recipients added from within the account. Those entries record what the thief did with your credentials. They do not show that you did it, and the law asks only who initiated each payment.

The reasons repeat:

• "The customer completed two-factor authentication." The customer's phone received the code; the thief obtained it. Who typed the code decides the case, not whether the code worked.
• "Payments were sent to contacts the customer added." If the thief added them while logged in, the contact list is evidence of the takeover, not against you.
• "This is a transaction with a third-party app; contact them." The bank's version. A debit from your checking account is a transfer from your bank account whoever requested it, and the bank's duty to investigate does not depend on the app's cooperation.
• "The customer sent the payment." If you did, under instruction from a scammer, this reason can hold up under federal law. If the thief did, it cannot, and the login records will usually show which.

What are my options as a Florida Venmo or PayPal user?

Florida has no state electronic-transfer law, so the federal EFTA is the main tool against both the app and the bank. The claim against PayPal, Inc. may belong in JAMS arbitration under the agreements above; the claim against your bank depends on its account agreement. Florida federal courts have applied the EFTA's investigation rules to banks and credit unions.

I have one office, in Tampa, and represent people with these claims across Florida; a takeover case is built from screenshots, statements, and letters, so the review happens by phone, email, and video wherever you are in the state.

In Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022), the court found the institution had not reasonably investigated a disputed debit or carried its burden of proving the transaction was authorized. In Katz v. JPMorgan Chase (S.D. Fla. 2015), the court held that a claim over a mishandled error report accrues when the institution's deadline passed, not when the money moved.

Florida's Deceptive and Unfair Trade Practices Act exempts banks, credit unions, and savings associations but not other finance companies (Fla. Stat. § 501.212). So that statute is usually unavailable against your bank, and whether it adds anything against a money transmitter like PayPal, Inc. depends on the facts; a Florida federal court has held that a licensing violation alone cannot support that claim. Courts also require a concrete injury, and losing the use of your money, even temporarily, generally qualifies.

What is a hacked Venmo or PayPal claim worth?

If the app or your bank violated the EFTA, you can seek your actual damages, meaning the money taken and related losses, plus statutory damages of $100 to $1,000, plus reasonable attorney's fees and costs. When an institution skipped provisional credit and did not investigate in good faith, the law allows up to three times your actual damages.

The statutory figure is set by the court, which weighs how often and how persistently the institution failed to comply, the nature of the failure, and whether it was intentional (15 U.S.C. § 1693m(a), (b)). Fee shifting is what makes a $900 takeover worth pursuing.

The treble provision has two triggers (§ 1693f(e)). First, the institution did not provisionally recredit your account within the 10-business-day period and either did not investigate in good faith or had no reasonable basis to believe there was no error. Second, it knowingly and willfully found no error when the evidence could not reasonably support that finding. The multiplier applies to your actual damages, the money you lost, not to the $100 to $1,000 statutory range.

Defenses apply on both sides: a bona fide error made despite reasonable procedures, and fees against a consumer who sues in bad faith or to harass. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.

What deadlines apply after a Venmo or PayPal takeover?

Report the stolen login within 2 business days of learning of it to hold your share at $50. Report each unauthorized payment to the app, and each bank debit to your bank, within 60 days of the statement or history showing it. Mail any arbitration opt-out within 30 days of accepting the agreement. Bring any EFTA claim within one year.

The one-year period runs from the violation (15 U.S.C. § 1693m(g)). For a mishandled report, that is the institution's failure, so the South Florida court in Katz counted from when the 10-business-day deadline passed. Because you may have reported to the app and the bank on different days, you may have two different one-year clocks. I treat the date of the first unauthorized payment as the safe deadline for both.

If a hospital stay, extended travel, or a similar extenuating circumstance delayed your report, the regulation requires the reporting periods to be extended to a reasonable time (12 C.F.R. § 1005.6(b)(4)).

What should I do today?

• Take the account back. Reset your Venmo or PayPal password and your email password, sign out all other devices, and remove any phone number or email the thief added.
• Report every app payment through the channels above and say "unauthorized" for each one. Confirm a phone report in writing within 10 business days and keep proof of the date.
• Report every bank debit to your bank as an unauthorized transfer from your account, in writing to its error-resolution address, and log the date. Do not accept "contact the app" as an answer.
• If either institution has already denied you, request in writing every document it relied on, and note when you asked.
• Gather the documents: both denials; screenshots of each payment with date, amount, and recipient; login, new-device, and password-change alerts; the phishing message or call log entry; bank statements showing each debit the app initiated; your app account history; and a police report if you filed one (helpful, never required).
• Ignore "recovery" offers. Anyone offering to retrieve the money for a fee is usually part of the same operation.
• Send it to me. Request a free case review and attach both denials and your statements. I'll tell you which transfers federal law covers, which institution owes what, and how I would proceed.

Sources: EFTA, 15 U.S.C. § 1693a(7) and (12), § 1693f(e), § 1693g(b), and § 1693m; Regulation E, 12 C.F.R. § 1005.2(b) and (m), § 1005.3(b), § 1005.6(b), § 1005.11, and § 1005.18(e), and official interpretations 2(m)-3, 6(b)-2, 11(b)(1)-2, 11(c)-2, and 11(c)-3; CFPB, Electronic Fund Transfers FAQs (page last modified January 2025; checked October 8, 2026); PayPal User Agreement and PayPal Balance Terms and Conditions (both last updated September 14, 2026); Venmo User Agreement (effective August 24, 2026); Venmo Long Form Disclosure; PayPal help article on reporting unauthorized transactions; Venmo help articles on unauthorized charges to an account and to the Venmo Debit Card; PayPal Holdings, Inc. Form 10-K for fiscal year 2025; FDIC BankFind record for The Bancorp Bank, N.A.; Katz v. JPMorgan Chase (S.D. Fla. Feb. 10, 2015), reported at 2015 WL 11251764; Monroe v. Grow Financial Federal Credit Union (M.D. Fla. Dec. 5, 2022), reported at 2022 WL 17417034; Cross v. Point & Pay (M.D. Fla. 2017), reported at 274 F. Supp. 3d 1289; Fla. Stat. § 501.212. Last reviewed October 8, 2026.