How strong are PayPal's cybersecurity and threat-intelligence defenses on the public record?
PayPal's public record shows a documented security program and three incidents since 2022 that began with code changes PayPal itself shipped. Its fiscal 2025 Form 10-K, filed February 3, 2026, says its Information Security Program is guided by the NIST Cybersecurity Framework and ISO standards including ISO 27001, monitors threats 24/7 through the PayPal Cyber Defense Center and uses threat intelligence from governmental, public or private sources; the board's Risk and Compliance Committee receives quarterly reports from the Chief Information Security Officer, and an October 2025 PayPal release names Shaun Khalfan as CISO. In December 2022 attackers used credential stuffing to reach Form 1099-K data on 34,942 customers, The Register reported. New York DFS fined PayPal $2 million in January 2025, finding the 1099-K change went live without a risk assessment, penetration test or vulnerability scan and that multifactor authentication was optional; PayPal now requires MFA for all U.S. customer account logins, the consent order says. In August 2025 a coding error in a system update disrupted service in Germany, with fraudulent transaction activity for a limited time, per the 10-K, and in February 2026 PayPal notified about 100 customers that a coding error in its Working Capital loan application had exposed their data from July 1 to December 13, 2025. On the defensive side, PayPal reported 70% lower account-takeover rates with passkeys than with passwords. None of its 40 current reports filed from November 2023 to October 27, 2026 lists Item 1.05, the SEC's item for material cybersecurity incidents, and PayPal discloses no security headcount or budget.[1][2][3][4][5][6][7][8][9]
Data as of Nov 3, 2026 · PayPal profile updated Oct 22, 2026 · 17 sources cited on this page · 56 fintechs profiled on this site · Markdown
What does PayPal disclose about its cybersecurity program and defenses?
From PayPal's filings and releases. Item 1C of the 10-K is the SEC-required description of cybersecurity risk management and governance.
| Item | What it says | Who | Date |
|---|---|---|---|
| Security framework | The Information Security Program is guided by the NIST Cybersecurity Framework and ISO standards (including ISO 27001), proprietary controls and industry best practices, and is built on a three lines of defense model integrated into the Enterprise Risk and Compliance Management Program; Internal Audit reports its assessments to the board's Risk and Compliance Committee | PayPal, FY2025 Form 10-K, Item 1C | February 3, 2026[1] |
| Board oversight | The board delegated oversight of cybersecurity and other information technology risks to its Risk and Compliance Committee, which receives quarterly reports from the CISO; the board receives briefings at least annually from management on the program | PayPal, FY2025 Form 10-K, Item 1C | February 3, 2026[1] |
| Chief Information Security Officer | The 10-K says the CISO approves all security policies and has over two decades of experience, including as a CISO at PayPal and four other organizations; PayPal's October 2025 phishing alert quotes Shaun Khalfan as PayPal Chief Information Security Officer | PayPal | October 15, 2025; February 3, 2026[1][2] |
| Monitoring and threat intelligence | 24/7 monitoring and measurement of cybersecurity threats through the PayPal Cyber Defense Center; security teams draw on threat intelligence and other information obtained from governmental, public or private sources, including external consultants, and on alerts and reports from security tools | PayPal, FY2025 Form 10-K, Item 1C | February 3, 2026[1] |
| Third-party risk | A third-party risk management framework with due diligence over vendors' information security at onboarding and periodically through the relationship; standard contractual terms require third parties to notify PayPal of a cybersecurity incident | PayPal, FY2025 Form 10-K, Item 1C | February 3, 2026[1] |
| Threats named | AI-enabled threats, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes; PayPal says it has experienced breaches involving customer information for which it notified regulators, customers and other third parties, and the Q3 2026 10-Q says it expects to continue to experience cybersecurity and data privacy incidents | PayPal, FY2025 Form 10-K and Q3 2026 Form 10-Q | February 3, 2026; October 27, 2026[1][10] |
| Material incident filings | None of the 40 Form 8-K current reports PayPal filed from November 1, 2023 to October 27, 2026 lists Item 1.05, the 8-K item the SEC adopted in July 2023 for any cybersecurity incident a company determines to be material | SEC EDGAR | Retrieved November 3, 2026[8][9] |
| Passkeys | Rakan Khalid, Senior Director, Identity Product, said account-takeover rates for transactions authenticated with a passkey are 70% less than with passwords and login success is 10%+ higher, and that PayPal planned to accelerate passkey availability in 2025 | PayPal | January 23, 2025[7] |
| Scam alerts | Dynamic scam alerts on PayPal and Venmo Friends and Family payments run on continually learning AI models that analyze billions of data points; live in all global markets in which PayPal operates and across the U.S. on Venmo | PayPal | July 21, 2025[11] |
| Phishing guidance | During National Cybersecurity Awareness Month PayPal warned of phishing scams that impersonate well-known brands, said authentic PayPal and Venmo emails show a checkmark next to the logo in the inbox view, and asked customers to forward phishing emails to phishing@paypal.com | PayPal; CISO Shaun Khalfan | October 15, 2025[2] |
Which security incidents and regulatory actions are on PayPal's record?
| Event | What happened | Outcome | Date |
|---|---|---|---|
| Form 1099-K change | To make Form 1099-Ks available to customers newly eligible under the lower reporting threshold, PayPal changed existing data flows; the engineering team misclassified the change as a "platform migration", so no Risk and Control Identification Process, risk assessment, penetration test or vulnerability scan took place, and the forms went live with names, dates of birth and full Social Security numbers unmasked | Found on December 6, 2022, after a PayPal security analyst saw an online post reading "PP EXPLOIT TO GET SSN" | October 18, 2022[5] |
| Credential-stuffing attack | Threat actors used credential stuffing to reach the unmasked forms; PayPal's customer notice says unauthorized parties used customers' login credentials between December 6 and December 8, 2022, and could view names, addresses, Social Security numbers, individual tax identification numbers and dates of birth; information submitted to Maine's attorney general put the count at 34,942 customers, The Register reported | PayPal added CAPTCHA and rate limiting, which stopped the automated access, masked the exposed data, reset passwords and offered two years of Equifax identity monitoring; it said there was no evidence the credentials were obtained from any PayPal systems | December 6–8, 2022 (notice dated January 18, 2023)[5][12][3] |
| New York DFS consent order | DFS found PayPal violated 23 NYCRR 500.3, 500.10(a) and 500.12(a): it failed to use qualified cybersecurity personnel and adequate training, and multifactor authentication was optional for customer accounts although PayPal's own policy required risk-based authentication; before the incident PayPal did not require MFA or use controls such as CAPTCHA or rate limiting | $2 million civil penalty; DFS acknowledged PayPal's "commendable cooperation" and remediation, and noted PayPal now requires MFA for all United States customer account logins; a PayPal spokesperson said it had self-reported the issue | January 23, 2025[5][4][13] |
| Germany direct-debit disruption | PayPal's 10-K says a coding error in a system update caused a temporary service disruption that primarily impacted a limited number of customers and partners in Germany, with some fraudulent transaction activity for a limited time period; Süddeutsche Zeitung, cited by Reuters and the BBC, said PayPal's filter for fraudulent direct debits was disrupted and German banks blocked more than 10 billion euros of payments | PayPal incurred transaction losses and claims under its protection programs (10-K); BaFin confirmed to Reuters it had been informed; PayPal told German merchants all transactions would be reimbursed under its seller protection program | August 23–24, 2025[1][14][15][16] |
| PayPal Working Capital exposure | A coding error in the PayPal Working Capital loan application exposed business contact information, including names, Social Security numbers, dates of birth, email addresses, phone numbers and business addresses, between July 1, 2025 and December 13, 2025; PayPal spotted the unauthorized activity on December 12, and a few customers saw unauthorized transactions | PayPal rolled back the code change, reset passwords, refunded customers who saw unauthorized transactions, offered two years of credit monitoring and notified about 100 customers in a February 10, 2026 letter; a spokesperson said PayPal's systems were not compromised | July 1–December 13, 2025[6] |
How do PayPal's cybersecurity strengths weigh against the gaps on the record?
Strengths on the record: the 10-K describes a program guided by NIST CSF and ISO 27001, quarterly CISO reports to a board committee, a 24/7 Cyber Defense Center, Internal Audit as an independent third line, and threat intelligence from governmental, public and private sources. Measured results are few but specific: passkey-authenticated transactions had 70% lower account-takeover rates than password logins (January 2025), and the scam alerts launched in July 2025 run on continually learning AI models in every PayPal market. Since the DFS order, PayPal requires MFA for all U.S. customer account logins.[1][7][11][5]
The weak point is change control. Three of the incidents on the record began with changes PayPal itself shipped: DFS found the 2022 Form 1099-K change went live without a risk assessment, penetration test or vulnerability scan; the 10-K attributes the August 2025 Germany disruption to a coding error in a system update; and the 2025 Working Capital exposure came from a code change PayPal later rolled back. Detection lagged in two of them: the 1099-K forms were live from October 18, 2022 until an analyst saw an online post on December 6, and Working Capital data was exposed from July 1, 2025 until PayPal spotted unauthorized activity on December 12.[5][1][6]
Not disclosed: the CISO's reporting line inside management (Item 1C describes reports to the board's Risk and Compliance Committee, not to an executive), security headcount and budget, the size of the Cyber Defense Center, how many incidents PayPal has had or notified, and whether any past incident was material; Item 1C refers readers to the risk factors instead of answering that. No Item 1.05 8-K appears in PayPal's filings from November 2023 to October 27, 2026, and the Q3 2026 10-Q says PayPal expects to continue to experience cybersecurity and data privacy incidents.[1][8][10]
What does the PayPal profile record on this topic?
The rows below are the entries of the PayPal AI strategy profile that bear on this page, as of Oct 22, 2026; the profile holds the full record of 16 dated moves, 10 use cases and 21 sources.
| Use case | What the record shows | Status | Source |
|---|---|---|---|
| AI and ML fraud prevention and risk management | PayPal's 10-K says it uses AI and machine-learning technologies in fraud prevention and risk management across its two-sided network. | In production | [1] |
| Agent ready | Lets existing PayPal merchants accept payments on AI surfaces with fraud detection, buyer protection and dispute resolution; announced for early 2026. | Announced | [17] |
| Date | Move | Detail | Source |
|---|---|---|---|
| Oct 28, 2025 | Agentic commerce services launched | PayPal introduced store sync, to make merchant catalogs discoverable in AI channels such as Perplexity, and agent ready, to let existing merchants accept payments on AI surfaces with fraud detection and buyer protection (planned for early 2026). | [17] |
| Jan 23, 2025 | New York DFS fines PayPal $2 million over cybersecurity | DFS found PayPal failed to use qualified personnel for key cybersecurity functions and lacked controls such as multifactor authentication, CAPTCHA or rate limiting, after cybercriminals used compromised credentials to reach Form 1099-Ks containing Social Security numbers; PayPal has since remediated the issues, DFS said. | [4] |
How strong are PayPal cybersecurity and threat intelligence defenses on the public record?
PayPal describes a NIST CSF and ISO 27001-guided program with a 24/7 Cyber Defense Center, threat intelligence from governmental, public or private sources, and quarterly CISO reports to a board committee. Its record also holds a 2022 credential-stuffing breach, a $2 million New York DFS penalty in January 2025, and coding errors behind two 2025 incidents.
Has PayPal had a data breach?
Yes. In December 2022 attackers used credential stuffing to access PayPal accounts and view data including Social Security numbers; The Register reported 34,942 customers were affected. In February 2026 PayPal notified about 100 customers that a coding error in its Working Capital loan application had exposed personal data between July 1 and December 13, 2025.
Why did New York DFS fine PayPal $2 million?
DFS found that PayPal's Form 1099-K change went live in October 2022 without its required risk review, exposing full Social Security numbers, that the engineering team was not adequately trained, and that multifactor authentication was optional for customer accounts. The consent order of January 23, 2025 set a $2 million penalty and credited PayPal's cooperation.
Does PayPal require multifactor authentication?
For U.S. customers, yes. The January 2025 DFS consent order says PayPal now requires MFA for all United States customer account logins; at the time of the December 2022 incident MFA was optional. PayPal also offers passkeys, which it said in January 2025 had 70% lower account-takeover rates than passwords.
Who oversees cybersecurity at PayPal?
The board delegated cybersecurity oversight to its Risk and Compliance Committee, which receives quarterly reports from the Chief Information Security Officer, according to the fiscal 2025 10-K. PayPal's October 2025 phishing alert names Shaun Khalfan as CISO; the 10-K says the CISO has over two decades of experience.
- PayPal Holdings, Inc. Annual Report (Form 10-K) for fiscal year 2025
- PayPal Alerts Consumers to Phishing Scams and Encourages Safety Tips
- PayPal says crooks accessed 34,942 customers' info
- Superintendent Adrienne A. Harris Secures $2 Million Cybersecurity Settlement with PayPal, Inc.
- NYSDFS Enforcement Actions – January 23, 2025: Consent Order Issued to PayPal, Inc.
- PayPal app code error leaked personal info
- Solving the Convenience and Security Equation
- EDGAR Search Results: PayPal Holdings, Inc. Form 8-K filings (undated page, retrieved 2026-11-03)
- SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies
- PayPal Holdings, Inc. Form 10-Q for the quarter ended September 30, 2026
- Introducing AI-Powered Scam Alerts for Friends and Family Payments
- Notice of Data Breach (PayPal customer letter dated January 18, 2023, filed with the California Attorney General)
- NYDFS penalizes PayPal $2M over 2022 data breach
- German banks halted 10 billion euros in PayPal payments on fraud concerns, says newspaper
- European banks hit by rogue PayPal payments worth 'billions'
- Störungsmeldung: Vorübergehende Beeinträchtigung (undated page, retrieved 2026-11-03)
- PayPal Launches Agentic Commerce Services to Power AI-Driven Shopping
When PayPal moves on AI, you'll read it here first.
when a bank, fintech or regulator moves on AI, it is in the next morning's brief · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning