How to Enable Two-Factor Authentication on PayPal

Why Enable 2FA on PayPal?

PayPal is one of the most targeted accounts for hackers because it provides direct access to money. Stolen PayPal credentials are sold on dark web markets every day. A compromised account can result in unauthorized payments, drained balances, or fraudulent purchases — often before the real owner even notices. Since PayPal transactions are often irreversible, recovering stolen funds after an account takeover can be difficult or impossible.

PayPal's 2-step verification (their name for two-factor authentication) means that even if someone steals your email and password, they still can't log in without the second factor — a code sent to your phone or generated by your authenticator app. For financial accounts in particular, 2FA is one of the most effective ways to prevent credential theft from escalating into real financial loss.

Beyond protecting your balance, PayPal 2FA also secures linked bank accounts, credit cards, and your personal information stored in your profile. A hacked PayPal account doesn't just lose its own balance — attackers can also use saved payment methods to make purchases elsewhere if you have features like One Touch enabled.

Before You Start

A few things to know before enabling PayPal 2FA:

• PayPal 2FA setup must be done through a web browser — it cannot be set up inside the PayPal mobile app.
• You'll need either a mobile phone (for SMS) or an authenticator app already installed.
• You can only have one active 2FA method at a time on PayPal — either SMS or an authenticator app, not both simultaneously.

PayPal 2FA Options

PayPal offers several ways to enable two-factor authentication. Each method has different trade-offs between convenience and security. Here's how they compare:

• Authenticator App (TOTP) — Generates 6-digit codes offline using a time-based algorithm. Recommended because codes can't be intercepted by SIM-swap attacks. Works with apps like Google Authenticator, Microsoft Authenticator, and Authy. See our top authenticator app picks.
• SMS (Text Message) — A 6-digit code is texted to your phone each time you log in. Widely compatible but vulnerable to SIM-swap attacks and carrier outages.
• Security Key — A physical hardware key that plugs into your device via USB or NFC. Considered the most secure option but requires purchasing a separate device. Hardware key vs authenticator app — which is better?

For most users, an authenticator app offers the best balance of security and convenience. Below we cover how to set up both SMS and authenticator app methods.

Enable PayPal 2FA via SMS

Enable PayPal 2FA via Authenticator App

Using an authenticator app is more secure than SMS — codes are generated offline and can't be intercepted by SIM-swap attacks. PayPal supports any standard TOTP app including Google Authenticator, Microsoft Authenticator, and Authy.

Signing In with 2FA Active

Once 2-step verification is enabled, here's what happens each time you sign in to PayPal from a new or unrecognized device:

1. Enter your email and password as usual.
2. PayPal sends you a code via SMS, or you open your authenticator app for the code.
3. Enter the 6-digit code on the PayPal verification screen.
4. You're signed in. PayPal may give you the option to trust this device to skip 2FA in future.

How to Turn Off PayPal 2FA

If you need to disable 2-step verification, go to Settings → Security and click Turn Off next to 2-step verification. Click the Turn It Off button to confirm.

Troubleshooting PayPal 2FA

Not receiving SMS codes

If PayPal isn't sending SMS codes, first check that your phone number is correct in Security settings. Make sure your phone has cellular signal and can receive texts from short codes (5-6 digit numbers). If you're traveling internationally, some carriers block short-code SMS from abroad — in that case, switch to an authenticator app instead.

Authenticator app code isn't working

TOTP codes expire every 30 seconds. Make sure you're entering the code before it refreshes. If codes consistently fail, check that your device's time is set correctly (TOTP relies on accurate time sync). On both iOS and Android, enable automatic time zone and date/time settings for proper code generation.

Locked out of your account

If you can't log in because you lost access to your 2FA method, click the "Having trouble?" or "Try another way" link on the PayPal login screen. PayPal may offer account recovery options such as verifying your email or answering security questions. If those don't work, you'll need to contact PayPal support and complete identity verification — have a government ID ready.

2FA keeps asking on the same device

After logging in successfully, PayPal gives you the option to "Trust this device" so you won't be prompted for 2FA again on that browser. If you're seeing the 2FA prompt every time, you may have declined the trust prompt, or cookies may be cleared regularly by your browser settings.

Frequently Asked Questions