PayPal can access your bank account only for the specific transactions you authorize, and only after you give it explicit permission to do so.
When you link a bank account to PayPal, you are giving PayPal permission to pull money from that account for transactions you initiate—sending money, paying for purchases, or funding your PayPal balance. PayPal cannot access your account to see your balance, history, or other details beyond what is necessary to process the transaction you requested. PayPal also cannot withdraw money without your instruction, change your account settings, or access funds for any purpose you did not approve.
The connection works through a find authorization process. PayPal receives limited access credentials—not your full login or password—that allow it to move money in the direction you specify. Think of it like handing a cashier a check: they can cash it, but they cannot open your checkbook and take more.
Key Takeaways
- PayPal can only withdraw money from your bank account when you initiate a transaction, such as sending a payment or funding your PayPal balance.
- You control which bank account PayPal can access by linking and unlinking accounts in your settings at any time.
- PayPal cannot see your full bank balance, transaction history, or other account details—only what is needed to process your requested transfer.
- If you suspect unauthorized access, contact your bank when ready and remove the PayPal authorization from your bank's app or website.
- Fraudsters can use a stolen PayPal account to drain a linked bank account, which is why a strong PayPal password and two-factor authentication matter.
How the bank connection actually works
When you link a bank account to PayPal, you go through a verification process. PayPal deposits two small amounts (usually under $1 each) into your account, and you confirm the exact amounts in your PayPal settings. This proves you own the account. After that, PayPal has what is called ACH (Automated Clearing House) authorization—permission to initiate transfers between your bank and PayPal.
This authorization is one-way in the direction you choose. If you set up the account to fund PayPal transfers, PayPal can pull money out when you request it. If you set it up to receive money, PayPal can push deposits in. PayPal does not get a key to your entire account—it gets permission to move money in one specific direction for one specific purpose.
Your bank also has safeguards. Banks can see which third parties have authorization to access your account. You can revoke PayPal's access at any time through your bank's website or app, usually under a section called "Connected Apps," "Authorized Services," or "Third-Party Access." Revoking it stops PayPal from being able to pull or push money, even if your PayPal account is still active.
What happens if your PayPal account is compromised
If someone gains access to your PayPal account—through a weak password, phishing, or a data breach—they can use your linked bank account to send money out of PayPal or to fund transfers. They cannot see your bank balance or history, but they can drain the account by moving money to themselves or to other PayPal accounts they control.
This is why the security of your PayPal password matters as much as the security of your bank password. A compromised PayPal account is a direct line to your bank account. The attacker does not need your bank login; they only need your PayPal login.
If you discover unauthorized PayPal transactions, contact your bank first. Your bank can reverse ACH transfers within a window (usually 60 days, depending on your bank), and they can block PayPal from making further withdrawals. Then change your PayPal password, enable two-factor authentication if you have not already, and review your PayPal transaction history for other suspicious activity.
Protecting your bank account from PayPal-related fraud
Use a strong, unique password for PayPal—one you do not use anywhere else. If PayPal is breached or if you reuse passwords across sites, attackers can log in and use your linked bank account. A password manager can generate and store a long, random password so you do not have to remember it.
Turn on two-factor authentication in your PayPal account settings. This means that even if someone has your password, they cannot log in without a code from your phone or email. PayPal offers authentication through an app, SMS, or email—app-based is most find because SMS can be intercepted.
Review your linked bank accounts regularly. Go to your PayPal wallet settings and check which accounts are connected. If you see one you do not recognize or no longer use, unlink it. Also check your bank's third-party access settings to see what apps and services have authorization. Remove anything you do not actively use.
Monitor your bank account for small, unauthorized charges. Fraudsters sometimes test a stolen account with a small transaction before attempting a large one. Catching it early gives you more time to act and more options for recovery.
Can PayPal see information beyond what you authorize?
No. PayPal receives only the data necessary to process the transaction you request. When you send money from your bank account through PayPal, PayPal learns your account number and routing number (because it needs them to initiate the transfer), but it does not receive your login credentials, your full transaction history, or your account balance.
PayPal also does not have ongoing access to your account. Each time you initiate a transaction, PayPal requests permission from your bank, your bank processes it, and the connection closes. PayPal cannot log in to your bank account on its own or pull information whenever it wants.
Your bank may share some information with PayPal for fraud prevention purposes—for example, flagging a transaction as suspicious—but this is limited and governed by your bank's privacy policy and federal regulations like the Gramm-Leach-Bliley Act.
Removing PayPal access to your bank account
You can disconnect your bank account from PayPal in two places, and doing both is the safest approach.
In PayPal, go to your Wallet or Settings, find the linked bank account, and select "Unlink" or "Remove." This tells PayPal it no longer has permission to use that account. However, this only removes the connection from PayPal's side.
In your bank's app or website, find the section for connected apps or authorized services (the name varies by bank). Look for PayPal in the list and revoke its access. This tells your bank to stop honoring PayPal's requests. Doing both ensures that even if your PayPal account is compromised, the attacker cannot use your bank account.
If you are closing your PayPal account entirely, unlinking all bank accounts first is a good practice. It reduces the window of time during which a compromised account could be used against your bank.
What to do if you suspect unauthorized access
Contact your bank when ready. Tell them you suspect unauthorized ACH transfers from your account. Your bank can freeze the account, reverse recent transfers, and block PayPal from making further withdrawals. Do not wait for a statement to arrive; call the number on the back of your card or log into your bank's app.
Change your PayPal password from a different device (not the one that may be compromised). Use a strong, unique password. Then enable two-factor authentication if you have not already.
Review your PayPal transaction history and your bank statements for the past 60 days. Look for transfers you did not authorize. Report each one to both PayPal and your bank. PayPal has a Resolution Center where you can open a dispute for unauthorized transactions.
File a report with the Federal Trade Commission at reportfraud.ftc.gov if the fraud involves identity theft or if the amount is significant. The FTC does not recover money, but it creates a record that can help you dispute fraudulent accounts opened in your name.
Frequently Asked Questions
Can PayPal see my bank balance?
No. PayPal receives only the account number and routing number needed to move money. It cannot see your balance, recent transactions, or account details. Your bank does not share that information with PayPal unless you explicitly authorize it through a separate service.
What if I unlink my bank account but PayPal keeps trying to charge it?
Contact your bank and revoke PayPal's access through your bank's app or website. This stops your bank from honoring PayPal's requests. If charges continue after you have revoked access, contact your bank to dispute them and ask about blocking ACH transfers from PayPal entirely.
Is it safer to use a debit card or a bank account with PayPal?
A debit card offers slightly more protection because your bank can dispute the charge and reverse it. A bank account connection is direct and faster, but if compromised, an attacker can drain it more quickly. Either way, two-factor authentication on your PayPal account is your best defense.
Can PayPal freeze my bank account?
No. PayPal can only move money out of your account if you authorize it. PayPal cannot freeze your account, lock it, or prevent you from accessing it. If your PayPal account is limited or closed, that does not affect your bank account.
What if someone opens a PayPal account using my bank account without my permission?
Contact PayPal when ready and report the account as fraudulent. Then contact your bank and revoke PayPal's access. File a report with the FTC. Your bank can reverse any unauthorized transfers, usually within 60 days. This is identity theft, and you may want to place a fraud alert on your credit report as well.