To give a little behind-the-scenes here, I worked for a bit for a web hosting company that had this as standard policy. This was because, before it was put in place, scammers would actually use coordinated campaigns of support calls with otherwise legitimate accounts in order to extract piecemeal details about how the company's fraud investigations worked, then reorganize their scamming to precisely evade the time periods and credit card checks used at the time.
> The hackers explained that they were able to breach the banks’ sub-par security by using an algorithm to generate account numbers and then posing as customers who had forgotten their passwords.
“They were giving too much permission to half-authenticated account which enabled us to grab all these information,” the email said, adding that the system “was not checking if a password was valid until the security question were input correctly.”
Source: https://www.ccn.com/hackers-demand-1-million-in-xrp-after-br...
It may be possible that PP thought someone else was using your account.
What should happen in these scenarios is simply a validation of some kind ie payment only goes through if you click on the email your received.
I used to travel to SF from Canada a lot and my bank would block my Visa even though I told them not to.
In the US there's no password in Visas, i.e. no chip-and-pin, which is totally crazy = huge fraud.
It's funny to think in the Silicon Valley, top tech companies in the world ... everyone is still using that old mag stripe stuff when pretty much the rest of the world has moved on.
To be clear, this is chip (and sometimes signature for large purchases) but not chip-and-pin, so the original statement of no passwords generally holds true, but the mag stripes are generally not used anymore.
It's the other way around. If you try the chip 3+ times, and it doesn't work, you can swipe the card, and the swipe transaction will work.
When the more secure method fails, it falls back to the less secure one. It's lunacy.
Since a relatively small number of complaints ruins the parent companies perception of how well the individual store is doing as far as customer service the store level doesn't want anything to inconvenience their customers especially since literally 99.9999% of swipes are from legit customers not thieves.
The chips also don’t seem to last as long as the magstripes for some reason (which makes zero sense when you think about it). I’ve had to get my card replaced 3x in the space of two years.
After PayPal refusing to help. I resolved it by opening a new PayPal account. Adding my credit card (not flagged suspicious) and transfer $2 to the account. Then I could delink the bank account and close it. Then I closed the new account I opened.
I donno. This is PayPal Australia, maybe they operate differently. I couldn’t even figure out how my account got into a negative balance to begin with.
Unfortunately I don’t have any of the old emails otherwise I would upload it.
I've had them be annoying to me before. My favorite PP fact I found out the hard way: never put the string 'aleph' in the note field. Apparently that's flagged as a Terror-Word(tm), and it held up a transaction of mine for over a month.
I still use them, but only under modified-casino rules: never play with money you can't lose. Have a separate bank account just for them, so they can't get up to shenanigans with more than you intend; never depend on them for anything time sensitive; and never send money anyone depends on for anything important.
I started accepting donations from a community gaming website via PayPal and I was very hesitant about using it due to the bad stories I've heard. A couple of months and a couple of hundreds of dollars later, no problems yet.
The biggest 'problem' I've had with PayPal is moving to a new country. You can't add International cards to your account, and you can't change the country of your PayPal account. The only solution for me was to create a new account, which is fine I guess.
But then I guess you never have a bad experience until you do.
I wrote about it here: https://www.cogini.com/blog/paypal-know-your-customer-failur...
How is that not a bad experience for a buyer who never got an item he paid for?
The buyer kept emailing me after it, 'updating' me on the situation, which I mostly ignored. I believe he was in some smaller town and he knew the postman and had a very strong suspicion that he stole it, or something like that.
No postal system is without risk; that’s why they offer package insurance, registered post, etc.
Every real merchant who deals with the public at scale accepts this and refunds in such cases. Presumably they eat the cost or THEY purchase insurance for the shipping and roll this into the cost so they don't have to tell customers I'm spending YOUR money on drugs and hookers and don't care if you actually got anything for it.
Such interactions absolutely destroy relationships with customers and the customers bank is likely to issue a charge back to protect their relationship with their customers.
In my personal life on the other hand, I'm regularly prompted at checkout to decide between registered post with insurance, or regular post without. If I opted out of insurance, I wouldn't blame the seller for the package not arriving or any damage (presuming of course that it was packaged appropriately), and I'd fully expect Paypal to resolve in their favour after verifying that the package was actually sent.
It's true that this would ruin the customer relationship which is why some businesses may offer to make things right anyway, but I personally wouldn't expect it.
That said, the consumer protection laws in my country (Australia) are fairly strong so I may well be entitled to redress; this is just my personal attitude.
As far as alternatives, customers seem to love PayPal, because they side with buyers effectively 100% of the time in any disputes. So even if there were a convenient PayPal clone (which there isn't, at least in the US), you still wouldn't match the conversion rate that PayPal has, as many people will only use PayPal.
So, you can either accept a lower conversion rate by going with something like Stripe (because users don't want to enter their CC information directly on small merchant sites), or you can accept PayPal and be essentially guaranteed that at some point your account will be closed and you'll be screwed out of a significant amount of revenue. Currently, these are the bad choices that merchants face.
I've won disputes on PayPal as a seller.
Companies have been using PayPal for over a decade without their accounts being closed.
You're talking nonsense.
There are exceptions to every rule, but in the vast majority of cases, they side with buyers. I once had someone that admitted in email that they were trying to extort me into refunding them. PayPal actually wrote back saying they were going to go to bat for me with the card issuer after I showed them these emails, but the card issuer didn't budge. I have no idea if PayPal sent the card issuer the emails, I just know that I wound up being out the money.
So you aren't just fighting with PayPal, you're fighting with card issuers as well. PayPal will side with buyers in most cases, and in the few instances where it is obvious that the merchant is correct and PayPal tries to do the right thing, then the card issuer will pick it up and screw the merchant from their side of it.
Regardless of who does the screwing, the merchant is the one that suffers in the end by accepting PayPal.
Companies have been using PayPal for over a decade without their accounts being closed.
Very large companies have nothing to worry about from PayPal, but small merchants have a very high percentage chance of being screwed by them. See http://www.paypalsucks.com/
Now suppose it turns out I have misrepresented the items I sell. When your item arrives, you find that my site was pretty much fraud. You try to contact me to demand a refund...but no one answers the phone or responds to email. That's because I took all the money from you and the rest of the people I deceived and moved far away, to someplace safe from extradition to the US and that won't enforce US civil judgments.
So you call up your credit card company, tell them what happened, and they quickly refund your money. As do the credit card companies of all the other people I took advantage of.
Where does the credit card company get the money for all those refunds? They aren't going to get it from me. They certainly have no interest in eating those losses themselves.
What they do is require a business that accepts credit cards to have an account at a "merchant bank". When someone pays that business by credit card, the credit card company does not pay the business directly. They pay the merchant bank, which pays the business.
In order to be allowed to do this, the merchant bank has to enter into a contract with the credit card company that says that the merchant bank will pay the credit card company for all refunds and chargebacks. The merchant bank will try to get the refund money from the business, but if they fail they have to make up the difference.
The way merchant banks do this is they hold back some of the money they receive from the credit card company for the business, to build up a buffer to cover refunds and chargebacks. As the business establishes a track record and the merchant bank becomes more confident in its estimates of the refund/chargeback risk for the business, they will adjust the amount they hold in reserve.
I don't know exactly how it works when a buyer uses a credit card to pay PayPal, but somewhere between the credit card company and the seller there is an entity taking the role of the merchant bank and guaranteeing that the credit card company won't be left holding the bag if the seller can't cover refunds/chargebacks.
I suspect that the entity is PayPal itself, and most of the incidents you hear about of them holding some seller's money is them increasing the reserve because there was some change in his selling pattern that suggested the current reserve was no longer in line with their estimates of his refund/chargeback risk.
I think people don't switch to alternatives because the alternatives, at least the ones that provide strong consumer protection, almost all have the same or similar mechanisms to try to make sure that if the seller is bad it is the seller who pays.
They could switch to alternatives that do pay the seller directly with no mechanism for a refund other than asking the seller, such as most cryptocurrencies, but then they would probably lose a lot of buyers unless they were very well established businesses with outstanding reputations. (But if that were the case, then they probably could accept credit cards without their merchant bank requiring a large reserve).
Presumably someday cryptocurrencies will be able to fill the PayPal niche, but that requires a more robust buyer-merchant ecosystem than exists at present.
As a buyer, I don't care for that feature of Bitcoin.
Why will this be any cheaper, or safer, or fairer with Bitcoin? All the incentives in this business align with the buyer. 90% of the time, I have a choice between many equivalent merchants, all of whom want my business. I will go with the one that supports my cash-back credit card - whose issuer will almost always side with me in a dispute.
Once these escrow services become popular in the crypto world, you're back to square one. The reasons for why PayPal sucks for some of its users have nothing to do with fiat money, and everything to do with the nature of the escrow business. It would be just as shitty for said users if it transacted in Bitcoin, Dogecoin, or silver bullion.
The mediator can decide against your case just like Paypal or Visa can. Even worse, now I have to find some random mediator the seller trusts.
How is that better than plain bank transactions or paypal? The fees are not even cheaper for that "privilege" of having some random mediator play paypal-on-the-blockchain.
This is what I received from Paypal:
To ensure that activity and transactions comply with current regulations, PayPal is requesting that you provide the following information via email to [email protected]
1. Purpose of payment XXXXXXXXXXXX attempted on 29 May 2016 in the amount of 53.00 AUD, including a complete and detailed explanation of the goods or services you intended to purchase. Please also explain the transaction message: "Cuba and postage to 4113. <my address>."
They obviously have a block on the word "Cuba" and there was some back and forth to let the transaction through.
Weapons of Math Destruction was one of the most eye opening books I read recently. It's all about how Machines when set up with self-reinforcing models can become a real big problem.
And how the fact nobody quite understands how The Machine makes decisions isn't helping either.
My solution would be to not rely too much on these systems, but at the very least, at least include escape hatches and big red emergency buttons. Engineers do, why can't hackers do this?
That can be difficult if security features rely on humans not being able to subvert the process, I think. But for other processes, this should be the default!
Once we let the machines make the decisions, and rely on them to do a "better job" there will be cases like this where it's just cheaper and easier to just follow the program and explain what happened.
Actually we are building a zoo for ourselves where humans will make no decisions at all about anything of consequence!
https://en.wikipedia.org/wiki/United_Express_Flight_3411_inc...
The metrics* gathered on us were pretty meaningless, and didn't meet the cardinal rule of being actionable, but we still had to go over them each and every week. And some of the actual work was producing reports on productivity for other parts of the company in different places.
*Despite the fact we were programmers and every person in the department had a different role, we were scored based on tickets done and tickets that failed qa.
Of course, they could provide no information about why this happened or how to avoid it. I became a lot more conservative about using Paypal again, and never did make another request for a debit card.
I've been using it for at least 10 years at that point.
What I did was try to pay for some cheap VPS hosting in Italy. The transaction was denied. I thought there was some problem with my CC, so I immediately tried to do a $1 transaction with some other company and it went without a hitch.
So I contacted PayPal support about it and the next day I actually get a phone call from one of their support staff.
He says my transaction was flagged as "suspicious" by the fraud prevention system. So I asked, okay... but now a Human has looked at it, can you manually approve the transaction? The answer was "No, I am not allowed to tell you why".
I was incredulous, so I asked "Wait... you acknowledge that I'm not a scammer or a terrorist (since my PP account still worked and does to this day), and the party I'm trying to purchase from is obviously not either since they're still accepting PP, but The Machine thinks there is something fishy about us two specifically and there is no way for someone to manually approve this transaction?"
And he said something to the tune of "Yes. I'm sorry, but there is nothing I or anyone at PP can do about it, and for security reasons we're unable to offer further details."
So yeah. This was just a minor nuisance for me, I purchased similar services elsewhere. But the whole thing was a real eye-opener. That was the day I realized that there is no pleading or reasoning with The Machine.