The payments won’t still go through - if you look at the links, PayPal is returning a big red error message to customers. It doesn’t look like PayPal is doing any kind of review, they are just blocking all transactions with Tardigrade in the associated text anywhere.

Tried this with my german paypal account. Several 1cent payments were flagged, reviewed and then accepted. One 2€ payment was reviewed, flagged and hold back until I describe the details of this transaction.

How do you think a review process works? It's not instant. When you try to process the payment, the OFAC check fails, and it's flagged for manual review. Only option is to show the user an error

As a retailer who has been stung by this bullshit with PayPal many times in the past, I can tell you with absolute certainty that the payment doesn't go through ever, at all.

It isn't flagged and reviewed, it's just outright rejected with a cryptic error message indicating that someone, somewhere breached PayPal's terms of service. No money leaves the customer's account, no money arrives in the vendor's account; the process simply fails.

What is “manual review” here? The reviewer doesn’t have the ability to send the transaction through. It went to the circular file.

I hope an arms dealer names themself eBay Arms. I’m against arms dealers and PayPal and this would destroy PayPal.

FYI Paypal's been spun off from eBay since 2015 and its agreement to serve as eBay's default payment processor was set to expire this year.

Really! That is extremely interesting news. I’ll let the sentiment stand, but if you find an HN post about that or submit one, please link it here.

eBay is in the process of migrating sellers to use eBay's internal payment processing (beta users last years, others gradually - my eBay stored moved to it in July)

https://pages.ebay.com/seller-center/service-and-payments/ma...

Or PayPal Arms. Inception!

>This is more or less legally required for any company that moves money in the United States of America. You will probably find the same issues with the same terms on any other banking for financial body.

No you won't because names are not unique. Banks and credit unions tend to have sophisticated data analysis, unlike the knuckleheads at PayPal.

When I heard about this nonsense years ago, I put some of the banned words in the memo area of checks and transferred money between two credit union accounts. They went through. I did the same thing using electronic transfers between accounts. Again, they went through without any problem.

https://imgur.com/a/RnpRm

A person put the words "James Kang" in a donation to the Red Cross that stated he was testing these banned words and PayPal, in their infinite stupidity, froze the transaction.

It's very annoying. I worked at a shop that sold cigars online. No actual cubans, but brands that used the name cuba in it. Inadvertently every time it would get flagged.

This seems like poor branding on the part of the cigar brands (at least for online sales).

When Castro took over the owners of the brands fled and took the rights to the brands with them. At the same time the Cuban government kept making the cigars under the same name. So for every major brand you will find 2 in the world, one Cuban, one not.

Bacardi (Puerto Rico) has started copying the Cuban Havana Club rum as well.

[1]: https://www.washingtonpost.com/business/havana-club-v-havana...

Well there's legal arguments to be had here about ip.

One of the Bacardi family was locked up / exiled during the first Cuban revolution ironically.

And the non-Cuban ones are laughably awful. The unexpected benefit of the embargo is it forced them to maintain a super premium product. They've had some anecdotal quality issues since Castro died, but being shielded from US markets and globalization made for better products in that case.

I am not sure what you are talking about but some of the best cigars in the world are not Cuban. Just look at CA top 25 list over the last 10 years. The H. Upmann (non Cuban) 175th Anniversary is an amazing stick. Cuban cigars have a unique flavor profile and can be amazing but they have not evolved at all. Also they have had some major quality issues. If I go into any store in London to by a box I am allowed to inspect each stick and build a box of good quality ones from a set of boxes. To be fair, the quality issues have gotten better in the last few years.

If I'm buying Cuban singles, I get it cut in the shop at the counter and check the draw to see if it's plugged. There are great non-Cubans, just not the fake brand ones, imo. The Avo Domaine is one of my all time favourites, and any Ashton maduro is my go-to when I'm stateside. I haven't had a Davidoff that I remembered well enough to get another of, and for that price, it should have been more memorable. It's a very individual thing. Given how recklessly dangerous it is to smoke anything at all, I keep it to a few high end ones as an occasional treat, as if I'm going to be giving myself cancer, it had better be the fancy cancer.

Is "I Can't Believe It's Not Butter!" a bad brand for margarine? Imagine it getting flagged by the butter police.

The difference is that there are no butter police, while there are in fact Cuban embargo police that will cause much greater difficulties in selling anything with the word "Cuban" in it.

So, no, "I Can't Believe It's Not Butter!" is not a bad brand for margarine, but saying "Cuban" something in a cigar which causes all manner of embargo difficulties is bad branding.

Well, they have managed to generate a class-action lawsuit, although it's more over the zero-calorie claim:

https://dev.theclassactionguide.com/News/3029/I_Can%E2%80%99...

>Technically, these aren't being blocked. They're being audited. The payments will still go through.

They buyers are literally getting a message saying "This transaction cannot be completed because it violates the PayPal User Agreement" [0]

[0] https://twitter.com/ArchieMcPhee/status/1304437732584771584

So the answer is this will never be fixed? Just a big RegExp essentially, is the path to avoid $250k per fines? A Persian friend was craving his mother’s cooking, so we went to a restaurant which he Venmo’d me for and we got a stupid flag because his note said “Iranian”. That’s borderline culturally inappropriate considering these companies have a long history of all our other good-standing transactions, they already have massive data from third-parties they purchase from about our offline identities, they have our geolocations whether we like it or not. There is a vast asymmetry of information between these companies and the public they service. They have the advantage, so why not apply that advantage to not flag a small-charge restaurant outing in one of the country’s most well educated neighborhoods, and use something more sophisticated than a silly-string dictionary lookup to determine when to flag.

OK, but so what? 'Be on the lookout for XYZ' is an understandable request, but what prevents paypal rapidly distinguishing between credible and suspicious transactions - and more importantly, pre-emptively communicating with users about it, since they are going to find out the hard way?

Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.)

The basic problem here is that the burden of enforcement is being shifted by Paypal to innocent people with no warning, instead of being shouldered by the company, which is in a position to push back legally on unreasonable requests and plan ahead for reasonable ones.

> Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.)

This literally happened at HSBC. Employees entered transactions in exactly the way you're imagining.

(I didn't find a written source, but this is covered in Netflix's "Dirty Money", episode "Cartel Bank")

Just to be clear, OFAC does not give a list of “banned strings”. It provides a list if individuals and entities that it is illegal to transact with. By which I mean, it’s the entity that matters, not just the raw string.

It’s up to the payment processor to have a process that ensures they don’t send payments to a blocked entity.

You can search for them here: https://home.treasury.gov/policy-issues/office-of-foreign-as... and see the listing for the company in this notice: https://home.treasury.gov/policy-issues/financial-sanctions/...

Note that the standard practice for handling an OFAC hit (e.g. payment to O Bin Laden) is to disambiguate your payee from the blocked individual/entity. This can be easy or difficult depending on how much info you have on the payee; if you have an address and nationality already that don’t match the sanctioned entity then you’re generally ok; typically you would collect a photo of the payee’s ID and run a manual check if there was any doubt.

These “enhanced due diligence” processes can be quite time consuming in aggregate, and I’m not surprised that PayPal isn’t running a detailed EDD process on transactions that will probably net it a few cents of fees.

Having said that, given the structure of their business (online checkout) I’m surprised that they are considering the product (eg “tardigrade”) as being relevant; they have account info on both the payor and payee so they know the payment isn’t going to the sanctioned Cypress company from the OFAC list. This isn’t a Venmo payment that says “pass this payment on to Tardigrade Inc”, which you would want to block.

This seems like either a bug in their screening code or some very risk-averse logic (maybe to do with low-value transactions).

In all software I've seen dealing with these issues (ofac, aml, Dow Jones listings, etc) the flagging should result in manual verification but you're able to configure risk allowances. They almost all certainly allow some bad transactions through accepting the potential risk/cost of actually hiring huge teams of manual auditors. Just being flagged does not always lead to audits.

And the strings from this list have to be matched indiscriminately against everything? Names of account holders, text in the reference field of a transaction (if such a thing exists in the US), whatever?

I’ve had an order of “Aleppo pepper” blocked from a small online retailer because it contained the word “Aleppo”.

https://en.wikipedia.org/wiki/Aleppo_pepper

Yep. I bought a used copy of Yakuza 0 online once and foolishly included the name of the game in the notes of the transaction. PayPal blocked the transfer of funds for over a week.

I haven't read the actual guidelines / rules / etc put out by OFAC in over a year but that was the gist of it from the legal team.

Yes, all text in a message scanned, matches made are for manual review. In the world of financial compliance false positives are in the majority. No company can afford to skip a true match for the sake of scalability based on current audit practices.

In finance, compliance is taken very seriously. Better to block 1000 transactions than miss 1.