1) Have a written statement of the criteria for freezing funds, demanding a 100% reserve, etc.. Make the criteria concrete and objective enough that business owners can reliably predict whether this will happen to them.
2) Notify account holders of this policy in a very conspicuous way. Burying it in the TOS isn't good enough for something like this.
It's fine if PayPal wants to be strict about business models it deems high-risk. But they should do a much better job of managing customers' expectations. Right now, it seems that most customers find out about PayPal's draconian risk management practices by unexpectedly losing their cash flow or by hearing from someone else who did. That's unacceptable.
They could perhaps identify the general risk categories (i.e have a list of businesses-type which are considered high-risk). Most merchant account providers maintain such a list and you can easily find examples by googling, but I'm guessing most people who run businesses in high-fraud industries are already aware of that fact.
The short is that PayPal just doesn't care about small users. If they did, these problems would be solved.
What Paypal is however is a mass-market product aimed at low-risk transactions. They don't care about dealing with special case high-risk transactions, that's a fundamentally different business model which they don't want to go after.
It's perfectly reasonable for Paypal to decide their own business model.
If you never trust businesses that appear to be legitimate, no matter how long they maintain this appearance, eventually all your legitimate (and highly profitable) business customers will leave. That risk should be weighed against the fraud risk.
That's a fraction of the £11,000+ that they would have been on the hook for if it turns out the event had been a fake and they'd allowed the account holder to withdraw the money.
You're making the assumption that fraudsters are stupid, they're not. Fraudsters regularly try to build (or perhaps more commonly steal) accounts with reputation before using them for fraud, you can weight account history in your risk evaluation and they may well have done so in this case, but you can't let that overly influence your risk judgement as otherwise fraudsters will exploit that.
(Unless you're arguing that Paypal should be more lenient and just accept the high fraud rate as a cost of business (presumably passing it on their customers in the form of higher commissions) - in which case I agree that's a feasible route they could take, but I assume Paypal have done the analysis and figured the numbers just don't work).
Your point about PayPal's risk vs. their profit on this account is valid, but look at it from the other side. Let's take a more plausible scenario than one in which the account was opened for fraudulent purposes from the beginning. Let's imagine our business owner has had every intention of running a legitimate business and has been doing so, but as a result of personal misfortune is now in a state of desperation. Would it really make sense to torpedo a running business in order to get a final payout of maybe £50,000, and put oneself very much on the wrong side of the law in the process? For £500,000, I could see this, but I don't think many people, even those desperate or venal enough to ignore the ethical difficulties, would do it for an amount comparable to a year's revenue from a business they've worked for years to build.
Or conversely, if there really are fraudsters with the patience to run a legitimate business for six years in order to run a large scam, surely they would also be shooting for a payout well into six figures if not seven.
I think PayPal has made the considered decision that it's not worth their time to think about individual cases. That's their right, though they certainly are inviting competition.
Remember to take into account (pun intended) hacked reputable accounts.
The same could be said for just about every other business that fails.
And I don't believe that is reasonable to freeze transactions of business based solely on some sort of suspicion of guilt, then after it has been resolved that they are indeed innocent, continue to hold their money for months after the fact.
The horror stories of paypay have been floating around for some years, this story is nothing new.
Paypal didn't think they were fraudsters when they suspended their account, they thought they were high-risk. They unsuspended the account when the event organizer agreed to some risk mitigation measures (allowing Paypal to hold the money for the length of the creditcard chargeback period to let Paypal protect themselves).
If something goes wrong they don't say "Sorry, we believe there may be a problem so we had to suspend your account. Not to worry, just send us X or call us on this number.", but rather something along the lines of: "You're a fraudster, we disabled your account, go figure out yourself how to fix it. Here's a few unhelpful pointers."
They managed to beat the competition because of their superior fraud detection ability. Because of their succes, they now have no incentive to work on customer service.
The web allows for some unprecedented powerful corporations to come into existence and most of them (Google, Apple, Paypal, Facebook, Amazon, etc) have already abused that power on several occasions, particularly regarding small business. Get used to it...
I had assumed it was something like the "Your account has been limited emails" which point you to their resolution centre and tell you to phone them if you have any problems.
Imagine if you're a fraudster, you've knocked up a fake event and you've sold $10k-$20k in tickets, you could withdraw the money and disappear before the date of the event. Now Paypal are on the hook for the money, when they get creditcard charge-backs it comes out of Paypal's account and not the fraudsters.
Does anyone consider it reasonable that Paypal take this risk ? - the reason for the 90 day limit is that's the length of time most consumers have to request a credit card chargeback. Paypal is simply protecting themselves.
If you're engaged in high-risk transactions you're much better off going with a specialist provider (i.e Amiando or Eventbrite in this case) as they have risk fraud models designed to handle the specific risk factors.