At least going by your retelling, I'll say PayPal was right to refuse reversal.

Mindlessly clicking through OK buttons is end-user negligence, not fraud. Your brother presumably had multiple opportunities to notice something was not okay before completely signing off on it. It's tantamount to signing a contract without so much as even glancing through the terms, then turning around saying you never meant to sign it.

Fraud protection does not absolve someone from being a responsible adult.

Some arbitrary policy they happen to have about personal transfers doesn't absolve them of the responsibility of policing their platform to ensure it's not being utilized by scammers, and shutting them down when they find them, or when they are EXPLICITLY REPORTED TO THEM. That's what I was referring to when I said they're a joke about addressing fraud. The website is still up, it still directs you to the same form to send money to the same exact account. I highly doubt my brother was the first person to call them and complain about this person, but their account is still active and apparently in good standing. What a fucking joke. It would take them literally 5 minutes of investigation to go to the website, see how it presents itself as a retail store, and to go through the checkout process that eventually leads to a page for a personal transfer, which is clearly not correct, and no goods are ever delivered, and clearly it's entirely meant to fraudulently separate non-savvy buyers from their money. But they clearly have zero interest in doing any of that, since they still get to collect their percentage on every transaction sent to him, they couldn't care less.

This seems like textbook fraud to me. It doesn't matter if there are hints here and there, if the "merchant" is directing you through a flow that will direct funds somewhere other than you intend (or other than they claim), it's fraud.

See: https://www.law.cornell.edu/uscode/text/18/1341

Fraud detection is difficult when there's no uniformity in experience.

PayPal's "redirect the user through our services" flows provide more uniformity than some random site with a hosted-- or even baked-into-the-shopping-cart-- credit card form-- but I wouldn't say it's uniform enough that people would be able to reliably identify something outside the norm.

Just think of currency-- could you spot a decent quality counterfeit? Particularly if you're dealing with a more edge-case design that you don't encounter every day (say, a Series 1934 $50 note)?

TBF, is there any way to do fraud protection on personal transfers ? Imagine you sent 100 bucks to your cousin and 10 min later requested your bank to get your money back because you sent it to the wrong cousin.

I hate to say this, but there will always be loopholes as long as scamming js lucrative enough.

>TBF, is there any way to do fraud protection on personal transfers ? Imagine you sent 100 bucks to your cousin and 10 min later requested your bank to get your money back because you sent it to the wrong cousin.

When it's easily verifiable that actual fraud has taken place I would say yes. It would've taken them literally 5 minutes of their time to investigate by going to the website, seeing it presents itself as a retail furniture store, and to go through the checkout process and seeing that it ends up at a form for a personal transfer, and that no goods ever end up being delivered, all of which clearly indicate the transaction is 100% intended to be fraudulent by the supposed seller.

Playing PayPal'd advocate, that's a lot similar to home made "give me money to finish this personal project" and you're expecting a faceless service to go spend 5 min on one of the hundreds of thousands of claims they receive every day. Including of course the ones where you actually sent the money to your friend who already spent it out of PayPal, and PayPal has to front the money for your chargeback.

Fraud management is hard. Most actors in the domain are also jerks, but that's orthogonal to it being hard I think.