Some arbitrary policy they happen to have about personal transfers doesn't absolve them of the responsibility of policing their platform to ensure it's not being utilized by scammers, and shutting them down when they find them, or when they are EXPLICITLY REPORTED TO THEM. That's what I was referring to when I said they're a joke about addressing fraud. The website is still up, it still directs you to the same form to send money to the same exact account. I highly doubt my brother was the first person to call them and complain about this person, but their account is still active and apparently in good standing. What a fucking joke. It would take them literally 5 minutes of investigation to go to the website, see how it presents itself as a retail store, and to go through the checkout process that eventually leads to a page for a personal transfer, which is clearly not correct, and no goods are ever delivered, and clearly it's entirely meant to fraudulently separate non-savvy buyers from their money. But they clearly have zero interest in doing any of that, since they still get to collect their percentage on every transaction sent to him, they couldn't care less.

This seems like textbook fraud to me. It doesn't matter if there are hints here and there, if the "merchant" is directing you through a flow that will direct funds somewhere other than you intend (or other than they claim), it's fraud.

See: https://www.law.cornell.edu/uscode/text/18/1341

Fraud detection is difficult when there's no uniformity in experience.

PayPal's "redirect the user through our services" flows provide more uniformity than some random site with a hosted-- or even baked-into-the-shopping-cart-- credit card form-- but I wouldn't say it's uniform enough that people would be able to reliably identify something outside the norm.

Just think of currency-- could you spot a decent quality counterfeit? Particularly if you're dealing with a more edge-case design that you don't encounter every day (say, a Series 1934 $50 note)?