If you have to give PayPal banking information make sure it's a separate bank from your "main" one - it should be easy enough to get a free online bank account you can use as an intermediary.

didnt know companies can just take money from your account. broken bankings system

The only two things you need to take money out of an account are the routing number and account number.

There are a lot of checks on top of that which individual banks may or may not implement or care about, but at the end of the day those two numbers get you 99% of the way there. And for an organization the size of PayPal they're really going to be given the benefit of the doubt by banks.

So why aren’t criminals doing this to drain accounts all the time? They traffic in stolen credit cards, why not banking info?

I think that was why Donald Knuth stopped issuing checks for rewards for people finding errors in his books -- people would post images of the checks online to brag about having received them, and then criminals would initiate fraudulent ACH transfers.

Also not sure why that's not more common in comparison to credit card fraud.

Edit: I guess credit card fraud can be easier to cash out (for physical goods or services), while ACH fraud requires mules to act as intermediaries to receive the fraudulent deposits, which might be harder to come by and sustain.

I'm sure they do, but it might be less common because it takes more effort to launder than credit cards.

There's millions of retailers that accept credit info in exchange for goods and services.

You can't use ACH to buy Wal-Mart gift cards.

They certainly try. But it's not like there are no protections in place.

The US banking system can be summarized as "withdraw first, ask questions later." The whole system is based around auditing after the fact. If at the end of the day (or week, or month), the numbers don't balance out, a flag is raised, and someone investigates it. And in many cases, there is a waiting period before you can access funds transferred.

Outside the US, people find this whole thing crazy, but that's how it is and it actually works well enough. My understanding is that banks are moving to a more modern system, but it's a slow process given how much is built around the current system.

they do 100%. back in June i got charged $30,000 by a fake "home depot". I disputed the charge, but that wasn't fun. the cs reps told me it was not through a debit card but via acct+routing number which got leaked somehow.

Because you have to transfer it to another bank, and the banks are actually quite good at tracking and reversing it.

But it does happen; google "check cashing scam" to find how they mule it out.

In Australia they technically need a direct debit authority, but PayPal is above the law in Australia so our dispute process is through our local bank. It works, but it's very tedious and the bank will try to push you towards the PayPal dispute process. It's much better not to link it to a bank account at all, use a credit card because that way it's two US corps fighting with each other when there's a problem.

must be some US thing, because this is literally crazy to think about to allow withdrawal without authorization

might also be a reason why US banks always seem nosy as fuck, calling people about transactions, blocking stuff, etc. instead of just giving the account owner a safe way to perform transfers/authorizations/set limits

I'm not sure how folks regard privacy.com (the domain is a little... lofty?) but I use that to present my bank to PayPal as if it was a credit card. I change charge limits on the fly to be just a bit more than I need.

Revolut offers free (disposable) virtual debit cards and isn't limited to just the US.

(No affiliation; I'm just a happy customer.)

Revolut seems less trustworthy that PayPal. And there appears to be a lot less protection for you as their customer.

> Revolut seems less trustworthy that PayPal

Why?

> And there appears to be a lot less protection for you as their customer.

They have EU banking licenses (depending on where you are a different one applies to you), but they are a regular bank with all the protections that includes for a customer - if they go bankrupt, your money is guaranteed up to a certain extent; they can't just close your account and keep the money like PayPal do, etc. etc..

They may have the licenses, but do they actually do business under them? They did not in the past. So it always looked just like a fun ploy to gain some credibility.

> They may have the licenses, but do they actually do business under them? They did not in the past

What do you mean? They provide banking services, they cannot do that without a banking license to do it under. They used to only have one, in Lithuania, and use it for all operations, but now they have a bunch more and the most appropriate applies (e.g. I'm in France, and I'm under the French one).

Companies can provide money services without a banking license. A lot of companies do.

When I duckduck the question, even revolut has this in their FAQ: https://megous.com/dl/tmp/bbebf0d88acb54d8.png

It's possible to have a license and not use it.

Wise offers free virtual cards as well.

Isn’t Revolut just for Europeans?

Not exclusively European countries, but also not the whole Europe: https://www.revolut.com/change-country/

I was able to get my hands on one of their cards, but it was useless to me as I couldn't actually put any money on it from my unsupported country.

Ah but it is available in USA…I didn’t know that!

they closed their Canadian operations a couple of years ago. good riddance.

Tried them once.

- Basically none of the banking functions were available outside the app

- The app itself was buggy. There was some sort of "vault" or whatever they called it that had attractive interest rates (the reason I signed up), and after wasting hours of my life over a few weeks with customer support I decided it would never work

- Unlike any other bank-like service I've used, you can't just get mailed a check and close the account. Neat idea maybe, but at the time the app was buggy and wouldn't let you withdraw fully if you had anything in savings because of some sort of minimum balance nonsense

- You can't use the app if they think your phone isn't sufficiently secure. This is more on Apple/Google for caving to that bullshit, but IMO an app with its own security model shouldn't have any clue how you access your phone

- Deposits were capped to like $10 for the first day, $100 for the second, and so on. I don't remember the exact schedule, but it meant that instead of just depositing an old 401k I had to design over a period of time a series of increasingly large deposits of some other money (just like a fraudster would do? ELI5, what are they actually preventing?) just to be able to throw a check into the account

- Deposits to and withdrawals from Revolut took an obscene number of days, nobody on either side of the transaction could tell where the money was (magically available in neither account), and the transactions were 10x longer when I was trying to leave

And on and on. Like, I'm sure they're fine on average, and they're probably better than when I tried last time, but I haven't had a worse banking experience yet anywhere by a longshot. The basics for an online bank are logging in, depositing money, and withdrawing money, and neither the basics nor the fancy features they sold me on were very functional.

Happy to hear the virtual debit cards work for you :)

I've been using their app for years, it's pretty helpful. I really wish they used a different name, though.

I got halfway through the "Privacy.com" sign up process and discovered they wanted my online banking username and password to access funds, with some ridiculous alternative like mailing a paper check

Yeah... that's FinTech. I find it soothing to consider how little I trust my bank with those credentials.

At the very least one would expect the bank to be salting and hashing - PrivacyDotCom presumably has to keep the plaintext in some form in order to use them!

As a secondary concern, the bank has occasional 2fa, and definitely does some kind of anomaly detection. Primed by the ickiness of the user/pass request I just had a mental image of some hacky Selenium script on an AWS IP address filling out the login form and getting my online banking disabled proactively.

privacy.com is just like VPNs. It's not private; you're "just" moving the pieces. That's not to say that these things aren't useful, but caveat emptor.

This. They can and will steal money out of your account if your cards don't work.

I knew not to rely on PayPal to not lock my account but I never really thought about them withdrawing incorrect sums from my bank account.

Will be removing my bank account from it right now.

Another reason to remove your bank details is one-time login codes. PayPal is testing a feature that lets users log in using a 6-digit code sent over SMS, bypassing both password and TOTP/hardware authenticator, and the feature can’t be disabled.

I refuse to use SMS as a second factor, so using it as the _only_ factor for what is effectively a bank account is absolutely batshit insane. They’ve completely lost their mind.

https://www.paypal-community.com/t5/Managing-Account/How-do-...

Like google, they badly want your mobile number, for tracking and additional Pii/identity purposes. This is what it boils down to, not security.

I cannot log in without a phone any more to paypal. At all. My mobile phone doesn't even work on my property, I live in a rural area, with no cell phone service for 1km.

I have a phone. Email. I could set up 2fa via the internet.

Nope.

Because of course, cell phones are always reachable?!

> I cannot log in without a phone any more to paypal.

I use TOTP with my account just fine?

I suppose they might have an old account that does not have a phone number attached to it and PayPal won’t let them log in without providing one?

Receiving SMS via the Internet is possible by enabling WiFi Calling. It is a game changer for locations with good wired Internet but poor cell coverage.

Of course it doesn't change the fact that using SMS for security should be illegal.

I have an old-ish paypal account with no phone number attached and while they prompt me every time I have not supplied one. There was a period of a month or two a couple of years ago when I couldn't use paypal at all without providing a phone, but I was quite willing to live without paypal. Mysteriously when I tried to log in a few months later it let me.

> Because of course, cell phones are always reachable?!

I don't get what you're supposed to do when travelling? Incur international texting charges?

People enforcing SMS login/MFA don't care. As someone who's frequently away my home country, I often find it difficult to log into services that are necessary for my survival (like banking), let alone regular apps which more and more frequently are ditching email address signup in favour of mobile numbers (BeReal, Artifact etc).

At _minimum_ I need to swap the physical SIM card in my phone which for some reason breaks iMessage for a few days every time I do it. However roaming doesn't work in every country, so, sometimes I'm just fucked.

eSIM could make the first problem easier, but it actually makes it harder. With a physical SIM, if I lose or break my phone I still have my home SIM so I can still access SMS on a new phone. With eSIM, if I lose or break my phone my home SIM is lost along with it. No problem, just provision a new eSIM, that's the whole point right? Well, one of my telcos doesn't support eSIM yet, but they enforce SMS MFA, so I can see where this is going. I'll only be able to provision a new sim if I have access to the old one. Absolutely braindead. Another of my telcos doesn't allow eSIMs to be provisioned digitally; you need to obtain a physical QR code from a shop or have it posted to an address within the country (they won't send one overseas). It's actually unbelievable how telcos have managed to make eSIMs less convenient than physical SIMs. Anyway, this means I need to return to my home country if I lose or break my phone because without SMS I won't be able to access banking.

This is beyond infuriating, but I'm an edge case so no one cares. It should be illegal for critical services, banking/finance/govt etc to depend on SMS.

Do you get charged for _receiving_ texts when traveling internationally? Maybe it's different here in Europe, but as far as I know, I only get charged for active things - sending texts, making calls, accepting calls. Passive things - receiving texts, getting calls (but not accepting them) - do not incur any charges.

It depends on the telco. I have a telco that requires me to have an active roaming plan to receive SMS/calls. Which is about $5 a day from memory (I don’t use it overseas). Another telco has no requirements and no charge to receive SMS/calls overseas as long as the number is active.

That's weird - PayPal has been doing the opposite to me: Making me do both reCatptcha and hCaptcha in addition to my password and TOTP. Seriously, who the fuck needs not one captcha after valid login information but fucking two.

Thank you for this. I just removed my main bank account with them.

hadn't considered this, thanks

What free online banks would you trust more than (rightfully untrustworthy) Paypal? Adding a free online bank account sounds like a way to add more points of failure.

The main argument for another small bank account to interface with PayPals of this world is not that it cannot fail, but if it does it is an easily survivable event.

Why is it easily survivable any more than Paypal taking money out of your regular bank? If you don't pay it, the bank will come after you.

PayPal cannot take more money out of your account than what is in the account. If you have $500 in an account the bank will not let PayPal withdraw $5000 from it. It's not different from writing a check for $5000, which will just bounce.

The bank is not in the business of allowing overdrafts and then somehow collecting the difference.

  > The bank is not in the business of allowing overdrafts
  > and then somehow collecting the difference.

But one's main bank is? I don't see how the intermediary is any different in that regard?

No bank will honor your check for more money than is in your account. The amount in your account gives a hard stop on the amount you can lose.

Having a separate account with enough for the current Paypal transaction (that you refill from the main bank account as needed, in a few mouse clicks) means you limit your losses from a transaction gone wrong with a major company.

Can a malicious player try pulling money from your main account? Absolutely. But the chances of a large company, like Paypal, hitting you like this on an account not registered with them is zero. And your bank's fraud protection should stop an attempt to pull a large sum from your account by an unknown company in a sketchy country.

The point is to have a bank account with nearly no balance, so PayPal can't drain it, or if they do they don't get much. Then you can transfer cash from PayPal to that account, and then from that account to your real bank.

But if that intermediary bank account has a negative balance, you cannot just ignore it. The bank _will_ come after you for their money. So far what does it protect you?

When PayPal goes to make the withdrawal, the bank doesn't have to let them and give the account a negative balance. Usually you can turn off overdraft and withdrawals will bounce if the funds aren't there.

This doesn't stop PayPal from reversing a previous inbound transfer they decide shouldn't have happened, but it ought to stop PayPal unilaterally deciding they would like some of your money.

So why not turn off overdraft from one's main bank account?

Can US bank accounts get overdrawn? If they can the intermediary doesn’t help it just gives you debt and bank charges.

Oh, boy, can they ever! And the fees can be hefty. Even with a credit union back in the early 2000s, we were talking $10 _per day_, I don't expect it has gotten any cheaper.

Yes, and banks routinely charge $35 for each transaction on an overdrawn account. This is particularly easy to do if multiple people share a bank account with a low balance.

They also sometimes sequence transactions largest to smallest when settling to maximize the number of charges[1].

[1] https://www.forbes.com/sites/halahtouryalai/2013/06/11/yes-b...

The law was changed to forbid this, though that's not to say they don't sometimes still "allow" it to happen.

At least at Wells Fargo, it's simple to set up a second checking account. I use that for all my book-related expenses and (heh, heh) royalties.

Very good advice. Paypal can be convenient, and even necessary, for certain websites that only accept paypal as payment (yes, they exist). I keep $5 in the bank account I have connected to paypal for exactly this reason.

Actually you don't want to use credit cards between yourself and PayPal. They play a finger pointing game that can last months. Been there. I eventually had to small claims the CC company (MBNA Europe, now LLoyds) which took weeks. They didn't contest the claim or even turn up and judgement was made in favour in their absence then they did nothing until bailiffs were appointed then wrote the whole account off and closed it.

If I unlink my bank account, how can I get my money out of PayPal?

link to a not main account and only setup one way transfers from one to the other i.e. You have your main account, and you have your paypal receivables account.

Paypal receivables account has no overdraft protection and not overdraft allowance. If a withdrawl over the value of the account comes in, it is denied.

Connect that account to paypal.

Next, in the Paypal receivables account, setup an external transfer from the receivables account to the main account. You will have to validate the ownership of the second account usually by posting two small transactions that were auto posted to the account as part of the validation process. This takes a couple days. Once that is done, you can transfer money from receivables account to main account but not the other way.

Transfer money out of paypal to the receivables account, transfer money from receivables to main. Use a credit card to spend money with paypal.

You can set up two way transfers if you need to put cash into that account for transactions and you still get a similar level or separation, I just prefer to use a CC instead because they'll help you out if you want to dispute or reverse a transaction and paypal may not.

> Paypal receivables account has no overdraft protection and not overdraft allowance. If a withdrawl over the value of the account comes in, it is denied.

Note that this may not work everywhere in the world. For example, in Australia, the legacy direct debit system will happily put an account with no overdraft into negative balance.

I’m not sure if the modern replacement (PayTo) has the same behaviour. In any case, legacy direct debits will probably stick around for years.

The best option is to simply avoid PayPal.

Yep, have experienced similar surprise negative balances with Visa debit cards in New Zealand as well.

Maybe, but if you were going to pay your rent with the money on Thursday, at least it's not gone.

>The best option is to simply avoid PayPal.

Unfortunately certain vendors only accept Paypal. For example, I like to watch billiards, and Accu-Stats (one of the largest PPV billiards sites) only accepts Paypal. So, unfortunately, my choice is either to bite the bullet and use Paypal or be prevented from watching the events I'm interested in.

Thanks!

My bank (BoA) allows me to have multiple checking accounts so long as you satisfy the initial deposit requirement, and maintain sufficient balances in other linked accounts, so this looks like a good way forward. I think I'll switch other apps to use this new receivables account to contain their potential blast radius.

double check your statements now and then - if you don't already. i had a biz acct and my home account, and would get dinged "service charges" on home account if it was below ... $500 for too long. Biz account had 30x that in there - far more than their min requirements, and I was told they were 'linked'. 2x in 3 years, they "got unlinked" and I was getting various $39 service fees on the home account. "Oh, so sorry, here... we linked again - we'll waive the fee"... months later... same thing. Less for you specifically OP and more just a general warning.

Heh, I keep having my auto pay disabled on my card and my wife's card, just one day the card doesn't work and the payment has been missed.

It happens every 10-18 months, enough that I assume there is a substantial amount of money being produced by charging a late fee and interest and people not noticing. They never put it back either, have to call and spend a couple hours with them.

My lease favorite bank.

This is a good approach in general, having a spending account where you pay anything directly, email transfers, cash withdrawals, etc., And then a true savings account for things like salary direct deposit. The Firewall between them is you making manual transfers. It's like CI/CD with a human approval step before going to GA

please no one say crypto ;-)

but I definitely have the same question, I always deposit anything sent to me via paypal, venmo, whatever right away so there's zero balance.

good luck telling a bank to un-authorize someone from being able to deposit or remove money from your account though, I had to call them up and they didn't even seem to know how to do it.

somehow it isn't just a checkbox, it seems to me like revoking that permission should be vastly easier than providing it...

Create a second account with your bank that is only for PayPal withdrawals.

Spend it.

> never giving paypal your bank information

Why?

Because they can pull funds from your account and it'll be a hassle to get it back if not authorized. If you must, you tie it to a burner deposit account you can immediately sweep into our out of at your discretion. Sending funds? Sweep just enough in from another account. Receiving funds? Sweep out as soon as the funds land via ACH.

Have there been any examples of PayPal stealing money from people's bank accounts?

This happened to me. An eBay buyer lied that the item I sold was never delivered. eBay sided in their favor, I was scammed by the buyer. My PayPal account went negative and bank account was debited of a few thousand dollars while a freshman in college. I hate PayPal.

Meanwhile, I've had a package marked as delivered that never actually showed up. eBay wouldn't help me. USPS wouldn't help me without info from the seller. Seller never gave me the correct info that I requested, nor followed up with USPS.

Seems random who gets screwed in these situations.

Honestly it boggles my mind that USPS can just mark something delivered with no actual evidence of delivery (signature, photograph etc.) and it's just taken as fact.

If you'd have played dirty and initiated a refund, then sent a box of nothing back, you'd have won in the end. All eBay cares about is delivery receipts. Not saying you should actually do that, but OTOH an experienced eBay seller knows how it will play out so if they could be convinced you were about to do it (without, you know, giving them evidence to send to eBay), it might light a fire under them to contact USPS and trace the delivery.

Sort-of happened to me. Someone sent me a large amount of money unsolicited. (5 figures.) This wasn't a scam, just a very dumb woman who can't remember her teenage son's email address even though I've haf the address longer than he's been alive. I logged-in and canceled the erroneous transfer to return her funds to her, but unbeknownst to me a small automatic charge for a domain name had gone through since I received the money. Ordinarily I keep $0 in my Paypal account and Paypal automatically deducts the funds from my bank account. But apparently when reversing a transaction instead of covering any shortfall from my bank automatically, they charged me a $100 insufficient funds fee and THEN deducted the fee + shortfall from my account. Absolutely infuriating.

That thing where recurring payments subtract from your PayPal balance before the assigned payment method is, as you put it, absolutely infuriating. It put me off of PayPal so hard.

I vaguely recall this happening to a guy who scammed someone then got charge-backed after withdrawing from Paypal, he somehow got the bank to reverse his transaction to Paypal and kept the funds. I think this is why Paypal stop you from withdrawing/spending your incoming payment for a few weeks in some cases.

Happened to me in 2007, they took 750 GBP from my back account. I complained, it was never explained what happened. They paid the money back to me over a period of about 4 months. It was utterly ridiculous.

I literally just selected your question and searched brave: https://arstechnica.com/tech-policy/2022/01/paypal-stole-use...

The article you linked talks about Paypal holding funds, not about Paypal taking money from bank accounts.

There looks to be several in this thread alone.

Yes I temporarily lost £350 via paypal and eBay. I sent some amateur radio equipment to someone via UPS tracked fully insured. Was signed and delivered. The buyer decided to return it immediately (suspicious) but I had no choice. I received the item back and it had a different serial number. The buyer had stolen a working radio and replaced it with a broken one. I contacted eBay and they told me to work it out with the buyer and they couldn't do anything. The buyer did not respond and opened a case against paypal. I provided evidence to paypal and paypal sided with the buyer because as far as they cared, both deliveries were signed for. Then because I didn't have any money in paypal they took it out of my account instead. The bank allowed this and it caused an unauthorised overdraft that cost me another £30. I closed that bank account and removed it from paypal immediately.

The buyer listed the radio I had sent him immediately on eBay for way above a reasonable price. I took screenshots and made a police report. Didn't hear anything back in a week. Considered small claims but I'd have to potentially travel to the claimant's area which is a good 3h drive each way at the time.

So the buyer/reseller was in Ipswich which is 15 miles or so from my brother-in-law so he went round there and recovered it for me. My brother-in-law is an ex army (Gulf War vet) 6'5" bouncer. The guy did not argue with him. He was told he could come and collect the broken one at his cost from Bristol. He never did.

I now run a mule account on ebay managed payments and do not accept paypal for anything and do not send anything until cash is cleared from the mule account into my main account.

Edit: also worth pointing out that ebay do not allow sellers to leave negative feedback for buyers so you can't even rate or report the buyer publicly. If you leave any comments in a positive feedback other than sucking dick, they will remove the feedback.

In most of Europe there is an "undo" button in online banking next to such debits to get the money back no questions asked (for a few weeks after the transaction), as per regulations. US banking should copy this maybe.

This makes so much sense

Paypal can just pull money from an account without any kind of authorization on the US? That's a quite bad procedure.

Great and succinct analogy, that was helpful

to the extent possible, it may make sense to just have multiple banks/accounts anyway. i use a big megacorp bank, my wife has money at a small local bank, we have other money in some online accounts. most stuff is handled day to day via one main account, but I've had cards suspended out of the blue in the past, and having 'all eggs in one basket' seems to be what often bites a lot of people when something causes a bank to freeze/suspend an account.

Paypal stranded me in Atlanta when I rented a room for a week and they denied the charge. So I called their customer service and got the worst customer service experience of my life. The rep would talk over me, literally speak gibberish, and then hung up.

That was the end of my interactions with PayPal.

I couldn't even get them to speak to them. Their system denied my payment dispute (for which I could show obvious fraud) instantly--within 20 seconds. And then when I called they refused to talk since it was denied.

Luckily I paid through my credit card on Paypal since I disputed it through them. If I had linked my checking account, they would have help a fraudster steal 700 dollars from me.

Interesting thing happened to me a couple of years ago.

I went to another state to pick up a car I had bought. I needed to pull $10k of my own money in cash out of the my banks to pay the seller. I checked with the banks before I left to make sure it would be OK.

I arrived in Utah to meet the seller and we go to the bank to do the transaction, and my banks suddenly don't want to let me cash out that much money. I ended up having to kludge the transaction together with some my cash and credit card advances. I didn't quite make the full sale amount so the seller let me take the car and sent me the pink slip later.

Second fact: online banking used to do instant bill pays. Now anything above a trivial amount has to be scheduled. It didn't used to be that way.

Combining these two suggests to me there is a liquidity shortage in the retail banking system. Paypal may be under the same liquidity pressures and using fuzzy TOS reasons to hold money because they don't have the liquidity to handle all of their transaction demand.

It's not liquidity, it's fraud protection

Liquidity to support your 10k transaction seems unlikely. More likely fraud and CYA by the banks

The bank workers told me they don't keep a lot of cash on hand to minimize robberies.

The thing I wonder about is why did online banking start requiring scheduled payments for anything over a $100 or so about five years ago? Now they often make me wait a few days to clear a payment, unless it's internal to the bank itself (e.g. my checking account to pay off my same bank cc account).

I'm sure they're investing my money short term and the holds give them more time and flexibility to do so. However, tying up account money in short term invesments means their liquidity will be reduced.

If you were PayPal would you not invest user funds overnight (or longer) based on projections of inflow/outflow? If not you'd be cheating your shareholders. However the temptation to hold on to user funds as long as possible would be constantly present. That's almost certainly what's happening.