I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.

If someone X is comfortable doing business with/as entity Y but a bank Z is not, it's totally sensible that X would say Y to the bank Z and bank Z would block them.

More importantly, "terrorists" is often used by some governments in reference to protesters or any group that they see as unfriendly to them.

Bottom line is: it happens, but I agree with you that people that know what they are doing are not putting "Pay for assasination by Osama Bin Laden on 03/28/23" in reference field.

Those of us “of a certain age,” will remember the old adage ”To err is human, but it takes a computer to really f*** things up.”

Without unique identifiers you have big problems.

The payment description should at least mention the invoice number or order number.

Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.

In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.)

It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient.

The particular system the library community was using [https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.

Some security scanners do check for this kind of thing.

That's a special kind of evil...

But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.

However, the issue is political and not technical. OFAC itself has grown its SDN list[1] to 6300 names and that is just one list and the tool has been already severely overutilized ( in my opinion anyway, so take that with a grain of salt ), but if the trend and current geopolitical situation is any guide, this number will only increase.

What I am saying is that you have a big and very variable base to build a key from and there is no guarantee and old key won't suddenly become 'hot'.

Here, the answer is to the problem is actually political. Affected businesses have to start really complaining, if they are affected by the requirements. I have no evidence suggesting that is the case ( based on what I saw maybe 20% of transactions face that kind of scrutiny and even smaller percentage is questioned the way the OP is ). Naturally, it does not help that this process is not standardized so every single financial institution does their own thing..

[1]https://home.treasury.gov/policy-issues/financial-sanctions/...