9 ms·
PayPal and zero-dollar invoice spam
- orf 11y agoWhy would you put a clickable link to the spam website on your blog though?
- miander 11y agoIf you're so interested in typing in spam links you might as well search up something like "cheap electronics online" in Google and start clicking around page 10.
- miander 11y agoSorry about being a bit rude in this comment. I didn't mean to sound so sarcastic and I didn't mean to refer to you specifically.
- bluedino 11y agoI wonder what the reasoning is that PayPal allows you to 'send' someone $0.00? I'm not really surprised at how terrible the support via Twitter is. I almost never use chat/email support these days with any large company-because of how useless it has become.
- overcast 11y agoI've received invoices for $0.00 when receiving promotional items for projects I was a part of. Comes right in the shipping box, and I'm assuming it's an accounting requirement.
- Ensorceled 11y agoLots of accounting reasons to invoice people 0.00 dollars. Sales materials, demo models, returns, replacements, etc.
- ams6110 11y agoInvoices can contain credits as well as charges. In some cases these might net out to zero but there would still be a legitimate reason to send the invoice showing that detail.
- tehwebguy 11y agoHas PayPal just not tried to fix anything or add features other than a CSS refresh in, like, ever?
- giancarlostoro 11y agoThey did make paypal.me not long ago... That's about all I can think of?
- roymurdock 11y agoThey acquired Venmo, which was pretty big for adding users to their ecosystem. They've kept it pretty quiet and have not tried to link the brands together, which probably says something about the current state of Paypal's brand.
- rory096 11y agoVenmo was actually acquired by Braintree, which in turn was later acquired by PayPal.
- ericcholis 11y agoBraintree as well, which has a site and api that work very well. PayPal's on the other hand...
- chromaton 11y agoThere was an update to invoicing features last year, as well as a complete re-design of the website when you're logged in.
- jedberg 11y agoTheir mobile app has advanced in leaps and bounds in the last year. Also, payment is way easier than it was before. Less bouncing back and forth.
- wheaties 11y agoOn one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.
- deleted 11y ago[deleted]
- magicmu 11y agoIt can, however, be useful to get invoices for purchases that were discounted down to $0.00. At the startup I'm with we often give new customers a $0.00 trial rate, but they still want invoices so their billing department can keep track. Of course, this billing system isn't using PayPal, but just a thought.
- ikeboy 11y agoNot invoices per se, but if you buy something on eBay using only eBay gift cards, it processes as a PayPal "transaction" of $0.00. I've got a bunch of those in my email, always interesting to see "You sent a payment of $0.00 USD to X".
- minikites 11y agoWhat about sending out a replacement product to a customer? A given business process may be simpler if you generate a $0 invoice for replacements.
- hluska 11y agoEspecially if your inventory system requires an invoice number in order to -x from inventory.
- bhartzer 11y agoI agree, but what if the invoice was $1.00 or even $25.00. It would have the same effect, which would be to get the receiver to visit their website?
- tyingq 11y agoNot mentioned in the article, but paypal allows you to send a single invoice to up to 100 different email addresses with a single click. It also allows a 1-click way to email anyone that "hasn't paid" with an update.
- p0la 11y agoThis is brilliant :)
- xentronium 11y ago> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.
- mikeash 11y agoIt's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.
- brianwawok 11y agoI mean, it does slightly increase your rate of spam. I have a private email that I only give out to RL people that has never received a spam message.
- siphor 11y agoWow I love this idea! Can't believe I haven't thought of it
- sean-duffy 11y agoHaving a 'spam email' that you use to sign up for stuff and a separate one for non-automated communication only is definitely a good idea.
- sliverstorm 11y agoIf you can keep your email address off the front page of the internet, I figure that will help reduce spam.
- mikeash 11y agoAt this point, that's like trying to reduce flooding by not dumping a bucket into the river. There's so much spam out there that your only hope is effective filtering.
- deleted 11y ago[deleted]
- patates 11y agoIf we were ever to reach singularity, it would be partly thanks to the motivation created by the spammers.
- yeukhon 11y agoI read the title and thought of spamming zero dollar gift on Minecraft!
- bcrescimanno 11y agoPayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our product worse for our many legitimate customers by going too far in trying to stop this spam.
- samstave 11y agoDon't know if you can answer this: Why can I venmo people money instantly and paypal holds my money for days or weeks at a time?
- tomlongson 11y agoHolding onto funds is how you mitigate risk as a bank or money transmitter.
- pcooney10 11y agoDo you think they're running loads of security tests all the while or something? I'd imagine a majority (if not all) of the checks are done up front- especially given it's 2015. Pretty sure they get a nice bump on their balance sheet for cash "in-transit" - and keeping the timeframe to 3-5 business days only magnifies that effect.
- tomlongson 11y agoIt's not about balance sheets, it's about having time to cope with any unexpected problems with the transaction, like fraud. It's frustrating, and ideally not necessary, but it's essentially a safety net for the middle party.
- asfakeaccount 11y agoYou can not venmo money instantly. The UI makes it seem that way, but it takes a few days for payment to process and as such, Venmo has become a target for scams: http://time.com/money/4036511/venmo-more-check-than-cash/ http://time.com/money/4036511/venmo-more-check-than-cash/ So do not use Venmo for commercial transactions (buying things of Craiglist for example) and do not assume the money transfers immediately. Also shame on Venmo for misleading their users; they should do a better job of explaining how the transfer actually works.
- dudus 11y agoI've been getting the same emails for a while now. I sent to paypal through email and got no response. I also added on a topic I thought was relevant on their forum, and a guy there said he reported it and got a less automatic response than I did. https://www.paypal-community.com/t5/Access-and-security/Getting-Spam-Invoices/td-p/352294 https://www.paypal-community.com/t5/Access-and-security/Gett... I haven't got more messages lately, so I'm guessing they managed it already.
- kenzokai 11y agoHorrible PayPal customer service. This person should not be allowed on their Twitter account.
- equine 11y agoYou can send invoices to people to get paypal to show their name to you and connect names to emails
- dogma1138 11y agoI can also do that with DirectDebit (ACH for you yanks) transactions in the UK for example; brute force branch sort code and account numbers and when you "transfer money" (you can do 1p, or even cancel the transaction once the TUN code has been generated iirc) you get the name associated with the account. There isn't much you can do about it, detecting an abuse of an invoicing system and locally blocking it is much preferable to the other potential outcome of not knowing or being able to confirm where the hell did that invoice actually went.
- richdougherty 11y agoI saw the same sort of thing a few years ago with Google Calendar invite spam. If I remember correctly, I'd even get a meeting reminder with the spam message.
- deleted 11y ago[deleted]
- pcooney10 11y agoWhich banks are offering throwaway credit card numbers? And where do you see wide scale deployment 3Dsecure for online checkouts? Certainly not in the US. And what online payments processors are offering less than PayPal's 2.9% + $0.30? Seems pretty standard across the industry.
- kentt 11y agoAny bank. No banks publicize this, but most will give businesses as many credit cards as they like for a reasonable fee.
- nhumrich 11y agoCiti bank will give a throwaway credit card number if you have one of their credit cards. I use it all the time, you can even set a date/limit on it if you want
- downandout 11y agoAll of these approaches are used to take advantage of the email deliverability rates of large reputable companies that send lots of email. Paypal is a new one, but Hotmail and Facebook have in the past been used for similar things. With Hotmail, you could define a custom "I've changed my email address" message, which would contain your spam message, and then it would send it to up to 5,000 "contacts" for you with near-100% deliverability. Some people automated this, and with that they were able send millions of messages per day. I haven't looked recently, but Facebook's "invite friends" feature has been used similarly in the past.
- shabbaa 11y agoFor a PayPal employee to post here and say he made a team aware and they are working on this it's utterly laughable. There was a post here on hn over two years ago for the same issue which was top post and generated a lot of news. https://news.ycombinator.com/item?id=6526481 https://news.ycombinator.com/item?id=6526481 It is obviously very well known to them for years but they continue to do it
- rtpg 11y agoObviously well known? Guy at PayPal sees post, tells a technical person about it, said person forgets about it. Suddenly PayPal doesn't know about it anymore. Or a person wants to work on fixing this but a manager says no, because there are other priorities. Or a person starts working on this, quits, and it gets lost among the things they were working on. It's so easy for things to get lost in a company, even with all the bug trackers in the world.
- r00fus 11y agoIsn't this what support case systems and bug tracking software was meant to do - to track non-closed issues?
- DrScump 11y agoThat assumes that the manager doesn't insist that bugs of age get closed simply because long-open bugs make for ugly metrics.
- rtpg 11y agoyeah, I agree, but I think a lot of us work in similar situations, where bug tracking exists, but there's such inundation of bugs that we can lose track of some. I guess I have sympathy for the PayPal team in this case. They're working on an extremely large product, with a huge user-base. I would imagine it would be very easy for bugs like this to fall through the cracks even with a "process" in place