5 ms·

PayPal tried to take money from my checking account because Consumer Reports "autorenewed" my subscription -- without my knowledge or explicit authorization. As

PayPal tried to take money from my checking account because Consumer Reports "autorenewed" my subscription -- without my knowledge or explicit authorization. As soon as I saw this I reported this as an unauthorized transaction on PayPal. But PayPal failed to stop the payment in time, even though at the time of my flagging it was unpaid. I then called BofA and blocked PayPal and that worked. So at the moment I have a negative balance on PayPal. PayPal called me to try and collect it from me, but I told them to fsck off: I had not explicitly authorized either Consumer Reports or PayPal. I didn't realize PayPal could dip into my checking account any time they wanted to. I thought it required my manual action. No more PayPal for me. This is a standard procedure for many merchants these days: Offer an attractive initial price, then add fine print that states your account will autorenew at "then current" rates, and you have to make a phone call (where you have to hold for 20 to 30 minutes for the next available representative) if you want to cancel. I am glad California is taking action. They still have a for-the-people government in California.

sonnyblarney 8y ago
"I didn't realize PayPal could dip into my checking account any time they wanted to." EBay did this to me once, I think this is an American thing, doesn't happen here in Canada like that.
- olliej 8y ago
  Oh yeah, this was one of the most insane things I experienced moving to the US. If someone has your bank account number they can withdraw money from it. For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it. It gets better: if you have someone’s bank account number you still cannot transfer money to them. It would literally be easier to tell your bank (say etrade or whatever) that it was your bank account. That’s why all these absurd abank payment systems exist in America. The act of just giving someone money is incredibly hard.
  - smsm42 8y ago
    Yes, though they must be a bank or have an agreement with a bank. Random person can't just do it by just having the numbers. And a bank can get in trouble if it allows shady clients access to ACH. > bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took In my experience, it is usually the reverse - they put a small sum there, and then withdraw it back after auth. But the end result is the same, of course (except if you have less than $1 on your account). > if you have someone’s bank account number you still cannot transfer money to them That's indeed weird, because I see no technical reason (at least with my knowledge about ACH - btw HN had recently a couple of nice articles about it) why that would not be possible, but my bank only allows me to transfer money to my accounts. No idea why. Maybe some legal stuff? OTOH there are apps like venmo which make it easier.
    - olliej 8y ago
      Nope no requirement that they be a bank. Plenty of places allow you to pay online by “direct deposit”, which in every country other than the US involves them providing you with their bank a/c details. In the US you give them /your/ bank account, and /they/ initiate the withdrawal. Anyone with your account details can pay for something from your account, including to a service they can withdraw from. Better yet fraud insurance covers credit cards, not debit or “cheque”. Specifically: if someone uses your bank a/c# you are responsible for recovering the money.
      - smsm42 8y ago
        > Plenty of places allow you to pay online by “direct deposit” Looks like you've missed the "or have an agreement with a bank". > if someone uses your bank a/c# you are responsible for recovering the money. I do not think this is true. Of course credit card fraud liability policy only covers the credit card, but there are rules about bank transfers. My reading of https://www.law.cornell.edu/ucc/4A/part_2 https://www.law.cornell.edu/ucc/4A/part_2 is that the customer is liable for the payment only if it is authorized and passes "commercially reasonable" security procedure. If somebody just gets you bank account number, it's clearly not an authorized payment (unless they make it look authorized, i.e. by stealing your identity or passwords, etc.) and you will not be liable for it.
- imroot 8y ago
  I had an issue where I accidentally sent an eBay shipment to an old address. It's something that I immediately recognized after clicking "Buy now," and immediately sent a message to the senders; all but one of them corrected the issue and sent the package to the right address, but, one didn't...and it wasn't a big deal -- a $15 package -- but, it was more about the principle... I followed eBay's "Buyer protection" to the letter...and guess what? I wasn't covered...even after escalating -- and saying, "They have my money and I still don't have my product, I'm trying to understand which part of 'Buyer Protection' I am missing here." I called my credit card company, explained what was going on, and had my money back in 3 minutes. Chargebacks are great, whenever they are used effectively...and ebay/paypal is the devil.
  - masonic 8y ago
    Note that PayPal requires that the vendor ship to the confirmed address that the buyer used in the payment. If the seller or shipper ships to a different address, even at the buyers request, they lose all Seller Protection.
- thelastidiot 8y ago
  It's even worse than you think. Because even if you put a credit card to back up your payments (easier now that PayPal has a deal with VISA), and you are hoping that a passed expiration date on your card will block a transaction from happening, the company will try new dates with one year increment in the future, till eventually the transaction goes thru.
  - robin_reala 8y ago
    Huh? Does your card number not change when you get a new one in the US?
    - thelastidiot 8y ago
      Unless you specifically ask for a new number, not at all. What's even worse it that the cvv is changing (checksum with the date and card number) but the transaction can go thru without cvv submission in most cases.
      - thecrazyone 8y ago
        what's the point of a cvv then? This seems rather odd
        icebraining 8y ago
        It's up to the merchant; since in the event of fraud they'll be the ones who get hit with the chargeback, it's up to them to decide if they want to require that extra safety or not.
        fjsolwmv 8y ago
        For a recurring subscription, the cvv was verified at the beginning. Cvv is for verifying the card security, not vendor account management.
Merad 8y ago
FYI anyone can dip into your checking account anytime they want to. AFAIK there is literally zero security, all you can do is dispute unauthorized transactions after the fact. Even with a paper check all the info on the check (including recipient and amount) is effectively just a paper trail to be referenced during a dispute.
- jjeaff 8y ago
  Not only that, but you only have 60 days to dispute. So don't miss a bank statement or you could be eating the fraudulent charge.
- dmihal 8y ago
  It's crazy how our modern banking system has almost zero security systems in the way of someone draining your account. The account numbers aren't even secret, they're written on the bottom of every check!
- dd36 8y ago
  Yes! And you have to catch it within 60 days. I use examples from a bad embezzlement in my pitch deck. Checks are a joke.
delfinom 8y ago
>PayPal tried to take money from my checking account because Consumer Reports "autorenewed" my subscription -- without my knowledge or explicit authorization. The only way this happens is you create a "billing agreement" when you first signup. Its a feature of Paypal that then lets sites bill more stuff to you without much in terms of prompting. Its useful because services like Steam use it to avoid prompting users over and over again to login but other sites use it....because they can. Problem is its not very obvious to perhaps the majority of users they are creating a billing agreement. You can terminate these agreements any time in the paypal site. But you have to do it yourself as otherwise it'll just sit there indefinitely.
- naibafo 8y ago
  Yes, I think that is what I use to pay for Netflix.

sonnyblarney 8y ago

"I didn't realize PayPal could dip into my checking account any time they wanted to." EBay did this to me once, I think this is an American thing, doesn't happen here in Canada like that.

olliej 8y ago
Oh yeah, this was one of the most insane things I experienced moving to the US. If someone has your bank account number they can withdraw money from it. For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it. It gets better: if you have someone’s bank account number you still cannot transfer money to them. It would literally be easier to tell your bank (say etrade or whatever) that it was your bank account. That’s why all these absurd abank payment systems exist in America. The act of just giving someone money is incredibly hard.
- smsm42 8y ago
  Yes, though they must be a bank or have an agreement with a bank. Random person can't just do it by just having the numbers. And a bank can get in trouble if it allows shady clients access to ACH. > bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took In my experience, it is usually the reverse - they put a small sum there, and then withdraw it back after auth. But the end result is the same, of course (except if you have less than $1 on your account). > if you have someone’s bank account number you still cannot transfer money to them That's indeed weird, because I see no technical reason (at least with my knowledge about ACH - btw HN had recently a couple of nice articles about it) why that would not be possible, but my bank only allows me to transfer money to my accounts. No idea why. Maybe some legal stuff? OTOH there are apps like venmo which make it easier.
  - olliej 8y ago
    Nope no requirement that they be a bank. Plenty of places allow you to pay online by “direct deposit”, which in every country other than the US involves them providing you with their bank a/c details. In the US you give them /your/ bank account, and /they/ initiate the withdrawal. Anyone with your account details can pay for something from your account, including to a service they can withdraw from. Better yet fraud insurance covers credit cards, not debit or “cheque”. Specifically: if someone uses your bank a/c# you are responsible for recovering the money.
    - smsm42 8y ago
      > Plenty of places allow you to pay online by “direct deposit” Looks like you've missed the "or have an agreement with a bank". > if someone uses your bank a/c# you are responsible for recovering the money. I do not think this is true. Of course credit card fraud liability policy only covers the credit card, but there are rules about bank transfers. My reading of https://www.law.cornell.edu/ucc/4A/part_2 https://www.law.cornell.edu/ucc/4A/part_2 is that the customer is liable for the payment only if it is authorized and passes "commercially reasonable" security procedure. If somebody just gets you bank account number, it's clearly not an authorized payment (unless they make it look authorized, i.e. by stealing your identity or passwords, etc.) and you will not be liable for it.
imroot 8y ago
I had an issue where I accidentally sent an eBay shipment to an old address. It's something that I immediately recognized after clicking "Buy now," and immediately sent a message to the senders; all but one of them corrected the issue and sent the package to the right address, but, one didn't...and it wasn't a big deal -- a $15 package -- but, it was more about the principle... I followed eBay's "Buyer protection" to the letter...and guess what? I wasn't covered...even after escalating -- and saying, "They have my money and I still don't have my product, I'm trying to understand which part of 'Buyer Protection' I am missing here." I called my credit card company, explained what was going on, and had my money back in 3 minutes. Chargebacks are great, whenever they are used effectively...and ebay/paypal is the devil.
- masonic 8y ago
  Note that PayPal requires that the vendor ship to the confirmed address that the buyer used in the payment. If the seller or shipper ships to a different address, even at the buyers request, they lose all Seller Protection.
thelastidiot 8y ago
It's even worse than you think. Because even if you put a credit card to back up your payments (easier now that PayPal has a deal with VISA), and you are hoping that a passed expiration date on your card will block a transaction from happening, the company will try new dates with one year increment in the future, till eventually the transaction goes thru.
- robin_reala 8y ago
  Huh? Does your card number not change when you get a new one in the US?
  - thelastidiot 8y ago
    Unless you specifically ask for a new number, not at all. What's even worse it that the cvv is changing (checksum with the date and card number) but the transaction can go thru without cvv submission in most cases.
    - thecrazyone 8y ago
      what's the point of a cvv then? This seems rather odd
      - icebraining 8y ago
        It's up to the merchant; since in the event of fraud they'll be the ones who get hit with the chargeback, it's up to them to decide if they want to require that extra safety or not.
      - fjsolwmv 8y ago
        For a recurring subscription, the cvv was verified at the beginning. Cvv is for verifying the card security, not vendor account management.

Merad 8y ago

FYI anyone can dip into your checking account anytime they want to. AFAIK there is literally zero security, all you can do is dispute unauthorized transactions after the fact. Even with a paper check all the info on the check (including recipient and amount) is effectively just a paper trail to be referenced during a dispute.

jjeaff 8y ago
Not only that, but you only have 60 days to dispute. So don't miss a bank statement or you could be eating the fraudulent charge.
dmihal 8y ago
It's crazy how our modern banking system has almost zero security systems in the way of someone draining your account. The account numbers aren't even secret, they're written on the bottom of every check!
dd36 8y ago
Yes! And you have to catch it within 60 days. I use examples from a bad embezzlement in my pitch deck. Checks are a joke.

delfinom 8y ago

>PayPal tried to take money from my checking account because Consumer Reports "autorenewed" my subscription -- without my knowledge or explicit authorization. The only way this happens is you create a "billing agreement" when you first signup. Its a feature of Paypal that then lets sites bill more stuff to you without much in terms of prompting. Its useful because services like Steam use it to avoid prompting users over and over again to login but other sites use it....because they can. Problem is its not very obvious to perhaps the majority of users they are creating a billing agreement. You can terminate these agreements any time in the paypal site. But you have to do it yourself as otherwise it'll just sit there indefinitely.

naibafo 8y ago
Yes, I think that is what I use to pay for Netflix.