Oh, you absolutely CAN do it, you're just not supposed to, since the terminal service is designed for merchants who accept fax/telephone orders. It's a totally

Oh, you absolutely CAN do it, you're just not supposed to, since the terminal service is designed for merchants who accept fax/telephone orders. It's a totally arbitrary distinction these days, but the risk is Paypal cutting him off if they find out he's using it for online orders instead of faxed ones. It's not the perfect solution, but this guy's alternative is twiddling his thumbs for 5 months while he gets screwed over by high-risk international payment processors and/or spends a couple thousand bucks registering an American business only to be told he can't get a merchant account as a foreign alien unless he shows up stateside in person to fulfill US "know your customer" requirements. It's not a crime for anyone to give him their credit card number, and his worst outcome is Paypal cutting him off before he is processing with someone else. So I wouldn't lose any sleep over PCI/DSS compliance.