7 ms·

PayPal gets a list of banned strings from the Office of Foreign Asset controls. If any match those strings it's flagged for a review. This is more or less leg

• shean_massey 6y ago
  In all software I've seen dealing with these issues (ofac, aml, Dow Jones listings, etc) the flagging should result in manual verification but you're able to configure risk allowances. They almost all certainly allow some bad transactions through accepting the potential risk/cost of actually hiring huge teams of manual auditors. Just being flagged does not always lead to audits.
• calvinmorrison 6y ago
  It's very annoying. I worked at a shop that sold cigars online. No actual cubans, but brands that used the name cuba in it. Inadvertently every time it would get flagged.
  • CydeWeys 6y ago
    This seems like poor branding on the part of the cigar brands (at least for online sales).
    • btrask 6y ago
      Is "I Can't Believe It's Not Butter!" a bad brand for margarine? Imagine it getting flagged by the butter police.
      • Kadin 6y ago
        Well, they have managed to generate a class-action lawsuit, although it's more over the zero-calorie claim: https://dev.theclassactionguide.com/News/3029/I_Can%E2%80%99t_Believe_It%E2%80%99s_Not_Butter_Class_Action_Says_Cooking_Spray_Isn%E2%80%99t_%E2%80%980_Calories%E2%80%99/ https://dev.theclassactionguide.com/News/3029/I_Can%E2%80%99...
      • CydeWeys 6y ago
        The difference is that there are no butter police, while there are in fact Cuban embargo police that will cause much greater difficulties in selling anything with the word "Cuban" in it. So, no, "I Can't Believe It's Not Butter!" is not a bad brand for margarine, but saying "Cuban" something in a cigar which causes all manner of embargo difficulties is bad branding.
    • myrandomcomment 6y ago
      When Castro took over the owners of the brands fled and took the rights to the brands with them. At the same time the Cuban government kept making the cigars under the same name. So for every major brand you will find 2 in the world, one Cuban, one not.
      • _JamesA_ 6y ago
        Bacardi (Puerto Rico) has started copying the Cuban Havana Club rum as well. [1]: https://www.washingtonpost.com/business/havana-club-v-havana-club-inside-the-rum-war-between-bacardi-and-cuba/2016/07/22/57c32a06-2cb4-11e6-9b37-42985f6a265c_story.html https://www.washingtonpost.com/business/havana-club-v-havana...
        • walshemj 6y ago
• athms 6y ago
  >This is more or less legally required for any company that moves money in the United States of America. You will probably find the same issues with the same terms on any other banking for financial body. No you won't because names are not unique. Banks and credit unions tend to have sophisticated data analysis, unlike the knuckleheads at PayPal. When I heard about this nonsense years ago, I put some of the banned words in the memo area of checks and transferred money between two credit union accounts. They went through. I did the same thing using electronic transfers between accounts. Again, they went through without any problem. https://imgur.com/a/RnpRm https://imgur.com/a/RnpRm A person put the words "James Kang" in a donation to the Red Cross that stated he was testing these banned words and PayPal, in their infinite stupidity, froze the transaction.
• _Microft 6y ago
  And the strings from this list have to be matched indiscriminately against everything? Names of account holders, text in the reference field of a transaction (if such a thing exists in the US), whatever?
  • imnotjames 6y ago
    I haven't read the actual guidelines / rules / etc put out by OFAC in over a year but that was the gist of it from the legal team.
  • SethMurphy 6y ago
    Yes, all text in a message scanned, matches made are for manual review. In the world of financial compliance false positives are in the majority. No company can afford to skip a true match for the sake of scalability based on current audit practices.
  • MattGaiser 6y ago
    In finance, compliance is taken very seriously. Better to block 1000 transactions than miss 1.
  • Nyra 6y ago
    Yep. I bought a used copy of Yakuza 0 online once and foolishly included the name of the game in the notes of the transaction. PayPal blocked the transfer of funds for over a week.
  • Ancapistani 6y ago
    I’ve had an order of “Aleppo pepper” blocked from a small online retailer because it contained the word “Aleppo”. https://en.wikipedia.org/wiki/Aleppo_pepper https://en.wikipedia.org/wiki/Aleppo_pepper
• URSpider94 6y ago
  The payments won’t still go through - if you look at the links, PayPal is returning a big red error message to customers. It doesn’t look like PayPal is doing any kind of review, they are just blocking all transactions with Tardigrade in the associated text anywhere.
  • derision 6y ago
    How do you think a review process works? It's not instant. When you try to process the payment, the OFAC check fails, and it's flagged for manual review. Only option is to show the user an error
    • ponker 6y ago
      What is “manual review” here? The reviewer doesn’t have the ability to send the transaction through. It went to the circular file.
      • tresCommatoso 6y ago
        To get away as a bad apple is to make a valid buisness with a auto-flagged name, get reviewed and de-flagged as a mistake - then use the "reviewed" account for money laundering, weapons or drug trade. Most systems will not re-check again on a false-positive that already consumed money. There is a whole buisness out there, making real-fake-door companys for just this. Surprisingly, using a very common name or a already dubious name does not work as well. The trick here, is to follow expected algo optimizations to reduce money spend on reading through transaction history of a flagged case.
    • neotek 6y ago
      As a retailer who has been stung by this bullshit with PayPal many times in the past, I can tell you with absolute certainty that the payment doesn't go through ever, at all. It isn't flagged and reviewed, it's just outright rejected with a cryptic error message indicating that someone, somewhere breached PayPal's terms of service. No money leaves the customer's account, no money arrives in the vendor's account; the process simply fails.
• floatingatoll 6y ago
  I hope an arms dealer names themself eBay Arms. I’m against arms dealers and PayPal and this would destroy PayPal.
  • Marsymars 6y ago
    FYI Paypal's been spun off from eBay since 2015 and its agreement to serve as eBay's default payment processor was set to expire this year.
    • floatingatoll 6y ago
      Really! That is extremely interesting news. I’ll let the sentiment stand, but if you find an HN post about that or submit one, please link it here.
    • bdcravens 6y ago
      eBay is in the process of migrating sellers to use eBay's internal payment processing (beta users last years, others gradually - my eBay stored moved to it in July) https://pages.ebay.com/seller-center/service-and-payments/managed-payments-on-ebay.html https://pages.ebay.com/seller-center/service-and-payments/ma...
  • MrQuincle 6y ago
    Or PayPal Arms. Inception!
• anigbrowl 6y ago
  OK, but so what? 'Be on the lookout for XYZ' is an understandable request, but what prevents paypal rapidly distinguishing between credible and suspicious transactions - and more importantly, pre-emptively communicating with users about it, since they are going to find out the hard way? Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.) The basic problem here is that the burden of enforcement is being shifted by Paypal to innocent people with no warning, instead of being shouldered by the company, which is in a position to push back legally on unreasonable requests and plan ahead for reasonable ones.
  • maxbond 6y ago
    > Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.) This literally happened at HSBC. Employees entered transactions in exactly the way you're imagining. (I didn't find a written source, but this is covered in Netflix's "Dirty Money", episode "Cartel Bank")
• Defenestresque 6y ago
  >Technically, these aren't being blocked. They're being audited. The payments will still go through. They buyers are literally getting a message saying "This transaction cannot be completed because it violates the PayPal User Agreement" [0] [0] https://twitter.com/ArchieMcPhee/status/1304437732584771584 https://twitter.com/ArchieMcPhee/status/1304437732584771584
• theptip 6y ago
  Just to be clear, OFAC does not give a list of “banned strings”. It provides a list if individuals and entities that it is illegal to transact with. By which I mean, it’s the entity that matters, not just the raw string. It’s up to the payment processor to have a process that ensures they don’t send payments to a blocked entity. You can search for them here: https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information https://home.treasury.gov/policy-issues/office-of-foreign-as... and see the listing for the company in this notice: https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20191209 https://home.treasury.gov/policy-issues/financial-sanctions/... Note that the standard practice for handling an OFAC hit (e.g. payment to O Bin Laden) is to disambiguate your payee from the blocked individual/entity. This can be easy or difficult depending on how much info you have on the payee; if you have an address and nationality already that don’t match the sanctioned entity then you’re generally ok; typically you would collect a photo of the payee’s ID and run a manual check if there was any doubt. These “enhanced due diligence” processes can be quite time consuming in aggregate, and I’m not surprised that PayPal isn’t running a detailed EDD process on transactions that will probably net it a few cents of fees. Having said that, given the structure of their business (online checkout) I’m surprised that they are considering the product (eg “tardigrade”) as being relevant; they have account info on both the payor and payee so they know the payment isn’t going to the sanctioned Cypress company from the OFAC list. This isn’t a Venmo payment that says “pass this payment on to Tardigrade Inc”, which you would want to block. This seems like either a bug in their screening code or some very risk-averse logic (maybe to do with low-value transactions).
• goldenManatee 6y ago
  So the answer is this will never be fixed? Just a big RegExp essentially, is the path to avoid $250k per fines? A Persian friend was craving his mother’s cooking, so we went to a restaurant which he Venmo’d me for and we got a stupid flag because his note said “Iranian”. That’s borderline culturally inappropriate considering these companies have a long history of all our other good-standing transactions, they already have massive data from third-parties they purchase from about our offline identities, they have our geolocations whether we like it or not. There is a vast asymmetry of information between these companies and the public they service. They have the advantage, so why not apply that advantage to not flag a small-charge restaurant outing in one of the country’s most well educated neighborhoods, and use something more sophisticated than a silly-string dictionary lookup to determine when to flag.