4 ms·

I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to l

I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to let me log in without it. Surprisingly, customer support was very helpful and let me transfer out the (minimal) balance in the account to another, completely unconnected PayPal business account I happened to have. Which is even more disconcerting, because it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane. I'm still (very, very occasionally) using that business account today, even though the underlying business also ceased to exist years ago. I wonder when the banhammer will drop?

tluyben2 4y ago
Maybe for your account they registered the wrong number as well? I could’ve gone on using it if I hadn’t told them. But in NL this is an issue (hence I tried so hard); bank accounts to companies need to be closed asap when the company gets closed and you definitely cannot pay or receive money with them as that will anger the tax office.
- jeromegv 4y ago
  But PayPal is not a bank or registered as a bank, so would that matter?
  - Tijdreiziger 4y ago
    They certainly are. From their NL terms and conditions [1]: > Who provides the Service? > The Service is provided by PayPal (Europe) S.à r.l.et Cie, S.C.A. (R.C.S. Luxembourg B 118 349) (“PayPal”) to registered users in the European Economic Area. For details on how to reach PayPal, please refer to this page on Customer Service, or in an emergency, see “What to do” below. > PayPal is duly licensed in Luxembourg as a bank (or “credit institution” in legal terms). We are under the prudential supervision of the Luxembourg financial regulatory authority, the Commission de Surveillance du Secteur Financier or CSSF. The CSSF maintains a register of the organisations that it regulates at https://supervisedentities.apps.cssf.lu/index.html?language=en#Home https://supervisedentities.apps.cssf.lu/index.html?language=.... PayPal is number B00000351 on the register, but you can also look us up on the register by our name. [1] https://www.paypal.com/nl/webapps/mpp/ua/servicedescription-full?locale.x=en_NL https://www.paypal.com/nl/webapps/mpp/ua/servicedescription-...
missedthecue 4y ago
Does "very very occasionally" mean you use it frequently or infrequently?
- kingofpandora 4y ago
  It means infrequently.
- deleted 4y ago
  [deleted]
xnorswap 4y ago
Transferring money out is far lower risk than unauthorised account access. If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small. If they give unauthorised account access then there's far greater harm including risk they'll get penalised by regulators over data security as well as the damage being potentially hard to undo if further changes are made to the account.
- P5fRxh5kUvp2th 4y ago
  The point is that requiring cvv for a login is stupid, not that the risk levels are different. Does it become acceptable to require the blood of my first-born because the risk levels are different? Of course not. They're not even allowed to store that in the US (PCI-DSS), so the other poster must not be in the US.
  - jefftk 4y ago
    Your GP had "it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane", and your parent is explaining why that's a non-insane thing.
    - rippercushions 4y ago
      GP here. I found every part of the process insane. To enumerate: 1) getting locked out for not having the CVV of some random card that expired a decade earlier 2) being allowed to transfer money out, but not to login into the account 3) being allowed to keep my second account, even though they don't trust me enough to give me access to the first None of these make sense individually, and they make even less sense as a whole.
  - ballenf 4y ago
    They probably couldn't see the CVV but were going to run the card and see if it verified.
mihaaly 4y ago
I closed my account when they discovered suspicious activity in my account, at least claimed so but apart from locking me out until I prove I am me with photo ID copy and independent sources about my address (bank statement, utility bill, ...), basically collecting more data on me, they did not make any steps tracking down this suspicious activity, not even explaining what it was, they did not report it to the authorities! It was complete unresponsiveness when I asked for details on the event, asking about reference to the case at the authorities, told them that I will report it myself to the authorities (someone doing something to my money!!) and need some info, nothing, complete silence! My conclusion that they simply lied to my face! I was around the time when PayPal got some bank like regulatory status in Ireland and might have needed some more data so they forced me to provide through a bullst claim. At least this is the only scenario I find feasible. I had very little money there, after gaining access again (giving them a lot of data on me) there was no sign of any activity there that not belonged to me, nothing. I decided that their practices are shady and I will never ever trust them! (I did not report it eventually to the authorities, even the preparation for it took time with little supporting material, and I already had an unrelated matter to tackle, it was simpler leaving them and spread their reputation. PayPal definitely did not bother reporting it as I was never approached or questioned about the suspicious activity in my account ever. It was about 10 years ago btw.)
- tluyben2 4y ago
  This is normal for almost all (all?) large corps; they don't have to tell you why the account was terminated/blocked so it could be anything; something you said online (about them / founders etc), something you paid they don't agree with, just ROI vs TCO for your spending habits etc etc. They don't have to tell you and 'suspicious activities' is an easy one: adsense/adwords uses it as well. They use 'if we would tell you what it is exactly and how we measure it, it will allow evil actors to use that against us'.
- tinus_hn 4y ago
  Same happened to me. Did they keep sending emails you need to agree to their new terms of service and to refuse you need to agree to their new terms?
- 4y ago
wsc981 4y ago
> I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to let me log in without it. LOL, I kinda had the same issue, but I had to remember the last 4 numbers of some old credit card. Couldn't find it in any email, so yeah ... couldn't use my Paypal anymore.
- rippercushions 4y ago
  This was a while ago, so maybe it was the four digits and not the CVV for me as we? Not sure, but I do recall that the card was waaaaay expired (as in, a decade ago) and it took me a while to figure out what card they were even referring to.

tluyben2 4y ago

Maybe for your account they registered the wrong number as well? I could’ve gone on using it if I hadn’t told them. But in NL this is an issue (hence I tried so hard); bank accounts to companies need to be closed asap when the company gets closed and you definitely cannot pay or receive money with them as that will anger the tax office.

jeromegv 4y ago
But PayPal is not a bank or registered as a bank, so would that matter?
- Tijdreiziger 4y ago
  They certainly are. From their NL terms and conditions [1]: > Who provides the Service? > The Service is provided by PayPal (Europe) S.à r.l.et Cie, S.C.A. (R.C.S. Luxembourg B 118 349) (“PayPal”) to registered users in the European Economic Area. For details on how to reach PayPal, please refer to this page on Customer Service, or in an emergency, see “What to do” below. > PayPal is duly licensed in Luxembourg as a bank (or “credit institution” in legal terms). We are under the prudential supervision of the Luxembourg financial regulatory authority, the Commission de Surveillance du Secteur Financier or CSSF. The CSSF maintains a register of the organisations that it regulates at https://supervisedentities.apps.cssf.lu/index.html?language=en#Home https://supervisedentities.apps.cssf.lu/index.html?language=.... PayPal is number B00000351 on the register, but you can also look us up on the register by our name. [1] https://www.paypal.com/nl/webapps/mpp/ua/servicedescription-full?locale.x=en_NL https://www.paypal.com/nl/webapps/mpp/ua/servicedescription-...

missedthecue 4y ago

Does "very very occasionally" mean you use it frequently or infrequently?

kingofpandora 4y ago
It means infrequently.
deleted 4y ago
[deleted]

xnorswap 4y ago

Transferring money out is far lower risk than unauthorised account access. If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small. If they give unauthorised account access then there's far greater harm including risk they'll get penalised by regulators over data security as well as the damage being potentially hard to undo if further changes are made to the account.

P5fRxh5kUvp2th 4y ago
The point is that requiring cvv for a login is stupid, not that the risk levels are different. Does it become acceptable to require the blood of my first-born because the risk levels are different? Of course not. They're not even allowed to store that in the US (PCI-DSS), so the other poster must not be in the US.
- jefftk 4y ago
  Your GP had "it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane", and your parent is explaining why that's a non-insane thing.
  - rippercushions 4y ago
    GP here. I found every part of the process insane. To enumerate: 1) getting locked out for not having the CVV of some random card that expired a decade earlier 2) being allowed to transfer money out, but not to login into the account 3) being allowed to keep my second account, even though they don't trust me enough to give me access to the first None of these make sense individually, and they make even less sense as a whole.
- ballenf 4y ago
  They probably couldn't see the CVV but were going to run the card and see if it verified.

mihaaly 4y ago

I closed my account when they discovered suspicious activity in my account, at least claimed so but apart from locking me out until I prove I am me with photo ID copy and independent sources about my address (bank statement, utility bill, ...), basically collecting more data on me, they did not make any steps tracking down this suspicious activity, not even explaining what it was, they did not report it to the authorities! It was complete unresponsiveness when I asked for details on the event, asking about reference to the case at the authorities, told them that I will report it myself to the authorities (someone doing something to my money!!) and need some info, nothing, complete silence! My conclusion that they simply lied to my face! I was around the time when PayPal got some bank like regulatory status in Ireland and might have needed some more data so they forced me to provide through a bullst claim. At least this is the only scenario I find feasible. I had very little money there, after gaining access again (giving them a lot of data on me) there was no sign of any activity there that not belonged to me, nothing. I decided that their practices are shady and I will never ever trust them! (I did not report it eventually to the authorities, even the preparation for it took time with little supporting material, and I already had an unrelated matter to tackle, it was simpler leaving them and spread their reputation. PayPal definitely did not bother reporting it as I was never approached or questioned about the suspicious activity in my account ever. It was about 10 years ago btw.)

tluyben2 4y ago
This is normal for almost all (all?) large corps; they don't have to tell you why the account was terminated/blocked so it could be anything; something you said online (about them / founders etc), something you paid they don't agree with, just ROI vs TCO for your spending habits etc etc. They don't have to tell you and 'suspicious activities' is an easy one: adsense/adwords uses it as well. They use 'if we would tell you what it is exactly and how we measure it, it will allow evil actors to use that against us'.
tinus_hn 4y ago
Same happened to me. Did they keep sending emails you need to agree to their new terms of service and to refuse you need to agree to their new terms?
4y ago

wsc981 4y ago

> I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to let me log in without it. LOL, I kinda had the same issue, but I had to remember the last 4 numbers of some old credit card. Couldn't find it in any email, so yeah ... couldn't use my Paypal anymore.

rippercushions 4y ago
This was a while ago, so maybe it was the four digits and not the CVV for me as we? Not sure, but I do recall that the card was waaaaay expired (as in, a decade ago) and it took me a while to figure out what card they were even referring to.