16 ms·
A failure of security systems at PayPal is causing concern for German banks
- ronsor 1y agoPayPal security is amazing. It randomly locks people out of their accounts and randomly closes their accounts too, but actual fraudsters and criminals are never deterred.
- calmbonsai 1y agoYup. My advice for using PayPal is do not unless you have no other choice. I just got my monthly account statement and, as usual, thankfully zero activity. Though extremely innovative (for its time), it's been a slipshod org since inception and slipshod is a property you decidedly do not want in a payments processor.
- thevillagechief 1y agoMy only use case for paypal is booking an internal flight in a country I visit annually because they do not accept my credit card, but will accept paypal. Literally the only reason I reluctantly got an account. The horror stories I've heard, I wouldn't put any serious money in there. And their drama during the heydays of censorship a few years ago, literally fining people $2500 for politically incorrect speech at the time, I couldn't believe sane people at the company thought that was an acceptable idea. I'd really like to know the inside story of that decision. We forget how crazy 2021-2022 was.
- ramesh31 1y ago> My advice for using PayPal is do not unless you have no other choice. This is literally their business model, which is why they are able to get away with so many shady practices. Until very recently they held a practical monopoly on web based international payments.
- calmbonsai 1y agoI concur. Thankfully, that's changing and changing very rapidly. I really hope to delete my PayPal account sooner rather than later.
- cultofmetatron 1y ago> It randomly locks people out of their accounts and randomly closes their accounts too, yup, my paypal got locked after using it for over 20 years. Customer service refused to help and wouldn't even tell me why it was locked. I still get messages from paypal that they "couldn't get process subscription for X." won't delete my data either. Scummy behavior from them on multiple levels.
- Cthulhu_ 1y agoThank you for the reminder to move money out of Paypal, I get some money every month through Patreon to pay for server costs but keep forgetting about it.
- climb_stealth 1y agoWhat, you don't remember random details from all this time ago? I got locked out of mine as well and the questions to restore were ridiculous. How the hell would I know what transactions I did 15 years ago? And other stupid things like that. Gave up on it after a while and now try to avoid it as much as I can. Good riddance.
- Findecanor 1y agoA few years ago when they suddenly switched on flawed mandatory TFA in my country, it took them nine months before they started to man phone support so people could get in. At about the same time they also implemented a policy to charge for having money left in your balance — when you couldn't access it! Add to that that hey had started with cryptocurrency. I cancelled my account (17 years) as soon as I could.
- lmm 1y agoThey'll do what your government lets them get away with. Demand better regulation.
- jklinger410 1y ago> but actual fraudsters and criminals are never deterred. When my argument is kinda weak I love throwing in some hyperbole to spice it up.
- thinkingtoilet 1y agoThe article is about $10 billion dollars in fraudulent transactions that PayPal has allowed that the banks had to catch themselves. Given that, it's hard to say the OP is speaking in hyperbole.
- jklinger410 1y agoI would imagine that fraudsters are deterred sometimes.
- nancyminusone 1y agoHow do you know they aren't one of the actual fraudsters or criminals?
- nancyminusone 1y agoPayPal also appears to suffer data leaks more than anyone else. I use multiple email addresses for every service I sign up for. But of all all the spam email I get, 99% has my PayPal email on it, and I even have other email addresses posted publicly.
- dkga 1y agoPerhaps those are not leaks, but outright data sales
- freedomben 1y agoExactly. They're not leaks, they're sales
- glenneroo 1y agoHappened to me with Moneybookers a few years ago. Started getting spam from various casinos at a unique email address. I contacted support and spent a few weeks explaining that, nobody could have gotten this email address unless they were hacked or willingly sold my address. After sending full dumps of the emails and a minor threat to go public with the information, suddenly the spam stopped.
- buckle8017 1y agoDidn't PayPal transmit the email to the merchant for every transaction? Merchants are definitely selling email lists.
- j_seigh 1y agoIt's worse than you think. I've closed PayPal accounts and opened new ones with a different email address and PayPal updates the merchants who've been spamming me with the new email address. There's no legitimate technical reason PayPal can't use a mail relay with transaction specific email addresses to control spam.
- hibikir 1y agoI never worked for PayPal, but I did for a competitor. Dealing with fraud is a red queen game: The fraudsters can keep trying until they find what gaps are there in your system, and will sometimes communicate with each other: Part of our defense system involved infiltrating some of those spaces and seeing the guides that were being sold to try to commit fraud in our platform. Meanwhile you will still have a false positive rate, and getting it all the way to zero means crazy fraud. Most people just don't get to see how much fraud is stopped before they know it exists. This isn't just for financial institutions: You'd be surprised by how much credential stuffing is attempted at, say, any very large streaming site which charges a subscription. Without looking in, it's hard for me to say exactly how successful their security team is, but being as big as they are, and having probably thousands of people whose only job is to do fraud on their platform, winning has to be pretty hard.
- freejazz 1y agoThe problem isn't the fraud, the problem is that they do not pay enough staff to deal with it which leads to legitimate accounts getting closed out and people not being able to do anything about it. Money seized, etc.
- calmbonsai 1y agoAmen.
- freejazz 1y agoIt's a constant theme with these internet companies. Oh Facebook is too big to police child predation on their platform? Am I supposed to be sorry about that? Whose fault could it be besides Facebook? They built it, the people came. Imagine running a Toys 'r' Us and telling parents that its not the store's fault that child predators loom in every corner... the notion that these business should not be held liable because of the principle that it would prevent them from scaling is an abomination on society.
- calmbonsai 1y ago
- yogorenapan 1y agoIndeed. And it's not a recent phenomenon either. I lost my first ever paycheck to PayPal randomly freezing my account. Was never able to get it back. Never used it again
- throw7 1y agoVenmos's security is also A++. I made an account, sent some money, then my account was immediately flagged and closed for fraud. Nice.
- tnolet 1y agoOff topic: Venmo does not exist (?) in Europe land. What’s its appeal compared to PayPal or regular credit cards or even debit?
- overdrive110 1y agoThe Nordic countries all have bank-backed apps for instant transfers from a checking account indexed by phone numbers. It basically replaces every peer to peer transaction that would be cash in other countries (paying back a friend, buying something at a flea market, chipping in for a gift at the office...)
- freetonik 1y agoIn Finland, bank-backed apps became less popular (and some even closed down), and MobilePay[1] became the most common way to send money around. I believe it's very similar to Venmo. 1. https://mobilepay.fi/ https://mobilepay.fi/
- mtmail 1y agoGerman, well West European, banks are slow in creating a competitor to Paypal, called Wero. https://en.wikipedia.org/wiki/Wero_(payment) https://en.wikipedia.org/wiki/Wero_(payment) I'm not implying they block Paypal because of that. It's good to have more competition and I wished my bank would take part.
- tietjens 1y agoThe product features sound nice. I'm all for anything that replaces Giropay.
- arianvanp 1y agoMostly German. The predecessor of Wero (iDeal) has been in use in The Netherlands for almost two decades. Nobody has credit cards here and everyone does online shopping with iDeal
- Cthulhu_ 1y agoTo add, on top of iDeal (I think they're on top anyway, they're digital payment whatsits anyway) there's an age verification system using a similar protocol - where a website gets a "yes this person is >18" signal, nothing else, from the user's bank. And there's "tikkie" (payment request), allowing people to request money through a link and people's own bank account - no need for everyone to use the same apps or services like paypal or cashapp.
- tchalla 1y ago> where a website gets a "yes this person is >18" signal, nothing else, from the user's bank. I am amazed on how this practical solution can't be implemented for age verification instead of all those ID uploads etc.
- mastermage 1y agoBecause legislators don't understand how the internet works. Thats like the biggest problem. IMHO.
- deleted 1y ago[deleted]
- hirako2000 1y agoWhat's so specific to German banks ?
- n1b0m 1y agoPayPal is the most important online payment service in the German market, with nearly 30% of online purchases made using the platform. The sheer volume of PayPal and direct debit transactions in Germany magnified the impact of the outage compared to other markets. With millions of potentially fraudulent debit requests appearing simultaneously, German banks chose to freeze all incoming PayPal direct debit payments. This was a necessary step to protect their customers from what appeared to be a massive, systemic fraud event.
- tgsovlerkhgsel 1y agoAlso protect themselves (or rather, PayPal's bank). These were almost certainly SEPA debits. Consumers could reverse unauthorized transactions (think "chargeback" but on steroids - customer says to revert, it gets reverted, no discussion) and their bank would then have to try to get the money from PayPal's bank, which would then have to get it back from PayPal.
- tomschwiha 1y agoI think the bank of the consumer is also completely automatically getting the money back. The risk is on the initiator if the payment (=PayPal).
- tgsovlerkhgsel 1y agoYes, I may not have described it well. The "try" only refers to "if the other bank is bankrupt, they get stuck with the loss" - they don't have to argue with the other bank. So unless PayPal's bank fails, it's a very simple process for the customer's bank. In general, the bank of the entity initiating the debit will only let someone initiate debits to the extent to which they'd be willing to give them a loan.
- 1y ago
- Terr_ 1y agoIn this case I think it's justified [0] to offer an alternate reporting: https://www.bbc.com/news/articles/cj6y42jggdyo https://www.bbc.com/news/articles/cj6y42jggdyo > European banks have seen widespread unauthorised direct debits from PayPal accounts, the German Savings Banks Association (DSGV) says. > The German newspaper Sueddeutsche Zeitung (SZ) says payments worth in the region of 10 billion euros (£8.6bn) have had to be blocked, after PayPal's fraud-checking system failed. [0] I was impeded by cookie popups and adblock/privacy-mode blockers in another language, and neither are direct reports or superior details.
- tietjens 1y agoYes, I agree. At the time this was the only English link I found. The BBC is much better, and it's a European issue. I cannot edit the link or title.
- altairprime 1y agoYou can email the mods and ask them to do so. Footer contact link and mention “FP #x” somewhere in the subject.
- hk__2 1y agoWhat’s "FP" for?
- buggymcbugfix 1y agofront page?
- Terr_ 1y agoMaybe, but it seems odd that someone would refer to a submission by a numeric ranking that changes constantly.
- 1y ago
- bouke 1y agoLast week the Dutch bank Bunq was also victim of unauthorised PayPal withdrawals: https://tweakers.net/nieuws/238190/bunq-neemt-maatregelen-tegen-ongeautoriseerde-afschrijvingen-via-paypal.html https://tweakers.net/nieuws/238190/bunq-neemt-maatregelen-te....
- m3kw9 1y agopaypal is trash, if you have issues, they can hold your payments or does whatever they want to you and you have very little recourse. They make up all the rules as "regulations". A lot of times there is no choice but to use them.
- heisenbit 1y agoIt is worth remembering that PayPal not only handles payments but also provides a degree of assurance to receive the goods. A pure payment system does not. From a customer perspective this can provide real value as filing a claim with PayPal gets merchants definitely to listen more closely.
- hulitu 1y ago> It is worth remembering that PayPal not only handles payments but It is _also_ worth remembering that PayPal not only handles payments but _also blocks acounts based on random issues_. A lot of people lost access to their Paypal accounts. /s Handle with care.
- account42 1y agoGP was talking about the assurance for buyers. The issues sellers face does not change what makes PP attractive to buyers.
- ta12653421 1y agoyou could integrate such a function easy in any other payment product flow
- Magi604 1y agoRecently I found out that one of my friends had his identity stolen, thousands and thousands drained from his bank accounts. After thorough investigation it was traced to a PayPal breach, and he had to fight hard to get them to admit it was their fault. He got everything back, eventually, but the whole process was a nightmare.
- baxtr 1y agoDo you know how this exactly went down? How can a PayPal breach result in money being stolen from a bank account? Genuinely interested to understand
- o11c 1y agoPayPal very strongly tries to make you give them your full bank info (remember that the banking system has absolutely no security as the computer world knows it - this is a feature required for checking to work - so this means anybody with access to your bank id numbers in PayPal's records can do arbitrary transactions to/from your bank account). When I last used it it was possible to avoid on the buyer end and just use a credit card, but I haven't used it for years and I think it was different on the seller end even then.
- majormajor 1y agoRouting and account numbers have been on every check written for decades. Banks usually aren't quite that naive to let anyone with the numbers transfer whatever they want. There's name validation they can do, but legally/contractually IIRC it's optional. So the numbers + a lot of social engineering skill can do damage. But I kinda suspect the ROI is higher for social engineering into an online account portal to Zelle a bunch of stuff around vs waiting for ACH transfers. Breach a login vs find an ACH list and transfer stuff out of the high-value accounts without triggering any flags (imagine you had access to that Paypal list - how are you trying to exfiltrate from millions of accounts without looking suspicious?).
- Magi604 1y agoI'll have to ask him for the details
- tpurves 1y agoArbitraging fraud has always been PayPal's game. For the mass market of small-scale sellers there's a threshold, whre the cost of onboarding, verifying, underwriting and eating fraud exposure is greater than the revenues you could ever expect to make from them at their low volume. So these segments went un-served, same with many other segments of transactions or transactors. PayPal's model has always been to accept a higher risk tolerance, then to have just-enough compensating controls and/or liability-dodging to make that work. At least just well enough to have net-revenues bps exceed their fraud-loss bps. And when that balance is working, it kinda works, but when it doesn't... And incidentally, it's not just PayPal with the fraud problems these days. It's everybody in the banking and payments space. AI is so far quite asymmetrically helping the bad guys more. It's bad out there.
- dev_l1x_be 1y agoEbay and Paypal are full of scam. Simply it is thei best interest to keep this up because it generates revenue for them.
- skybrian 1y agoThat's a simplistic way of understanding "best interest." The optimal amount of fraud is neither zero nor "let it all through." Their "best interest" is a balance between allowing legit transactions to get through and blocking enough fraudulent ones that fraud doesn't become too common.
- arn3n 1y agoI believe you’re referencing Patrick McKenzie’s takes on fraud, which I agree with — but when he (and others) talk about the optimal amount of fraud they’re usually referring to fraud from “losing money from the company to customers”. This is not PayPal’s case; because PayPal isn’t the victim of fraud on its platform but makes money off its use, their optimal amount of fraud is “as much as they can permit without losing customers or regulators getting up their ass”.
- 1y ago
- deleted 1y ago[deleted]
- awaymazdacx5 1y agoIn April the German state wanted 30,000 technocrats to use Libre Writer. [1]:https://blog.documentfoundation.org/blog/2024/04/04/german-state-moving-30000-pcs-to-libreoffice/ https://blog.documentfoundation.org/blog/2024/04/04/german-s...
- junto 1y agoSerious (aside) question. If you have MFA turned on then you’re safe enough right? I don’t use my account very much but sometimes it’s useful.
- sgbeal 1y ago> If you have MFA turned on then you’re safe enough right? Many of these payments (or would-be payments) are automated, so MFA doesn't play a role. i had automated payments get blocked yesterday for the first time ever and thought it was just my problem until seeing this thread.
- tick_tock_tick 1y agoIs PayPal common in Europe? I don't know anyone who still uses it in the USA.
- mr_mitm 1y agoYes. Im European. Everytime I'm out in a group and someone pays for everyone, they always ask for money via paypal, and I'm always the only one who doesn't have an account.
- tick_tock_tick 1y agoCrazy Venmo and Cashapp are all anyone in the USA uses for passing money to each other.
- chatmasta 1y agoTo be fair, Venmo is owned by PayPal...
- chatmasta 1y agoThis article is useless. It seems like an English translation of some German blogspam (and the ads are even making it through my filter). It says nothing other than PayPal is having some security failures and banks are blocking deposits from PayPal. What are these security failures? What is the mechanism of fraudulent activity that is being exploited? I’m surprised this was upvoted so much… am I missing something? It seems to be a bunch of words saying basically nothing.
- seb1204 1y agohttps://www.bbc.com/news/articles/cj6y42jggdyo https://www.bbc.com/news/articles/cj6y42jggdyo
- ryanjmo 1y agoLast week my PayPal account was "permanently disabled" this also happened to two of my friends at the same time. Is anyone else going through this right now? When I looked it up on Reddit it seemed like a widespread error that started last week. Could it be related to this? Are there any steps I should be taking to try to get my account back? Any help here would be really appreciated.
- TheJoeMan 1y agoI filed a dispute with Paypal that a merchant ran off with my money… Paypal nuked my account. No idea if the support agent hit the wrong button but I’m done with Paypal, no explanation or recourse. Filed dispute with bank on the Paypal charge and immediately got my money back.
- deleted 1y ago[deleted]
- yalogin 1y agoWow this headline is quite striking. I wonder what happened all of a sudden for their fraud checks to fail. This is exactly the kind of issues where we could use insight from some insider. I am somehow not super optimistic that PayPal will publicly respond to it
- amai 1y agoWhy do we use PayPal in Europe at all?
- schroeding 1y agoBecause what is the alternative, with the same level of convenience and support by (online) shops? Genuine question, because I do not know any and would be happy to. Wero is not supported by most shops (yet), Credit / Debit Cards often charge fees if the payment goes to a foreign country, direct transactions cannot be undone.
- robin_reala 1y agoTheoretically the alternative is whatever collection of local mobile payments EMPSA[1] manage to shackle together, but they’re taking an exceedingly long time to do it. [1] https://empsa.org/ https://empsa.org/
- xjrk58x 1y agoI got once my PayPal account blocked due to negative balance, but there was no transaction in the history and not even customer support was able to tell me why my account went to minus. They even sent me fairly threatening email and the whole process felt like a scam attempt. Later on I found out that it was due to a bounced transaction 3 months earlier, but the fee for bounced transaction was not reported anywhere and my PayPal account balance just got changed to -5 eur. I've closed my PayPal account directly right after this incident and never used PayPal again.
- Nekorosu 1y agoI'm a victim of such a fraud. It started gently on LinkedIn and ended up on http://fiverr.com http://fiverr.com that exploits PayPal to extract money from unsuspecting clients. I paid for CV editing service that was never provided. 60 euros gone and PayPal just accepts sellers side of the story. http://fiverr.com http://fiverr.com is a scam. Don't use it. PayPal's support is a joke.
- selinkocalar 1y agoThis is exactly why compliance frameworks exist. When your security controls fail, it doesn't just affect you - it ripples through every organization that trusts you. German banks are right to be concerned. PayPal processes massive amounts of financial data, and if their security posture is compromised, everyone downstream is at risk. The real test of any security program isn't whether incidents happen - it's how quickly you detect them, contain them, and communicate with affected parties.