30 ms·

In a hearsay battle between Paypal and a thief, why is the burden on PayPal to prove its innocence?

by freerobby 13y ago

shrooms 13y ago
Because Paypal has a history of being full of shit.
- 1angryhacker 13y ago
  that's not a reason to convict without evidence. if paypal is so shit why is everyone using them. vote with your feet
  - zamalek 13y ago
    We aren't convicting them here - this isn't a court. It's just pointing out that, once again, as always: PayPal Not only did they screw up; but they also can't man up, tell the truth and be transparent - as usual. Shit happens. Slamming us with a denial that shit happened is implying that you aren't going to do anything about it; admitting it is a clear statement that you are not proud of it and will work to make sure it never happens again. It's come to the point where if someone said that PayPal are responsible for climate change; I would be inclined to believe them. No matter how much they denied it.
    - jessedhillon 13y ago
      In other words you're prejudiced and see no reason to logically validate your preconceptions? Great, that's what we need. More people commenting who have all the answers. What if PayPal were telling the truth, how exactly would that situation look different than the one we are in? Good thing PayPal's always wrong though!
      - orclev 13y ago
        It's more like extrapolation from a known set of data points. PayPal has a certain history. You can look up what's gone down in the past, and based on that, the accusations fall right in line with the sorts of things PayPal has historically done. At this point it seems far more likely that PayPal did in fact do what it's accused of than that it didn't. If PayPal is in fact telling the truth (and that's a big if), then the question becomes where did the hacker get the last 4 of the CC from? GoDaddy has confirmed the hacker had a large amount of info, including presumably the last 4 of the CC when he called them, so somewhere in this whole thing someone gave that data away.
        jessedhillon 13y ago
        ...the question becomes where did the hacker get the last 4 of the CC from? That's always been the question. Until you know better, what you have is a situation where you're believing the word of an anonymous criminal, relayed to you second-hand, over PayPal. I'm just saying you have no evidence either way at this point, and are simply expressing your preconceptions, which are not helpful.
        fat0wl 13y ago
        (I can't reply to jessedhillon's follow-up comment yet & i don't want to wait so I'll just reply here....) If you look as far as... oh say, the top of this thread on HN, you will hear accounts from people who have apparently done this very thing (asking PayPal for last 4 digits and gotten an answer). So it seems like their policy did not forbid it, anyone could do it, so why not believe the hacker's claim? You can't have a policy of routinely giving out certain info then deny that you gave it out in a case where it caused a security breach. What is the defense there? "Well yeah ordinarily we DO give that out but we could tell this guy was a hacker so we didn't." Yeah, they wish. If they regularly give out last 4 digits, then the claim that they didn't in this case is absurd.
        zamalek 13y ago
        > It's more like extrapolation from a known set of data points. PayPal has a certain history. Exactly, the child who cried "wolf."
- Torn 13y ago
  @1angryhacker - they're the only game in town for a lot of people, notably ebay sellers and users. More tech-savvy sellers know to diversify or to use other payment gateways (amazon, google, etc) but paypal has a huge userbase of average internet users.
bushido 13y ago
To my knowledge they don't know who the thief is. The thief allegedly got the last 4 digits of the CC by posing as an employee.[0] If true, it would mean paypal gave out financial information to an unknown third-party, which would be a breach of a bunch of laws, terms, internal policies etc. The burden to prove innocence in this situation would definitely fall on paypal. Excerpts from the original article[0]: >I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone) >Yes paypal told me them over the phone (I was acting as an employee) and godaddy let me “guess” for the first two digits of the card [0] https://medium.com/p/24eb09e026dd https://medium.com/p/24eb09e026dd [1] https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532
- dec0dedab0de 13y ago
  I dislike paypal as much as anyone, but since when does anyone have to prove innocence?
  - bushido 13y ago
    When you are a financial company. edit: financial companies, or any company when dealing with a financial or privacy breach usually needs to prove their innocence when they are attributed to allegedly causing financial loss (to varied extents depending on the situation). This is an expectation from society in general. It may not seem fair or be legally required, but that's just the way it is.
    - jessedhillon 13y ago
      You need a course in elementary logic. Specifically, on the burden of proof. Also, everything you wrote in this comment here seems to be a complete fabrication.
      - simonh 13y ago
        I work for a bank and it's absolutely on us to show that our transactions and treatment of financial information is verifiable. We have to be able to demonstrate due diligence, there is no assumption of innocence when the auditors come knocking on the door, whatever 'elementary logic' may say. Thats why I completely believe the posters here claiming this wouldn't be possible in a banks call centre. What I don't know is whether PayPal operates at the same standard.
glanotte 13y ago
I would tend to agree with you, but paypal was emphatic that they _did not_ (emphasis theirs) release anything. There is a difference between not finding evidence and saying as such, "We could find no evidence that that one of our employees failed to follow correct and established procedures". If they had said that, I would be more inclined to let them go. I believe that they placed the burden of proof on themselves by coming out with such a firm statement.
taude 13y ago
Because 1) they likely have the actual recording on file 2) they are the service company that wants to convince us to continue using them.
phaus 13y ago
Its partly because PayPal's reputation precedes it. Paypal is a shitty company with often scummy policies. They also have a demonstrated history of employees making horrible decisions. If PayPal didn't do anything wrong, they would probably be far more eager to provide their customer with assistance. In their initial communication they should have volunteered whether or not there is a recording of any conversation they may have had with the attacker. If there is a recording, they should have immediately volunteered to play it back for the victim in order to give him peace of mind. That's basic customer service.
at-fates-hands 13y ago
They're not, they're just covering their own asses.
baddox 13y ago
Because the thief actually did acquire the last 4 digits of the credit card number, and there is plenty of anecdotal evidence that their techs can and will give out the last 4 digits of credit card numbers.
scott_s 13y ago
Because there are three parties here, not two: PayPal, the thief, and all real and potential customers of PayPal. PayPal has no obligation to convince the thief that they are innocent. But if they want to retain business, they must convince all of their current and future customers that they are innocent.

In a hearsay battle between Paypal and a thief, why is the burden on PayPal to prove its innocence?

shrooms 13y ago

Because Paypal has a history of being full of shit.

1angryhacker 13y ago
that's not a reason to convict without evidence. if paypal is so shit why is everyone using them. vote with your feet
- zamalek 13y ago
  We aren't convicting them here - this isn't a court. It's just pointing out that, once again, as always: PayPal Not only did they screw up; but they also can't man up, tell the truth and be transparent - as usual. Shit happens. Slamming us with a denial that shit happened is implying that you aren't going to do anything about it; admitting it is a clear statement that you are not proud of it and will work to make sure it never happens again. It's come to the point where if someone said that PayPal are responsible for climate change; I would be inclined to believe them. No matter how much they denied it.
  - jessedhillon 13y ago
    In other words you're prejudiced and see no reason to logically validate your preconceptions? Great, that's what we need. More people commenting who have all the answers. What if PayPal were telling the truth, how exactly would that situation look different than the one we are in? Good thing PayPal's always wrong though!
    - orclev 13y ago
      It's more like extrapolation from a known set of data points. PayPal has a certain history. You can look up what's gone down in the past, and based on that, the accusations fall right in line with the sorts of things PayPal has historically done. At this point it seems far more likely that PayPal did in fact do what it's accused of than that it didn't. If PayPal is in fact telling the truth (and that's a big if), then the question becomes where did the hacker get the last 4 of the CC from? GoDaddy has confirmed the hacker had a large amount of info, including presumably the last 4 of the CC when he called them, so somewhere in this whole thing someone gave that data away.
      - jessedhillon 13y ago
        ...the question becomes where did the hacker get the last 4 of the CC from? That's always been the question. Until you know better, what you have is a situation where you're believing the word of an anonymous criminal, relayed to you second-hand, over PayPal. I'm just saying you have no evidence either way at this point, and are simply expressing your preconceptions, which are not helpful.
      - fat0wl 13y ago
        (I can't reply to jessedhillon's follow-up comment yet & i don't want to wait so I'll just reply here....) If you look as far as... oh say, the top of this thread on HN, you will hear accounts from people who have apparently done this very thing (asking PayPal for last 4 digits and gotten an answer). So it seems like their policy did not forbid it, anyone could do it, so why not believe the hacker's claim? You can't have a policy of routinely giving out certain info then deny that you gave it out in a case where it caused a security breach. What is the defense there? "Well yeah ordinarily we DO give that out but we could tell this guy was a hacker so we didn't." Yeah, they wish. If they regularly give out last 4 digits, then the claim that they didn't in this case is absurd.
      - zamalek 13y ago
        > It's more like extrapolation from a known set of data points. PayPal has a certain history. Exactly, the child who cried "wolf."
Torn 13y ago
@1angryhacker - they're the only game in town for a lot of people, notably ebay sellers and users. More tech-savvy sellers know to diversify or to use other payment gateways (amazon, google, etc) but paypal has a huge userbase of average internet users.

bushido 13y ago

To my knowledge they don't know who the thief is. The thief allegedly got the last 4 digits of the CC by posing as an employee.[0] If true, it would mean paypal gave out financial information to an unknown third-party, which would be a breach of a bunch of laws, terms, internal policies etc. The burden to prove innocence in this situation would definitely fall on paypal. Excerpts from the original article[0]: >I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone) >Yes paypal told me them over the phone (I was acting as an employee) and godaddy let me “guess” for the first two digits of the card [0] https://medium.com/p/24eb09e026dd https://medium.com/p/24eb09e026dd [1] https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532

dec0dedab0de 13y ago
I dislike paypal as much as anyone, but since when does anyone have to prove innocence?
- bushido 13y ago
  When you are a financial company. edit: financial companies, or any company when dealing with a financial or privacy breach usually needs to prove their innocence when they are attributed to allegedly causing financial loss (to varied extents depending on the situation). This is an expectation from society in general. It may not seem fair or be legally required, but that's just the way it is.
  - jessedhillon 13y ago
    You need a course in elementary logic. Specifically, on the burden of proof. Also, everything you wrote in this comment here seems to be a complete fabrication.
    - simonh 13y ago
      I work for a bank and it's absolutely on us to show that our transactions and treatment of financial information is verifiable. We have to be able to demonstrate due diligence, there is no assumption of innocence when the auditors come knocking on the door, whatever 'elementary logic' may say. Thats why I completely believe the posters here claiming this wouldn't be possible in a banks call centre. What I don't know is whether PayPal operates at the same standard.

glanotte 13y ago

I would tend to agree with you, but paypal was emphatic that they _did not_ (emphasis theirs) release anything. There is a difference between not finding evidence and saying as such, "We could find no evidence that that one of our employees failed to follow correct and established procedures". If they had said that, I would be more inclined to let them go. I believe that they placed the burden of proof on themselves by coming out with such a firm statement.

taude 13y ago

Because 1) they likely have the actual recording on file 2) they are the service company that wants to convince us to continue using them.

phaus 13y ago

Its partly because PayPal's reputation precedes it. Paypal is a shitty company with often scummy policies. They also have a demonstrated history of employees making horrible decisions. If PayPal didn't do anything wrong, they would probably be far more eager to provide their customer with assistance. In their initial communication they should have volunteered whether or not there is a recording of any conversation they may have had with the attacker. If there is a recording, they should have immediately volunteered to play it back for the victim in order to give him peace of mind. That's basic customer service.

at-fates-hands 13y ago

They're not, they're just covering their own asses.

baddox 13y ago

Because the thief actually did acquire the last 4 digits of the credit card number, and there is plenty of anecdotal evidence that their techs can and will give out the last 4 digits of credit card numbers.

scott_s 13y ago

Because there are three parties here, not two: PayPal, the thief, and all real and potential customers of PayPal. PayPal has no obligation to convince the thief that they are innocent. But if they want to retain business, they must convince all of their current and future customers that they are innocent.