6 ms·
To my knowledge they don't know who the thief is. The thief allegedly got the last 4 digits of the CC by posing as an employee.[0] If true, it would mean payp
by bushido 13y ago
To my knowledge they don't know who the thief is.
The thief allegedly got the last 4 digits of the CC by posing as an employee.[0]
If true, it would mean paypal gave out financial information to an unknown third-party, which would be a breach of a bunch of laws, terms, internal policies etc.
The burden to prove innocence in this situation would definitely fall on paypal.
Excerpts from the original article[0]:
>I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone)
>Yes paypal told me them over the phone (I was acting as an employee) and godaddy let me “guess” for the first two digits of the card
[0] https://medium.com/p/24eb09e026dd https://medium.com/p/24eb09e026dd
[1] https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532
- dec0dedab0de 13y agoI dislike paypal as much as anyone, but since when does anyone have to prove innocence?
- bushido 13y agoWhen you are a financial company. edit: financial companies, or any company when dealing with a financial or privacy breach usually needs to prove their innocence when they are attributed to allegedly causing financial loss (to varied extents depending on the situation). This is an expectation from society in general. It may not seem fair or be legally required, but that's just the way it is.
- jessedhillon 13y agoYou need a course in elementary logic. Specifically, on the burden of proof. Also, everything you wrote in this comment here seems to be a complete fabrication.
- simonh 13y agoI work for a bank and it's absolutely on us to show that our transactions and treatment of financial information is verifiable. We have to be able to demonstrate due diligence, there is no assumption of innocence when the auditors come knocking on the door, whatever 'elementary logic' may say. Thats why I completely believe the posters here claiming this wouldn't be possible in a banks call centre. What I don't know is whether PayPal operates at the same standard.
- jessedhillon 13y agoThat's a different question altogether. Banks are required to keep meticulous and auditable transaction records -- nobody is disputing that or even questioning if PayPal does so. Banks are not required to show extend themselves to whatever demands made to them, in order to show that the claims of a random internet person are false.
- scott_s 13y agoLegally, no. But if enough people find the claim credible, then it is definitely in their best interest to convince everyone else that the claim is false. Whether or not you think that is fair is irrelevant; if enough people feel the bank is not safe to use, the bank will lose business.
- jessedhillon 13y agoOk well if that's your hand, the converse principle is more pertinent -- if it has no impact on profits, nobody cares about the random rantings of an insular group of technologists, and how they think PayPal ought to conduct itself.
- pessimizer 13y agoThe 'burden of proof' is a social/legal concept which has absolutely nothing to do with elementary logic, so maybe you're the one that needs the refresher.
- DerpDerpDerp 13y agoSince there is apparent evidence against their innocence?
- unreal37 13y agoWhat evidence? The chat transcript of a thief?
- altero 13y agoSince ever? For example anti-harassment law...
- fat0wl 13y agowhen there is a believable story about them getting socially hacked & they have a sea of clients they are trying not to lose...