Hacker News new | past | comments | ask | show | jobs | submit login
Paypal's fraud prevention routine does it again (scottishrubyconference.com)
189 points by rahoulb on Feb 2, 2011 | hide | past | favorite | 88 comments



I love the fact that people with no authority and no respect for privacy whatsoever arbitrarily just ask for bank statements from their customers. I have had estate agents ask for 6 months of bank statements for no apparent reason and when I declined they got furious with my insubordination. This was on top of a written / signed letter from my direct boss with regards to my salary and job status.

My bank statements = none of your business


Just to clarify, they don't want to see your bank statement, they want to see the covering sheet that verifies who you are and the address you're at. I had to provide my "bank statement" to Paypal a year or so ago and all I provided was the sheet that states my account # (they have this already) my address (they have this too) and then my banks information (sort code etc) which I don't think is private?

Your bank statement = covering sheet that proves the account is associated with you and your address, not x months of payments made and taken.


Maybe so, but since they didn't in any conceivable reading of the phrase "bank statement" make that clear, I think ffffruit's point stands.


That "none of your business" bit may or may not be true, depending on your local regulations and the loan you're applying for.

As an example, for the US, see http://www.ehow.com/facts_5155455_fha-mortgage-borrower-requ... for a situation in which the bank must see two months of bank statements from a borrower in order to be able to offer them a particular kind of loan (FHA-subsidized in this case). There are similar requirements in the US for larger loans that were imposed in the wake of the subprime stuff a few years back (e.g. at least as of a year ago mortgages at certain rates and certain mortgage amounts required a certain fraction of the purchase price in liquid assets remaining _after_ making the downpayment to qualify for the loan).

Apart from all that, your assets are insurance against you losing your job (for both you and the lender!), which is why underwriting wants to know about them. If there's no legal requirement for them to know, you don't have to give it to them, of course. And just as of course they may choose not to underwrite the loan at the particular rate you want in that situation, because they can't evaluate the risk.


I agree with what you are saying here and I believe there are similar regulations in the UK for loan applications. But remember: I am _renting_ a room in a house, not buying anything or borrowing any money. You also put down a 1 1/2 months of rent as a safety deposit.


I hate to come across as the pedant (since I agree totally with what you are saying), but to clarify a point: you were not guilty of insubordination, since you were not a subordinate of the estate agent (well unless you worked for them, in which case you would have been).


I hate to come across as even more of a pedant, but I think that that was specifically the reason he chose that word; he was using 'insubordination' as a rhetorical device to describe the way he feels about his relationship with the agent, even if it's not literally true.

<3


Exactly, thank you.


I have no sympathy for Paypal -- every time I've dealt with them it's been like talking to a robot -- but in all fairness they do something that's really hard. Can you imagine the number of people who are either trying to rip Paypal off or are using Paypal to rip other people off? I'm left thinking the only reason Paypal works is because the founders were too stupid to realize what they were getting into. (Although if you've never read it, they have a great startup story)

The thing that's especially onerous here is the fact that they keep screwing with the same customer the same way over and over again. I agree with the author of the post -- that's just too much crap for too little return.


Yes, just look at Western Union for a service that has a long history whose reputation has been practically destroyed by scammers.


I used WU's online service for a while. Then for no apparent reason it locked me out, and I've been able to figure out who to kick to get back in.

Possibly ironically, this has resulted in me falling back to my backup payment sending approach - paypal.


History of PayPal

The current incarnation of PayPal is the result of a March 2000 merger between Confinity and X.com. Confinity was initially as a Palm Pilot payments and cryptography company. X.com was founded as an Internet financial services company. Both Confinity and X.com launched their websites in late 1999. Both companies were located on University Avenue in Palo Alto. Confinity's website was initially focused on reconciling beamed payments from Palm Pilots with email payments as a feature and X.com's website initially featured financial services with email payments as a feature.

More at http://en.wikipedia.org/wiki/PayPal#History


I'm left thinking the only reason Paypal works is because the founders were too stupid to realize what they were getting into.

I'm not usually one for mantras, however "stay hungry, stay foolish" comes to mind.


I somehow doubt the likes of Thiel, Levchin and the other early Paypal folks were 'stupid'. But then, they really didn't have to run it for a long period of time at eBay so maybe one has to question what eBay was thinking.


"The Startup Wars" is pretty excellent.


This has just happened to me with my new business that saw exponential growth from the previous month. They asked me for all information within 2 days, from Friday, so basically they wanted me to work over my weekend.

Which I sent to them, and then they say that they'll follow up and it's been like 4 days. What pisses me off, is that they don't return the same courtesy / haste that they expect from us.


I have found the only real solution to this is to make merry hell for a couple of days until it becomes easier for them to fix it than leave it.

I got down to half hourly emails to the customer services manager "in charge of my case", but was ultimately worth it.


I'll give them one more day ;)


Got a reply just then. They told me, and I quote:

"Stella is out of office recent days for holiday. She will follow up the investigation of your account when she comes back."


^ Can't reply to your post, but I'll just do it here.

Of course, I told them that asking prompt replies, especially on non business days (with the threat of limitation) was unacceptable if the same courtesy was not going to be returned, and asked someone else take over.


> ^ Can't reply to your post, but I'll just do it here.

To prevent too much back and forth, the 'reply' button disappears, but if you click on 'link' to go to the page directly, you should still be able to reply anyway.


I like how they didn't say when she was coming back.

I hope you e-mailed them back, told them this was unacceptable, and asked to be transferred to someone who is actually there.


Four years and having the account frozen every time? Those organisers must either be very patient or desperate to use paypal. Why wouldn't other payment processors work; like Moneybookers, Wepay, or bank transfers, etc?


The short version? Accepting payments internationally is effing hard and effing expensive and the risk of fraud and other illegal activities is astronomical. Paypal does it head and tails better than any other organization.


I do agree. But I feel this complaint is different to the "I started making money and Paypal suspended my account" complaints that are normally posted.

It's the repeat nature - asking for the same documentation over and over again - that's so annoying here.


It's not really repeat nature. It's the same account, but it's for a short period of time each year which would seem suspicious to me, when they claim it's a conference they say the following:

"4/ Our bank statements are none of your business. 5/ The details of our venue agreement and insurance are also none of your business."

So they're refusing to prove it's a conference but requesting that Paypal are "reasonable"? Having your account verified once and then go dormant in payment receipt for the majority of the year then start again would seem suspicious to me... especially when their justification isn't something they're willing to prove.


Well I can't speak for the organisers, I'm just someone who attends.

But they have proved that they are a conference for the same dates for the previous three years.

And the implication is that Paypal are asking for more documentation than previous years ("the documentation you are asking for this year...").


What guarantees are paypal offering on handling their bank statements?

Even assuming paypal aren't crooks - is doing this OK with the Scottish Data Protection Act, Charities commission or Company registration?


What do people think of google checkout? Do they have a better record of not pulling this shit?


Supports a smaller number of countries for payments than Paypal, very few countries can be account holders who take money (eg: you can pay via GC from Sweden, but you can't be Swedish and take money via Google Checkout) and Google don't have a history of customer service, do they? :p


I've actually had worse customer support with GC (who froze our account with 30k with no support phone line to call) than Paypal (their phone lines are up until 11pm PT).


Every time I read an article like this, I wonder again: Why is no one competing with PayPal? People talk about sites like Google Checkout or WePay, but they are not viable alternatives, either because of different fee structures, international availability or other issues. Is PayPal doing something so hard that none of the incredibly talented and intelligent people in the startup world feel capable of challenging them? I feel like anyone who can replicate the right subset of their features (to start with) and guarantee good customer service would instantly have tens of thousands of jilted PayPal customers signing up. "PayGuys: We're Not PayPal". From zero to hero. Am I crazy?


In short, yes. A friend of mine was head of corporate strategy at Paypal. As of 2007, they had spent $300M dealing with fraud. We had a lot of talks on this subject when I was working for a startup providing anonymous credit cards for online shopping.


They'd be able to deal with fraud much more effectively (and cheaply) if they weren't so busy asking the same legitimate customers for the same information year after year. Yes, the job may be hard, but they're apparently also disorganized and incompetent.


    alter table accounts
        add column confirmed_not_a_fraudster boolean
            not null
            default false;


Remembering that the account owner is not himself a fraudster is not the same thing as verifying that the account hasn't been compromised and is now being used fraudulently.

(Granted that the OP's questions seemed to focus on the former, rather than the latter)


Oh snap, you have just saved Paypal millions of dollars and cut several jobs at their fraud desk.


I totally agree with you. It shouldn't be hard for Paypal to get better (and I don't understand why they don't), but to make something new that is better is a far more difficult proposition.


I'm certain (non-sarcastically) that fraud is a Hard Problem. But it's not so Hard that Paypal doesn't make money; why do you claim it isn't possible for somebody to solve the same Hard problem but have non-atrocious customer service?


Paypal lost millions of dollars every month to fraud in the beginning. Not a lot of companies can afford to loose thousands of dollars let alone millions.


I don't think it is impossible, just very, very hard (and expensive), made worse by having an entrenched incumbent who has very deep pockets.


Why is no one competing with PayPal? Because these stories are the exception, not the rule. PayPal has posed absolutely no problems to our business since we adopted it early last year. I feel like a total idiot for drinking teh internet kool-aid and boycotting them for so long.


I've depended on them (with Moneybookers backup) for about seven years now, with no problems once the original setup was all taken care of. I had slow but steady growth from just a few payers, though (translation agencies) - things would probably have gone differently had I had explosive growth of small amounts from a wide variety of payers.

Also: have a US bank and stick with it. If you leave the US, don't tell your bank! (I've had the same account since the 80's - it's gone through four banks now - and that might also be one factor in my looking stable.)

One of my agencies is a lady who did a round-the-world trip over two years, getting back a year ago. PayPal locked her payments - every time - while she was in Africa.


I do 6 figures a year through PayPal, and my account is now over 10 years old. It's never once been locked/frozen/restricted.


Mine has been locked for nearly 10years

I signed up when it was only available in the US now it's avialable in Scotland I tried to register for the UK version. You can't register for the UK cos you have a US account, you can't use the US account with a UK credit card. I asked them to delete the US account and it's now stuck in some sort of Limbo where I can't open a UK account cos I have the US one, and I can't log into the US one because it's been deleted. Once a year I spend a few days emailing them to try and sort it out.


only a year... yeah that's about right.. you should be due for a business-crippling lockout by paypal any time now.


Most of the ones I've read about come much sooner...are you neck-talking, or do you have something to cite?


personal experience


Ok then. My experience is we process hundreds of successful transactions per month, get about 1 complaint every other month, and 1 chargeback about every 3-4 months. They do impound fees on any dispute or chargeback, but I would hardly call it business crippling. Certainly less severe than our merchant account which has a higher chargeback fee than PayPal, and also PayPal doesn't charge for customer disputes. Also PayPal has ruled against every customer who filed a complaint about delivery once we showed proof of delivery (not a signature). Our merchant bank has screwed us every single time there is a chargeback over non-delivery, even when we fax them a copy of the recipient's signature.

In short, I can't wait to get the "delete merchant bank/switch all processing to PayPal" task to the top of my to do list.

PayPal has never required us to leave a reserve amount in our account. I believe that is due to our low complaint/chargeback rate.


> Why is no one competing with PayPal?

Go raise yourself 20-50 mil in VC money, then get several suites of legal types. PayPal has licenses in (by my count) 42 states. To operate in foreign countries, I'm sure the issues become much more involved. This isn't a matter of writing some cool code and getting server space somewhere.

https://www.paypal-media.com/licenses (which for me Safari is unhappy about the certificate for some odd reason)


We're trying (http://www.facecash.com). It's hard to raise funding to do something serious, and the government regulations presently in place require a lot of funding to comply with.

http://www.huffingtonpost.com/aaron-greenspan/a-public-comme...


I really like your idea, but it doesn't really look like something to hook up to my web app and accept payments.


Very interesting idea. Is there any way I can be notified when you get some merchants in the Baltimore/DC area? Or maybe when you get that far, it'll be on HN...


The best way is to sign up. We won't spam you but you'll at least be able to try it out when merchants are available nearby.


Payment services start with an incredibly trivial base requirement: track an integer for every account, let an account decrease its integer and increase the integer for another specified account, and convert between some other payment mechanism and your integer. Sounds like the kind of thing you could put together with a web framework and an afternoon, and then just spend a pile of time and/or money marketing it so people will use it.

Now add the invasive requirements of various governments to track the movement of money (formerly to "fight organized crime and money laundering", later to "combat the funding of terrorism"). All of a sudden an incredibly trivial problem requires piles of lawyers, legal research, logging, information collection from account holders, information verification, responding to "requests" for information, shipping around physical paperwork, and generally dealing with a pile of stuff that should have nothing to do with a payment system.

On top of that, even if you don't want to deal with issues of fraud (hey, cash doesn't), the various other payment services you'll have to deal with to get money into and out of your account still have piles of ways to screw you with it. If you take credit cards, cardholders will do chargebacks to take money back from you. If you take other Internet payment services, you get to deal with the issues raised in this article just like any other merchant. Most people don't want to trust a new payment service with a bank transfer right away. If you accept mailed or scanned checks you'll probably have to deal with check fraud. And without a physical presence and giant piles of extra money you can't convert to and from cash.

Oh, and if you want to make a service as close to cash-equivalent as possible despite all these requirements, then the first time your service transfers money for some notable illegal or questionable operation, you'll probably get shut down over one of the details you missed, which would probably get overlooked if you operated just like every other "financial institution".


And here I am about to launch a service on Thursday with PayPal as my payment processor. I didn't really want to, but for my customers it's basically a requirement.

I'm expecting to take about £2k in the first few days, so I'm almost certain the account will be limited; I've preemptively supplied most of the info listed in this article to try to mitigate that.

I'll be sure to update HN on what happens.


Note that when your account gets limited, your customers get an email which basically says that you are suspicious, and you can't accept any new payment until you get it fixed. I highly recommend that you DON'T launch with paypal unless you have all the documentation sorted out. And no, I don't know what you should do exactly.


>"DON'T launch with paypal unless you have all the documentation sorted out"

That is the problem. It appears to be impossible to know in advance whether your documentation is sorted out.

Even if PayPal had a 'how to not get locked out and look like a shady operator' HOWTO somewhere on their site the situation would be more acceptable but right now it seems people have to live their life with the (vain?) hope that their capricious payment-processing overlord will continue to smile upon them.


But when I click to register for this conference, they're using Paypal as their sole processor.

So what's the point? Complain all you want, you're still using Paypal THIS YEAR, after being screwed over 4 years in a row. When push came to shove, you picked.... Paypal.... to process your payments. So by your own actions, you've shown you think Paypal is the best processor available.


They're using http://www.stagehq.com/ this year for managing tickets. Currently the only payment gateway they support is Paypal.


It would be great for a bunch of small companies and 501c3s who have been affected by this to file a complaint with the FTC and state Attorneys General. At the very least, it could get some higher-profile media attention to this long-standing pattern of abuse. And with luck, somebody will decide to investigate ...


I had someone sign up for a subscription, 1 payment each week for 6 weeks. After the 3rd it stopped charging the client. It was just frozen, saying the next payment was due to be taken out of their account on a date that past 6 days ago.

So contacted support and their reply was, well how do we know they actually subscribed.

Well I don't know, maybe they could have looked at their records and seen the IP address and paypal account associated with the subscription with their attached bank accounts and credit cards.

Paypal is great when it works but when something goes wrong it really goes wrong and support just doesn't help.

Anyway, I use a proper merchant now for CC payments. I will most likely implement PayPal once again but just as an option and right at the bottom of the list.


That leading quote is great:

Sufficiently advanced incompetence is indistinguishable from malice.

-- Clark’s law


Not to white knight Paypal, but selling tickets is a highly fraud risky payment event (opposed to just selling stuff). It has a high number of chargebacks due to possible event cancellation, people not showing up, or people just not liking the event. You would most likely be required to send this paperwork for each event to most any credit processor.

Typically I've found that with Paypal there's no immediate cost of entry (just start accepting payments) but paperwork is required over a certain threashold. But try to use any regular credit processor, they'll require your paperwork done in advance, and since you're doing an event with tickets, it might take a few applications until you find one with decent rates who will accept your risk.


So when's the next PayPal going to take over? This is a company that had a great idea a long time ago and a whole bunch of terrible ones since. It needs to go away now, and we need a company that does what they do better.


Paypal is horrible (We had this happen so many times...) and there are many cases where they simply stole money without giving reasons or ability to dispute without going to court against a giant, but it's just not possible to go for a competitor, because that would cost you too much sales from clients who don't have/want to use a competitor. And a lot of Europeans at least don't want to use their CC online.

We tried AlertPay which works fine, but the fees are too high, still, they seem a good alternative if you want something that just works for now.


So, does someone have a solution for setting up a US merchant account from a foreign country for the best choice of merchant fees and service providers to bill through?

I hate all these "don't use PayPal" comments but even for first-world countries like Australia, setting up a merchant facility that can accept foreign currencies is really, really hard and very expensive.


They should really use http://WePay.com.


Somebody has to mention it so I might as well: WePay is not available in Scotland.

https://www.wepay.com/about/faq#thirteen


Touché


Not until people in Europe can use it.

Its a Scottish conference.


Loads of online services (esp. to do with money) are only available to USAians. :(


And it's a crying shame how many Americans aren't aware of that.


WePay is so limited in it's scope at the moment (US only, events / fundraising only) that it's usually not applicable as a PayPal replacement. If someone wants to replace PayPal, they just need to copy all the functionality / features but not be so annoying.


Which leaves me wondering: Why is there no credible alternative to PayPal? I would have thought that there would be plenty of money in this kind of business given the fees PayPal is able to charge. Although I imagine that it's a very difficult service to provide well and to provide internationally at the scale PayPal does.

(The historical UK alternative to PayPal is Nochex, of which a cursory Google search also reveals plenty of dissatisfied customers).


because taking money as everyone else has mentioned is covered in fraud, which is why Paypal "suck" and why there are no competitors. It's a miracle Paypal exist and for all their flaws, the service they do offer (international, open to almost everyone) is great. Most people don't seem to realise the people who do have problems are a tiny minority of all customers.

If someone screws over a Paypal customer, it's Paypal who have to swallow the loss. Can't really criticise them for the way they act when it's their bottom line that gets affected.


No, I've gotten burned twice by a Paypal transaction, but in both cases while I won the battle (dispute) I lost the war because both account holders took out the money from their accounts.

In one case I was able to find the guys new Paypal account, but they refused to go after him.

Agree that Paypal has a lot of challenges to run their business, but I disagree that the bulk of risk is being taken by them...


I think, as patio11 states above, it's because it's very hard to do without losing money to fraud hand over fist.

It's also why Apple/iTunes is so important and why the mobile carriers should be rubbing their hands with glee (if they had any sense).


The problem is that there is not plenty of money in smaller countries, which are generally just as hard to set up as large countries. So any new service will have limited scope.


There are a number of payment processors out there that do a better job than PayPal, but none of them is able to match the international reach they have.

If you need international payments and you don't want to be credit card only then PayPal more or less is the only option. (in many countries credit cards are not nearly as common as in the US)


This is the fourth year that we have run this conference, and every year PayPal have restricted our account.

"I keep hitting myself with this hammer, but it keeps hurting! What am I doing wrong!?"


Forget Paypal! I'd be MORE inclined to support an organization/product if I saw that they'd opted out of using their service.

At least until they change their policies. They seem so arbitrary sometimes.


That's not feasible in most situations.


Maybe not, but it would be nice to see.


For me, Paypal is simply a no go. If Paypal is the only way to pay, then there is no way to pay. (But there are still bank accounts and credit cards).


These fuckers do this to us every year as well. Seasonal business also. They seriously asked us to fax them our URL. Assholes.


Here's waiting anxiously for Bitcoin to put these guys out of business.


Trick me once, shame on you. Trick me twice, shame on me.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: