PayPal and zero-dollar invoice spam | Hacker News Reader

PayPal and zero-dollar invoice spam

troyhunt.com

160 pointstemp71 comments

PayPal employee here (and I'm hiring Node.js developers :P ).

I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix.

The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our product worse for our many legitimate customers by going too far in trying to stop this spam.

Don't know if you can answer this: Why can I venmo people money instantly and paypal holds my money for days or weeks at a time?

Holding onto funds is how you mitigate risk as a bank or money transmitter.

Do you think they're running loads of security tests all the while or something? I'd imagine a majority (if not all) of the checks are done up front- especially given it's 2015.

Pretty sure they get a nice bump on their balance sheet for cash "in-transit" - and keeping the timeframe to 3-5 business days only magnifies that effect.

It's not about balance sheets, it's about having time to cope with any unexpected problems with the transaction, like fraud.

It's frustrating, and ideally not necessary, but it's essentially a safety net for the middle party.

You can not venmo money instantly. The UI makes it seem that way, but it takes a few days for payment to process and as such, Venmo has become a target for scams: http://time.com/money/4036511/venmo-more-check-than-cash/

So do not use Venmo for commercial transactions (buying things of Craiglist for example) and do not assume the money transfers immediately.

Also shame on Venmo for misleading their users; they should do a better job of explaining how the transfer actually works.

I only use it to transfer money between myself and friends. The most time I've ever had to wait to get money from venmo to bank is 24 hours.

the longest I've had to wait from Paypal is 24 DAYS

This is a bit misleading - PayPal's 21-day hold only applies if you received the funds as payment for goods and services. Even in that case, the funds can be expedited to release in 3-5 days once the buyer marks the item as received. It's more for buyer protection than anything.

If you're in the US and receive money via a "Friends and Family" transfer, it's just as 'instant' as Venmo.

It seems like only allowing a zero-dollar invoice after two parties have conducted another non-zero legitimate transaction might be a solution.

I can see a lot of cases where you have a $0 legitimate transaction.

That require PayPal?

Genuine question: What are the legitimate uses of $0 invoices? The only thing I can think of is a product that usually costs money (and thus has an invoice workflow), but has been marked as free for some promotion.

It is very common to send $0 invoices. Some instances I can think of are receiving replacement goods / tracking if a service was rendered but not billable / making sure an account is zero'ed and you are fully paid up / etc

In the case of periodic invoicing but you haven't crossed into the billable threshold.

Let's say you get 2 hrs of support per month free, after that it costs $100. If you don't use the full 2 hrs, you'd get a $0 invoice - but there may still be detail and record of work performed (which you would want)

I sold a product and it was paid for by gift certificate or a special promo. I want to send a $0.00 invoice for the customer to see it and enjoy the feeling (Sweet! Free jerky/flowers/socks). It's great marketing and the customer will remember you the next time they want some jerky/flowers/socks.

On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.

It can, however, be useful to get invoices for purchases that were discounted down to $0.00. At the startup I'm with we often give new customers a $0.00 trial rate, but they still want invoices so their billing department can keep track. Of course, this billing system isn't using PayPal, but just a thought.

Not invoices per se, but if you buy something on eBay using only eBay gift cards, it processes as a PayPal "transaction" of $0.00. I've got a bunch of those in my email, always interesting to see "You sent a payment of $0.00 USD to X".

What about sending out a replacement product to a customer? A given business process may be simpler if you generate a $0 invoice for replacements.

Especially if your inventory system requires an invoice number in order to -x from inventory.

I agree, but what if the invoice was $1.00 or even $25.00. It would have the same effect, which would be to get the receiver to visit their website?

Sure, but Paypal et al might take a more active interest in shutting down service access for fraudulent payment demands than message spam

Actually a simpler fix is to hold $10 in the user's paypal account for each $0 invoice they send, and if the invoice is reported back as spam they keep the $10, otherwise after 90 days they release it back to the (potential) spammer. Doing this with funds in the account, rather than with a (likely) stolen credit card, works very well.

For accounts which keep an average balance > $minimum you could wave the $10 hold and just confiscate $10 every time someone reported their $0 invoice as spam.

Yeah, as much as I hate it, I always find myself appreciating the ingenuity that goes into these things.

Another similar spam hack (that unless I'm mistaken is also legal) is the recent plague of Google Analytics referrer spam targeting people who pay attention to their GA referral reports.[1] It has actually caused some issues given that the volume can be quite significant and can easily skew your overall numbers by quite a bit if left unfiltered.

[1] https://moz.com/blog/how-to-stop-spam-bots-from-ruining-your...

All of these approaches are used to take advantage of the email deliverability rates of large reputable companies that send lots of email. Paypal is a new one, but Hotmail and Facebook have in the past been used for similar things. With Hotmail, you could define a custom "I've changed my email address" message, which would contain your spam message, and then it would send it to up to 5,000 "contacts" for you with near-100% deliverability. Some people automated this, and with that they were able send millions of messages per day. I haven't looked recently, but Facebook's "invite friends" feature has been used similarly in the past.

> @AskPayPal: I recommend deleting that tweet, it has your personal info

> @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email!

This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

I mean, it does slightly increase your rate of spam. I have a private email that I only give out to RL people that has never received a spam message.

Wow I love this idea! Can't believe I haven't thought of it

Having a 'spam email' that you use to sign up for stuff and a separate one for non-automated communication only is definitely a good idea.

If you can keep your email address off the front page of the internet, I figure that will help reduce spam.

At this point, that's like trying to reduce flooding by not dumping a bucket into the river. There's so much spam out there that your only hope is effective filtering.

Oh, I've still got filtering, but it reduces how good/aggressive my filtering has to be.

It is indeed very difficult to keep ALL your email addresses from being publicly listed, so I use GMail accounts for the ones plastered all over the web, and let GMail handle the spam.

Hanlon's Razor dictates to "Never attribute to malice that which is adequately explained by stupidity".

From the perspective of PayPal, it's not that his personal email address is made public. It's that the fact that he has a PayPal account associated with that email address is made public.

It's similar to advice for "forgot password" forms not to acknowledge whether or not an email address or username actually exists--simply tell the user an email was sent for that account regardless.

Fair enough, but it's a reasonable guess that any given primary email address has a paypal account associated with it. It's also not really secret, because you share that information with people to allow them to send you money.

Has PayPal just not tried to fix anything or add features other than a CSS refresh in, like, ever?

They did make paypal.me not long ago... That's about all I can think of?

They acquired Venmo, which was pretty big for adding users to their ecosystem. They've kept it pretty quiet and have not tried to link the brands together, which probably says something about the current state of Paypal's brand.

Braintree as well, which has a site and api that work very well. PayPal's on the other hand...

Venmo was actually acquired by Braintree, which in turn was later acquired by PayPal.

There was an update to invoicing features last year, as well as a complete re-design of the website when you're logged in.

Their mobile app has advanced in leaps and bounds in the last year.

Also, payment is way easier than it was before. Less bouncing back and forth.

Not mentioned in the article, but paypal allows you to send a single invoice to up to 100 different email addresses with a single click.

It also allows a 1-click way to email anyone that "hasn't paid" with an update.

I haven't checked, but are you able to send invoices via API?

https://developer.paypal.com/docs/classic/invoicing/IntroInv...

I wonder what the reasoning is that PayPal allows you to 'send' someone $0.00?

I'm not really surprised at how terrible the support via Twitter is. I almost never use chat/email support these days with any large company-because of how useless it has become.

I've received invoices for $0.00 when receiving promotional items for projects I was a part of. Comes right in the shipping box, and I'm assuming it's an accounting requirement.

Yes, it is. Their inventory changed but they did not gain any revenue from it.

Which makes total sense when you need to consolidate inventory at the end of the month/quarter/year.

Lots of accounting reasons to invoice people 0.00 dollars. Sales materials, demo models, returns, replacements, etc.

Invoices can contain credits as well as charges. In some cases these might net out to zero but there would still be a legitimate reason to send the invoice showing that detail.

Why would you put a clickable link to the spam website on your blog though?

If you're so interested in typing in spam links you might as well search up something like "cheap electronics online" in Google and start clicking around page 10.

Sorry about being a bit rude in this comment. I didn't mean to sound so sarcastic and I didn't mean to refer to you specifically.

For a PayPal employee to post here and say he made a team aware and they are working on this it's utterly laughable.

There was a post here on hn over two years ago for the same issue which was top post and generated a lot of news.

https://news.ycombinator.com/item?id=6526481

It is obviously very well known to them for years but they continue to do it

Obviously well known?

Guy at PayPal sees post, tells a technical person about it, said person forgets about it. Suddenly PayPal doesn't know about it anymore.

Or a person wants to work on fixing this but a manager says no, because there are other priorities.

Or a person starts working on this, quits, and it gets lost among the things they were working on.

It's so easy for things to get lost in a company, even with all the bug trackers in the world.

Isn't this what support case systems and bug tracking software was meant to do - to track non-closed issues?

That assumes that the manager doesn't insist that bugs of age get closed simply because long-open bugs make for ugly metrics.

yeah, I agree, but I think a lot of us work in similar situations, where bug tracking exists, but there's such inundation of bugs that we can lose track of some.

I guess I have sympathy for the PayPal team in this case. They're working on an extremely large product, with a huge user-base. I would imagine it would be very easy for bugs like this to fall through the cracks even with a "process" in place

You can send invoices to people to get paypal to show their name to you and connect names to emails

I can also do that with DirectDebit (ACH for you yanks) transactions in the UK for example; brute force branch sort code and account numbers and when you "transfer money" (you can do 1p, or even cancel the transaction once the TUN code has been generated iirc) you get the name associated with the account.

There isn't much you can do about it, detecting an abuse of an invoicing system and locally blocking it is much preferable to the other potential outcome of not knowing or being able to confirm where the hell did that invoice actually went.

I've been getting the same emails for a while now. I sent to paypal through email and got no response. I also added on a topic I thought was relevant on their forum, and a guy there said he reported it and got a less automatic response than I did.

https://www.paypal-community.com/t5/Access-and-security/Gett...

I haven't got more messages lately, so I'm guessing they managed it already.

I saw the same sort of thing a few years ago with Google Calendar invite spam. If I remember correctly, I'd even get a meeting reminder with the spam message.

If we were ever to reach singularity, it would be partly thanks to the motivation created by the spammers.

I read the title and thought of spamming zero dollar gift on Minecraft!

Horrible PayPal customer service. This person should not be allowed on their Twitter account.

This is brilliant :)

Reply on news.ycombinator.com