Hacker News Reader

>PayPal tried to take money from my checking account because Consumer Reports "autorenewed" my subscription -- without my knowledge or explicit authorization.

The only way this happens is you create a "billing agreement" when you first signup. Its a feature of Paypal that then lets sites bill more stuff to you without much in terms of prompting. Its useful because services like Steam use it to avoid prompting users over and over again to login but other sites use it....because they can. Problem is its not very obvious to perhaps the majority of users they are creating a billing agreement.

You can terminate these agreements any time in the paypal site. But you have to do it yourself as otherwise it'll just sit there indefinitely.

Yes, I think that is what I use to pay for Netflix.

FYI anyone can dip into your checking account anytime they want to. AFAIK there is literally zero security, all you can do is dispute unauthorized transactions after the fact. Even with a paper check all the info on the check (including recipient and amount) is effectively just a paper trail to be referenced during a dispute.

Not only that, but you only have 60 days to dispute. So don't miss a bank statement or you could be eating the fraudulent charge.

It's crazy how our modern banking system has almost zero security systems in the way of someone draining your account.

The account numbers aren't even secret, they're written on the bottom of every check!

Yes! And you have to catch it within 60 days.

I use examples from a bad embezzlement in my pitch deck. Checks are a joke.

"I didn't realize PayPal could dip into my checking account any time they wanted to."

EBay did this to me once, I think this is an American thing, doesn't happen here in Canada like that.

Oh yeah, this was one of the most insane things I experienced moving to the US.

If someone has your bank account number they can withdraw money from it. For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it.

It gets better: if you have someone’s bank account number you still cannot transfer money to them. It would literally be easier to tell your bank (say etrade or whatever) that it was your bank account.

That’s why all these absurd abank payment systems exist in America. The act of just giving someone money is incredibly hard.

Yes, though they must be a bank or have an agreement with a bank. Random person can't just do it by just having the numbers. And a bank can get in trouble if it allows shady clients access to ACH.

> bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took

In my experience, it is usually the reverse - they put a small sum there, and then withdraw it back after auth. But the end result is the same, of course (except if you have less than $1 on your account).

> if you have someone’s bank account number you still cannot transfer money to them

That's indeed weird, because I see no technical reason (at least with my knowledge about ACH - btw HN had recently a couple of nice articles about it) why that would not be possible, but my bank only allows me to transfer money to my accounts. No idea why. Maybe some legal stuff?

OTOH there are apps like venmo which make it easier.

Nope no requirement that they be a bank. Plenty of places allow you to pay online by “direct deposit”, which in every country other than the US involves them providing you with their bank a/c details.

In the US you give them /your/ bank account, and /they/ initiate the withdrawal. Anyone with your account details can pay for something from your account, including to a service they can withdraw from.

Better yet fraud insurance covers credit cards, not debit or “cheque”. Specifically: if someone uses your bank a/c# you are responsible for recovering the money.

> Plenty of places allow you to pay online by “direct deposit”

Looks like you've missed the "or have an agreement with a bank".

> if someone uses your bank a/c# you are responsible for recovering the money.

I do not think this is true. Of course credit card fraud liability policy only covers the credit card, but there are rules about bank transfers. My reading of https://www.law.cornell.edu/ucc/4A/part_2 is that the customer is liable for the payment only if it is authorized and passes "commercially reasonable" security procedure. If somebody just gets you bank account number, it's clearly not an authorized payment (unless they make it look authorized, i.e. by stealing your identity or passwords, etc.) and you will not be liable for it.

> For example the errands bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took. I honestly could not believe it.

That is crazy! I remember Paypal doing the opposite in the UK, they made 2 or 3 tiny deposits and asked how much they were.

I'm not sure what "errands bank account" means, but I'm in the US and making a couple random deposits <$1 to confirm an electronically linked bank account is mine is how things are done here in my experience. They always take the deposits back afterwards, too.

Errands bank account = etrade, boo typo!

I had an issue where I accidentally sent an eBay shipment to an old address. It's something that I immediately recognized after clicking "Buy now," and immediately sent a message to the senders; all but one of them corrected the issue and sent the package to the right address, but, one didn't...and it wasn't a big deal -- a $15 package -- but, it was more about the principle...

I followed eBay's "Buyer protection" to the letter...and guess what? I wasn't covered...even after escalating -- and saying, "They have my money and I still don't have my product, I'm trying to understand which part of 'Buyer Protection' I am missing here."

I called my credit card company, explained what was going on, and had my money back in 3 minutes.

Chargebacks are great, whenever they are used effectively...and ebay/paypal is the devil.

Note that PayPal requires that the vendor ship to the confirmed address that the buyer used in the payment. If the seller or shipper ships to a different address, even at the buyers request, they lose all Seller Protection.

It's even worse than you think. Because even if you put a credit card to back up your payments (easier now that PayPal has a deal with VISA), and you are hoping that a passed expiration date on your card will block a transaction from happening, the company will try new dates with one year increment in the future, till eventually the transaction goes thru.

Huh? Does your card number not change when you get a new one in the US?

Unless you specifically ask for a new number, not at all. What's even worse it that the cvv is changing (checksum with the date and card number) but the transaction can go thru without cvv submission in most cases.

what's the point of a cvv then? This seems rather odd

It's up to the merchant; since in the event of fraud they'll be the ones who get hit with the chargeback, it's up to them to decide if they want to require that extra safety or not.

For a recurring subscription, the cvv was verified at the beginning. Cvv is for verifying the card security, not vendor account management.