Hacker News Reader

Just curious - how does it look from the technical side? Does PayPal use direct debit or something different?

Yes, direct debit. They authorize you account by taking out a minimal amount that you then use as a one-time pin to verify that you are the owner. After that they apparently can do as they please which is not how I thought it was going to work (I expected a verification step from my bank with each payment, a system called iDeal here).

You can (and should!) dispute direct debit. I believe that in most countries you should get a refund no questions asked. Check out the details with your bank.

That's a good one, I wasn't aware of that possibility (nobody ever got it in to their heads to take more than was due). From what I recall direct debit payments can be disputed when they're periodical, and then only for the last transaction, this is not at all like that but I will inquire anyway, because if that works I can resolve this really fast.

Thanks for the hint!

It might depend on the country, but I don't think there's one where you hand out your wallet and have no recourse whatsoever against fraudulent withdrawals. My bank (Poland) lets me revert any DD withdrawal through they web interface. The time limit is 30 days (business accounts 5 days only.)

> business accounts 5 days only.

It's a business account but I'm going to try to anyway.

I can't wait to hear how it turns out. I've just joined ebay and became a paypal customer and your story creeps me out.

> unfortunately paypal would not authorize any > payments (from my credit cards!) until they > had a confirmed (and thus accessible) bank > account.

Please elaborate. I'm not sure what you mean by this, and there may be (are!) differences between how paypal operates in the .us versus the .eu.

Were you not allowed to _send_ money with only your credit card on the paypal account?

Or were you not allowed to _receive_ money with only a credit card on the paypal account?

Sorry. It's late here, I'm tired, and I'm not reading your words as clearly as I should. Though I haven't done much in recent weeks, I do volunteer work for a non-profit organization here in the US that specializes in helping victims of online fraud. Sadly, the "paypal drained my bank account" story is repeated regularly.

> Were you not allowed to _send_ money with only your credit card on the paypal account?

Yes. They kept asking for a verification of the account, without that no further processing possible. Please note that this is a corporate account, not a personal account.

> Sadly, the "paypal drained my bank account" story is repeated regularly.

ouch.

Ahhh, though you said "corporate account," I'm betting you actually mean a "Merchant Services" account. There are actually a number of different types of paypal accounts, each with their own set of rules and features. Paypal --very intentionally-- tries to confuse people by not clearly listing both the various types of accounts and the various risks associated with them. They also very intentionally do _EVERYTHING_ they can to get your bank account credentials.

For example, in your situation, there may have been a somewhat hidden link to "other payment options" but of course, the only default you saw was "enter your bank account number." Paypal pulls this shit constantly, and all it takes is one wrong click (or less than careful reading) to trap you into an endless page reloads of "please enter your bank account" nonsense. --It's extremely scammy and they use every anti-pattern in the book, heck, they probably wrote the book.

I should also note, NEVER use a bank account debit card with paypal or online. These are also another way your bank account can be completely drained by attackers or less than honorable businesses.

> to trap you into an endless page reloads of "please enter your bank account" nonsense.

That pretty much describes what happened.

I will take your information to heart and get paypals access revoked and I'm going to close that account and open a new one just to be sure.

Thank you very much for the helpful info, I knew paypal was bad, I always thought the 'bad' limited itself to my balance on their end (which I made sure I never had).

This is a bit of a shocker really.

I wish it wasn't such an unpleasant shock for so many people, but very few people even think about how something actually works and the risk models being used. In the case of paypal Max Levchin (sp?) created a brilliant fraud detection (risk analysis) system, and also made sure to mitigate risks to his company by making sure someone else could be put on the hook when something goes wrong (i.e. why they press so hard for direct access to your bank accounts). Even though it is a brilliant design, and a profitable business, the entire company is dubious because it profits from putting normal people (users) at risk without ever informing them of the risks.

> I will take your information to heart and get paypals access revoked and I'm going to close that account and open a new one just to be sure.

To be fair, PayPal transactions to/from your bank account happen via ACH. ACH (automated clearing house) has been around long before PayPal existed. It is also used by various other entities for periodic payments (like insurance, utilties, etc).

I was once told that a common savings account can have inbound ACH (money sent to you) but not outbound (money sent from you). Might want to talk to your bank about this.

I had something similar happen with a shady merchant account company. I had changed some details I had on file with them a year earlier, so they said I couldn't cancel the contract I had with them without penalty, because we signed a two year contract and "it hadn't been two years" (it had been four years, I just changed the address and other simple details on file but apparently they were saying it was only a one year old account). I called my bank, told them to block all charges from the merchant account company and give them no access, and they did. The merchant account company sent a number of threatening letters and would call me at asinine hours (5AM Los Angeles time) but eventually they went away, and they didn't get their $600 cancel fee or whatever nonsense. This was a few years ago, when online payments was more of a wild wild west type deal, I think it's gotten better since then.

Anyways - you can always call your bank and explicitly them to block access. For bonus points, tell them you're recording the call in the beginning (even if you're not), and take down the person's info. Then if there's a problem, you can say, "I explicitly told teller John Winterman on 18th October at 2:25PM to deny access to Paypal." This kind of accurate record keeping makes banks take you very seriously. So yeah - call the bank and deny access, or reverse-reverse charges... the bank is generally on your side if they're decent. (And if they're not decent, get another bank! I've found all the RBS owned banks to be good quality - RBS, Citizen's, and Charter One, if any operate near you)

One of the things I love Greek banks for is that they have none of this overdraft nonsense. If you have no money in your account, the transaction fails. I've tried to buy groceries and things a few times without having money in the account, and it just didn't go through.

In Austria, you go negative, it's a loan. No penalties, just interest, if you don't fill it back up quickly. Reasonable interest.

That seems like the sanest option to me. (I don't think it happens very often, either - Austrians don't use credit and they have a lot of savings on average.)

That's also much better than the overdraft ripoff, but I'd much rather not owe anyone. I guess the best thing would be for the bank to offer that option when opening the account.

Isn't that exactly what the new CARD Act requires all US banks to do?

You can get this in the United States, too. Get a checking account with ING Direct. I don't make a habit of overdrafting, but it has saved my bacon a few times when e.g. I forgot that a credit card payment and estimated tax payment both happened the day before my client's check cleared.

US service members or their families can get the same with USAA. You can choose another account, credit card, or line of credit.

I can choose whether I want automatic loans or failed transactions.

The worry about Paypal dropping you below zero is a very good one, as I wrote about my experience with it: http://news.ycombinator.com/item?id=1664224