That raises another question: why couldn't Paypal simply say this?
I can imagine several plausible reasons, related to potential liability, but does that mean that if we're trying to outsource business functions to specialist firms that we can't expect them to be transparent in their operations?