PayPal is currently blocking all transactions containing the word “tardigrade”

Yes, large companies have solved their own money-making problems of scale by becoming so large that problems that we find important as a society become ignorable for their bottom line.

That doesn't mean that they've solved the problems of scale that we care about as a society.

Google does care about 10%.

But problems that are absolutely pretty big, might still only be 0.01% for Google.

Politicians often ask for silly things in connection with technologies they don't really understand, to achieve goals they don't really expect to achieve, just in order to look good to a certain part of the electorate.

Consider an analogy between modern social media sites and something like a phone network or postal mail service. What would happen if a politician suggested that phone companies or their national postal service should be required to monitor all communications for some vaguely-defined concept of suspicious activity, and then when something was flagged, have it reviewed by a human and if deemed inappropriate cut off the spread within X hours? It would be considered an absurd suggestion by just about everyone, for being impractical, expensive, intrusive, unreliable and of questionable benefit.

And yet, politicians keep suggesting that social media companies should be able to do almost exactly that. There are demands that these companies magically detect any sort of inappropriate content on their systems, and then remove it quickly. Small details like subjectivity, privacy and practicality never seem to feature in the press conference, though.

Another example for keyword matching: I work on a German/Polish team. We sent money for a birthday present from Germany to Poland. Someone used the colleagues' nickname "Kuba" in the subject line. The Paypal account of the Polish colleague was blocked afterwards. But he could resolve the issue via support afaik.

No because Ebay is well known, but pick a name of a small to medium start up and yes you can probably kill their paypal account

PayPal seems to arbitrarily block transactions on eBay too. Happened to my friend and he called support and they told him there is nothing they can do. In disbelief he called again and got the same response.

But for regular banks service to private citizens is also compulsory, so they can't just choose the easy path by blocking a transaction based on keyword filters, they must do the intended auditing. So for them there is a balance, for paypal there isn't.

Well completing Know Your Customer checks and audits is sort of their job, isn’t it? They provide a service, saying that they will process payments unless the payment is prohibited by government sanctions. But instead of carrying out actual due diligence, they just block anything remotely related and put the onus and cost of doing their own job on their customers. At least they should have a better process to start proper diligence once a customer complains about overreach of their blacklist, to avoid improperly sanctioning innocent businesses.

What if an arms trader used the name “Tickets Limited”? Would they block all payments mentioning tickets? Surely not, as it would hurt their business, clearly illustrating that their conduct is not at all due to “compliance with mandatory laws and nothing we can do about it” but “we did the math and we feel we can screw you over in this case.”

This is the kind of thinking that lead to the TSA putting infants, and even a US Senator, on the US no-fly list because their names matched those of "known terrorists."

The Washington concept of NATIONAL SECURITY<tm> is a brain-eating parasite that seemingly renders compliance managers unable to tell the difference between categorically different things, such as US Senators and IRA terrorists, or Serbian companies named Tardigard and products, sold by companies completely unconnected with Serbia, with descriptions that contain the word tardigard.

> Financial regulations require any transaction that is "suspicious" in any way of having links to terrorism financing or money laundering be reviewed, and there are large and personal penalties for not doing so.

Unfortunately, PayPal's advanced KYC and AML verification process is hilariously incompetent and rigid.

Some months ago, they asked me to provide charity information for my personal account, and subsequently limited my receiving/sending privileges.

Phone calls to them trying to sort this out have always ended up at some call centre in the Philippines, where the agents can only tell their users that the account limitation is "for their safety".

That account of mine is still limited.

They've also limited the personal account of a friend of mine (who was interestingly enough ex-PayPal) before, also asking for charity information.

> And a review is expected to be more like auditing your customers entire financial history than just asking what they meant by a word

In the US, which is presumably where the sanctions trigger originates (the company is on OFAC's list), a review of a transaction is just that. Even opening an account doesn't require a review of your customer's entire financial history, merely that, for a business account, you understand the nature of your customer's business.

> In that climate there's no good reason not to massively over-filter, the risks of a false negative are way too high.

There is, however, good reason to do an actual review and not outright block transactions. The advice PayPal gave its customer, "change the wording on your website to prevent this from happening," is exactly what competant regulatory training tells you not to do. Changing the wording of a transaction to obviate the need for a review is in itself a red flag. PayPal is utterly incompentant.

The only company I’ve ever seen take these requirement seriously is Transferwise. I have a very common last name and similarly common-ish business name and they had to have me say I wasn’t related to a bunch of politicians I’d never heard or nor associated with a bunch of similar companies.

This keyword stuff is no kind of protection for them, especially if their own reps are advising people to just circumvent the list, which itself probably is a TOS violation.

The first name and deity name Isis [1] got tarnished by ISIS (which later got renamed to IS).

PayPal is also just two words blended together. I'm not sure they're anyone's friend though.

[1] https://en.m.wikipedia.org/wiki/Isis

In all software I've seen dealing with these issues (ofac, aml, Dow Jones listings, etc) the flagging should result in manual verification but you're able to configure risk allowances. They almost all certainly allow some bad transactions through accepting the potential risk/cost of actually hiring huge teams of manual auditors. Just being flagged does not always lead to audits.

It's very annoying. I worked at a shop that sold cigars online. No actual cubans, but brands that used the name cuba in it. Inadvertently every time it would get flagged.

And the strings from this list have to be matched indiscriminately against everything? Names of account holders, text in the reference field of a transaction (if such a thing exists in the US), whatever?

The payments won’t still go through - if you look at the links, PayPal is returning a big red error message to customers. It doesn’t look like PayPal is doing any kind of review, they are just blocking all transactions with Tardigrade in the associated text anywhere.

I hope an arms dealer names themself eBay Arms. I’m against arms dealers and PayPal and this would destroy PayPal.

OK, but so what? 'Be on the lookout for XYZ' is an understandable request, but what prevents paypal rapidly distinguishing between credible and suspicious transactions - and more importantly, pre-emptively communicating with users about it, since they are going to find out the hard way?

Conversely, what stops bad actors just switching to doing transactions for t_rdigr_de, ta_dig_ade, or tar_igra_e and thumbing their nose at the filtering? (OK, realistically they would probably switch to some more obscure backup code but you get the idea.)

The basic problem here is that the burden of enforcement is being shifted by Paypal to innocent people with no warning, instead of being shouldered by the company, which is in a position to push back legally on unreasonable requests and plan ahead for reasonable ones.

>This is more or less legally required for any company that moves money in the United States of America. You will probably find the same issues with the same terms on any other banking for financial body.

No you won't because names are not unique. Banks and credit unions tend to have sophisticated data analysis, unlike the knuckleheads at PayPal.

When I heard about this nonsense years ago, I put some of the banned words in the memo area of checks and transferred money between two credit union accounts. They went through. I did the same thing using electronic transfers between accounts. Again, they went through without any problem.

https://imgur.com/a/RnpRm

A person put the words "James Kang" in a donation to the Red Cross that stated he was testing these banned words and PayPal, in their infinite stupidity, froze the transaction.

>Technically, these aren't being blocked. They're being audited. The payments will still go through.

They buyers are literally getting a message saying "This transaction cannot be completed because it violates the PayPal User Agreement" [0]

[0] https://twitter.com/ArchieMcPhee/status/1304437732584771584

Just to be clear, OFAC does not give a list of “banned strings”. It provides a list if individuals and entities that it is illegal to transact with. By which I mean, it’s the entity that matters, not just the raw string.

It’s up to the payment processor to have a process that ensures they don’t send payments to a blocked entity.

You can search for them here: https://home.treasury.gov/policy-issues/office-of-foreign-as... and see the listing for the company in this notice: https://home.treasury.gov/policy-issues/financial-sanctions/...

Note that the standard practice for handling an OFAC hit (e.g. payment to O Bin Laden) is to disambiguate your payee from the blocked individual/entity. This can be easy or difficult depending on how much info you have on the payee; if you have an address and nationality already that don’t match the sanctioned entity then you’re generally ok; typically you would collect a photo of the payee’s ID and run a manual check if there was any doubt.

These “enhanced due diligence” processes can be quite time consuming in aggregate, and I’m not surprised that PayPal isn’t running a detailed EDD process on transactions that will probably net it a few cents of fees.

Having said that, given the structure of their business (online checkout) I’m surprised that they are considering the product (eg “tardigrade”) as being relevant; they have account info on both the payor and payee so they know the payment isn’t going to the sanctioned Cypress company from the OFAC list. This isn’t a Venmo payment that says “pass this payment on to Tardigrade Inc”, which you would want to block.

This seems like either a bug in their screening code or some very risk-averse logic (maybe to do with low-value transactions).

So the answer is this will never be fixed? Just a big RegExp essentially, is the path to avoid $250k per fines? A Persian friend was craving his mother’s cooking, so we went to a restaurant which he Venmo’d me for and we got a stupid flag because his note said “Iranian”. That’s borderline culturally inappropriate considering these companies have a long history of all our other good-standing transactions, they already have massive data from third-parties they purchase from about our offline identities, they have our geolocations whether we like it or not. There is a vast asymmetry of information between these companies and the public they service. They have the advantage, so why not apply that advantage to not flag a small-charge restaurant outing in one of the country’s most well educated neighborhoods, and use something more sophisticated than a silly-string dictionary lookup to determine when to flag.

It makes the government officials and a certain percentage of ignorant public see how much busywork is done to stop the terrorists and feel good about it.

I bet a lot of malevolent transactions do slip through the cracks because of how laughably naive this system is.

You are misspelling TARĐIGRADE. That word is Serbian, not English. The Latin form of the language has the letters /d/ (upper "D" and lower "d") and /dz/ (upper "Đ" and lower "đ").

There is also a TARGET TRANSPORTATION LIMITED on the list. PayPal, in their infinite stupidity, would probably block transfers to the retailer Target.

Or just use "Cuba" somewher. It will have more effect than the rest all combined.

that’s proven by all other problems we have working with. but you cannot simply turn it off since it has huge payment share vs other payment methods

I don’t think it has to do with err on the side of caution. I don’t think PayPal has the technology to implement better blocking.

So, you think this is more of a prop 65 scenario?

Non-Vice: https://www.geekwire.com/2020/weird-seattle-retailer-archie-...

Probably not "grad", maybe "tard" ? ;p

Why specifically a civic responsibility?

PayPal was the first free electronic way to send and receive money to people in the US, to my knowledge. Which is a sad indictment of the US’s infrastructure.

Even today, so many people use Venmo, which is still PayPal. Apple Cash seems to work well, but still involves an unnecessary middleman like PayPal.

Zelle is the only half decent solution, that doesn’t involves third parties.

PayPal has always sucked, at least to some level.

For example: paypalsucks.com was set up some time around 2001[0].

[0] This is the earliest snapshot the IA has of the site: https://web.archive.org/web/20010215013627/http://paypalsuck...

>I'm not from the US and to me PayPal was always only a way to avoid filling in credit cards details on (random) websites.

And this is the answer.

Paypal's existence comes down to the fact that they are the sole "legitimate" vector into the US financial system for a vast majority of the rest of the world. Because that's such a massive financial incentive, they can basically treat users however they wish and get away with it.

What would be wrong with 'tard'?

There is no security team which you may speak to.

It was a lie, of course they have all that, they just never speak to people. When was the last time you spoke to google support or manager? They collect notes and only when something escalates to a PR story or a high volume of complaints/failures/cancellations do they create some JIRA story and assign it to some engineer. A “business to consumer” internet giant will never let the consumers get passed the call center to talk to engineers directly, and engineers don’t want that either. It’s as much of a rule as that a business must be profitable. On the other hand, competent support is supposed to have tools to fix most issues.

I also had a bad issue with some unauthorized withdrawal via eBay, from my paypal, in about 2004, and spent hours on the phone with no result. I wished I could boycott them after this, but no one cares, I just learned no to trust them because they are a terribly run company on the consumer support side. And I think it is because they deal so much with fraud. I don’t think we can do anything about it, except promote these stories.

They have a whole department called "risk management" that is responsible for combatting fraud. (I worked for PayPal under that department in a past life.)

I'm sure there's a "security team" somewhere that responds to attempts to directly breach PayPal's infrastructure, though I never interacted with them. (Paypal has quite a bit of on-campus physical security, and I did interact with them almost every week.)

Circling back to the discussion at hand: PayPal probably doesn't have any digital/financial security staff at their call centers (why would they?) so as far as the call center reps are concerned, there is no "security team".

All I can say, to all the comments, is "whoosh".

an upvote to you my good sir

OFAC match? The entities aren't matching just the product. It's like blocking someone from buying food at Joe's Cuban Resturaunt in Miami. Not what OFAC actually requires.

It's really hard to identify sarcasm on the internet.