Hacker News Reader

Comment by katsura | Hacker News Reader

Well, I'm glad I don't have money left there, because I had two factor authentication turned on, and for some unforseen circumstances, I lost my phone number. PayPal customer service is actually quite hard to contact, because every possibility they give you requires you to log in. I found an email address somewhere, but when I wrote them telling them about my situation, I got an email that if I log in I can check their answer in the internal ticketing system. Then a few days later there was another email asking me about my experience with their support.

I'll never use PayPal again. No way in hell I'll trust a company with handling my money when they make it impossible to contact them.

View on HN

Similar here. I've been using PayPal to receive our Patreon balance each month and pay various project (sqlitebrowser.org) related experiences.

Just over a week ago, when I tried logging in to PayPal (2FA is not enabled) a new screen appeared saying they'd sent an SMS with code to my phone number, and I need to type it in.

Problem being, the phone number they displayed is not mine. I've never given them my mobile number, as they've always had a little blurb about that saying people have to also give them permission to receive marketing messages. Hell No.

So now I'm locked out of my account. With sufficient screwing around in their help system, there is a phone number you can call:

  +44 203 901 7000

Trying to get through to a human being there however has proved an impossible task (after many attempts). From just being hung up on by their system, through to being told they're out of business hours (nope, double checked that), etc.

Looks like in about 51 weeks, they'll start stealing the remaining balance until the account is empty.

Fucking scammers.

PayPal is the main reason I'm not positive on Elon Musk's history... they've been "known bad" for many years, including when he was there. He started his fortune from building a company that knowingly scams people. :(

>PayPal is the main reason I'm not positive on Elon Musk's history... they've been "known bad" for many years, including when he was there. He started his fortune from building a company that knowingly scams people. :(

There's plenty of possible things to criticize him for, but this seems like a weird one. PayPal was started by Confinity. He founded X.com in 99ish and they merged like a year after, but then he got the boot as CEO in a matter of, months? Weeks? Don't remember why, but while he still owned a ton of stock he was out in management. Then Ebay bought it all in like 2002. 20 years after his departure, itself before he had any real chance to make a mark, and 18 years after being bought, seems like a bit of a stretch to hold that of all things against him?

Edit: also man what a crazy time, I mean it was obviously crazy even at the moment but still thinking back on the timelines it's still wild.

>20 years after his departure, itself before he had any real chance to make a mark, and 18 years after being bought

You seem to imply PayPal being scummy is a new development. Always has been.

I remember reading where Elon talked about Paypal. They implemented policies he thought were stupid but he was out.

It’s even more bizarre because things like Patreon and SMS text authentication weren’t around in 2002 and hardly even in 2012.

Might as well criticise Tim Bernes-Lee for not developing the HTTPS spec in the 80s

Ahhh, I haven't really had a close interest in Elon's stuff. Only really know of him as PayPal -> Tesla -> SpaceX.

Re: PayPal, just knew he used to run it, and they've been scammy pretty much from the start. Thus the poor impression from that.

Also Re: PayPal: I used to know a guy that worked there from the very early days, and he told wild stories about employees freezing people's accounts and withdrawing the money for their own use. Apparently it was widespread, and pretty common.

That seems incredibly doubtful and highly illegal. I can’t imagine that happening without lawsuits being filed.

Yep, clearly very illegal.

It's kind of funny you say that too, as people have been saying that forever. eg "If they were so bad, stuff would have been done" (sic).

Look at PayPal's reputation going back a decade or two, and you'll see there are tremendous amounts of stories about it. People used to set up dedicated websites collecting the copious horror stories. Not kidding about that, in any way.

At the same time, there were multitudes of other people going "Oh, I've never had a problem with them, you must have done something wrong". (etc)

They've cleaned up their image _a bit_, so things don't seem as obviously bad now (latest development aside). Back then though... sheesh...

I avoid PayPal like the plague, but I would require some hard evidence to convince me that employees were regularly stealing users money.

No idea if that's still the case (hopefully not), but it was widely known when they were a young company. It shouldn't take much effort to look into, if you actually care enough to investigate. :)

Hack: As soon as you start speaking to their robot and he asks "why you're calling", say something like "speak to a human". After robot tries to evade it with further programmed bullshit, say: "GET LOST!". He will quickly respond "It seems I am having problems here" and connect you to a human. Worked perfect for me several times I had to contact their customer support with the identical problem of being locked out due to outdated phone number.

PS: I read somewhere that customers who swear on the line will be connected to agents quicker ;-) or generally receive better experience. Sigh. What a world.

Tried multiple variations of that already.

Ironically, swearing at the bot memorably just ended up in an automatically dropped phone call pretty much right away.

Not sure if that was due to them just dropping the call anyway (guessing so), or there's detection for people swearing.

Or the bot is trying to transfer you somewhere that isn't properly set up.

Yeah, could have been anything. ;)

> Just over a week ago, when I tried logging in to PayPal (2FA is not enabled) a new screen appeared saying they'd sent an SMS with code to my phone number, and I need to type it in.

Is this a European or UK account? That's them implementing the PSD2 regulation [1], and they should have emailed you quite a few times about it.

But yes, PayPal customer support is hilariously bad.

[insert usual rant about their customer support] They've asked me to provide charity information for my personal account some months ago, and subsequently limited my receiving/sending privileges.

Phone calls to them trying to sort this out have always ended up at some call centre in the Philippines, where the agents can only tell their users that the account limitation is "for their safety".

That account of mine is still limited.

They've also limited the personal account of a friend of mine (who was interestingly enough ex-PayPal) before, also asking for charity information.

[1] https://www.paypal.com/uk/webapps/mpp/psd2

Yep, it's a UK account

They did email me a few times saying they wanted my mobile number, but each time I went to the page it had the little text blurb about needing to accept marketing texts.

Again, not going to happen.

That being said, they shouldn't get to invent a phone number when one isn't provided. ;)

---

On a related note -> I remember trying to change the address in my PayPal account a few times after they emailed, as I moved from the UK back to Australia. (thanks to fucking Brexit for forcibly removing my EU citizenship, which I very much wanted to keep. Grrr :< )

Anyway, PayPal didn't allow changing account country through the UI, and there didn't seem to any other way of doing it either.

Not sure what people who move country are supposed to do... o_O

> Anyway, PayPal didn't allow changing account country through the UI, and there didn't seem to any other way of doing it either.

I believe the "proper" way is to close your old account, and reopen a new one from that country's site. Most people I know just have multiple accounts. I don't know if PayPal warns or shuts people down for doing so.

It makes sense legally, since a user would have to agree to a different set of terms in a different jurisdiction.

> It makes sense legally, since a user would have to agree to a different set of terms in a different jurisdiction.

While it's true that different terms - or at least different provisions within a single terms document - might need to apply when someone travels or (especially) moves to another location, plenty of other companies implement various versions of this without needing an account to be closed and reopened.

Last time I checked their terms (it was a few years ago), you weren't allowed to have multiple accounts. As you said when one moves to another country, they just have to close the previous account, and create a new one in the new country.

Which of course causes problems for those of us who do genuinely live in two different countries.

Yeah, I came from Australia, moved to the UK, then have moved back to Australia. And I'll probably be back in the UK for a bit, once the Coronavirus problem is solved.

So, not being able to change country in PayPal is pretty bad. It doesn't match up with the actual reality of how people live. :(

The PayPal mafia in general are interesting folks

Peter Thiel the “libertarian” went on to found Palantir, for example, which helps governments do precrime and encourages mass surveillance of their citizens.

He also opined that “competition is for losers and you should build a monopoly” which as the first check in Facebook helped influence Mark Zuckerberg, and the results we see today. Back then Mark Z wanted to make peer to peer encrypted networks like Wirehog.

Peter thiel also wrote op eds saying stuff like giving women the vote ruined the USA by making it more social-democratic instead of capitalist.

Musk I think has long moved on from the PayPal days.

It's interesting to see that exactly what you wrote (except for the 2FA part) was happening to paypal users 18 years ago. Things haven't changed. Their entire business model is built on nearly complete automation and no human in the loop customer service interaction.

> Their entire business model is built on nearly complete automation and no human in the loop customer service interaction.

Same as the Google model then? ;)

I have the same exact problem! I wanted to delete my account, just in case, but I cannot login. I haven't used Paypal in over 10 years. Their "service" is really not needed anymore.

If you sell on eBay, Paypal is heavily integrated, to the point I'm not sure you can complete a transaction without it.

eBay is in the midst of migrating all seller accounts away from paypal to their own integrated solution. While buyers can still use paypal to pay, as a seller, you no longer have to touch paypal if you don't want to.

On the other hand, you now have to give them your SSN #.

I have recently purchased a number of things on ebay with 'buy it now' and giving my visa card number directly to ebay, in what looks like a very ordinary shopping cart checkout workflow, with no involvement of paypal. No login to paypal and no mention of it. The browser I was doing it from has never logged in to my paypal account and has no credentials cached for it.

Paypal still does the credit card transaction. I know because their black box algo blacklisted me for whatever reason many years ago and I tried that. They have no customer support its just an abyss of a company and you are a statistic. Fine with me because I really dont use Ebay but I remember that.

No, this parent poster is talking about a new thing.

I think the one you're talking about is the previous system, whereas PayPal would be the transaction processor anyway. You'd still get email (receipt?) and other bits from PayPal after the transaction was done.

Now though, the CC processing on Ebay seems to be a non-PayPal version. At least, that's what it looked like today when getting stuff. No mention of PayPal anywhere, which I was pleased with having had a very bad experience with them (PayPal) a week ago.

That is going away

A lot of e-commerce sites will take PayPal these days. I like to use that vs giving my credit card information. Granted, I prefer to use things like Apple Pay but there are circumstances where PayPal is the only indirect payment form I have in common with a site

you might be interested in privacy.com as an alternative!

The odd thing about privacy.com is that in order to use it, you have to surrender all privacy. You are required to provide them full access to your bank account.

Or if you have Capital One, they offer a browser extension called Eno to generate unique virtual numbers for each site or purchase.

...But does it play ambient music while the virtual number is valid?

same here. Lost 2fa due to water damage on phone. and all the data was irrecoverable. Now even if i give every data their customer service don't care.

From that day i haven't used any 2fa and just use password manager with additional backup.

Make sure you test the recovery system. I forgot how Paypal's works, but Google's for example, will simply bypass your 12288-bit strong password and give your account to anyone. Lost a Google account that way. 2FA would've saved it (in theory).

password managers let you store the one time password key.

this removes the "two factor" nature of two factor, but retains the one time password nature of one time password.

I honestly can't relate to people losing their access because something happened to their phone. The QR code is just a string of letters and numbers and you can save the QR code and the string of letters and numbers. I've been doing this for like a decade.

Just to point out... mobile phone's aren't 100% universal, though a lot of places pretend they are.

Up until about 18 months ago I used to live in a part of the UK without any mobile phone coverage. So, any mobile number I had (with Vodafone) always expired after 3 months.

That does not make for any kind of fondness of places trying to blindly force SMS based 2FA on everyone. ;)

Do they have the that though? When I turned the 2FA on it was only SMS option, so if your phone number is lost you are out of luck.

I thought they had added support normal TOTP now but if not you can probably still use the old method of generating a Symantec VIP style ID which has allowed you to use any TOTP app with paypal for years.

PayPal 2FA via OTP has apparently been available for at least 6 months

It had, but when they forced me through the 2FA enrolment flow recently the only option was SMS.

To use OTP I had to break out of that flow and start from a different part of the site.

I don't know about paypal.

Storing the second factor in the same password manager as the password is a lot like having a post-it with the password on your desk: it's practical, but defeats the purpose.

But to add to this, I wouldn't ever set up a 2FA on a service that doesn't allow multiple second factors, and mostly static backup codes. Having only one (ie. device) is a much higher risk, of being locked out, than having the password stolen.

If your password manager is compromised you are screwed.

When looking at the actual attack vectors though it is vastly improved:

Mitigated - Online attacks on your account at any service

Mitigated - In person attacks on your account due to post-it notes

Mitigated - Losing your phone which was the only way you could generate a one time password

All this drama is mitigated, turning a disaster into a 5 second recovery.

At least I know whoever is using my password is siting at my desk looking at the post-it (provided of course they didn't photograph it). Point being: it doesn't entirely defeat the purpose, in a similar way to how TSA locks don't defeat thieves, but delay them/lead them to find a different target.

I keep a separate phone next to home PC and enroll that for 2FA as well. That’s as secure as a sticky note on monitor, that is to say it’s airgapped.

Screenshot the QRCode, print it out, and keep it in a safe.

I have an encrypted backup of all my TOTP QRCodes and this has been tremendously useful.

I loathe sites that only do SMS 2FA, and I assume by default they just want my cell # for marketing or other privacy invasive purposes. Too many sites using SMS 2FA have poisoned the well.

That's a good idea. I've been only enabling 2fa when I can use two forms of it (totp + u2f token), but that's still vulnerable since I often carry both of those on my person at the same time.

Use a 2FA that lets you take backups?

Or print out the QR codes and keep them in a safe place.

Authy seems great for this.

> when they make it impossible to contact them

Funny (and infuriating!) to be in the same situation. I have lost access to my account and the money in it, because they have the wrong phone number on file. In their support forum, there are pages of people with the same issue - they're locked out of their account, with seemingly no way to contact anyone at PayPal to resolve it.

I hope they get sued for this practice of abandoning their customers, cutting off contact, and keeping the money.

You don't just have to hope; you can do it.

The cache-less society is no different, it's just the bandits that has changed. And it's for protecting the banks money, not your money. Paypal has always been on the consumer side though.

Not trying to make an excuse for all the horror stories, just some advice: Make sure you have backups/exports of the 2:nd factor keys so they can be imported when lost. For example print your password and store it on one location, for example in a safe, then print the 2nd factor key/export (QR code, or backup codes) and put it in another safe/location. Or make several copies and store on many safe locations. And don't forget to TEST YOUR BACKUPS on regular intervals to make sure they work when that day comes.

Reply on news.ycombinator.com