Hacker News Reader

Comment by throwaway2474 | Hacker News Reader

In my (quite extensive) experience with the company, one should only ever use PayPal as an extremely temporary means to accept payment for clients who can’t pay any other way, and then immediately withdraw the funds to a real bank account.

The company absolutely cannot be trusted, and will do everything in their power to take your money and not give it back. I do not know a single person who uses PayPal regularly for a business who doesn’t absolutely hate the company, because they do this type of thing so regularly.

Recently, when you log into a business account, there is a giant alert that looks like an important warning, that actually says you’re “eligible for a business loan”. You have to dismiss it every single time with the little non-default no thankyou button. And then beg them to give you access to your own money, because apparently you can’t be trusted.

I for one would love to see a lawsuit like this land.

View on HN

Prior to going to work for a direct competitor (which I was also a heavy user of), I fed my family out of a Paypal account for approximately 10 years, and had good experiences throughout. Total processed through Paypal on order of $X00,000 mostly in $30 chunks; I don't own the business anymore so can't SQL the breakdown by processor.

The one time my account was limited was after moving $3k immediately following a new apartment move in Japan. Total time to resolution: 2 minutes after calling them.

There, now you know one.

Very similar position here. $X00,000 for 10 years or so, payments generally in the US$1 - US$50 range. No specific complaints other can a couple of API breakdowns over the course of a decade.

So now they know two.

two good anecdotes vs over a decade of non-stop abusive practices.

2 white sand grains on a black beach count for very little.

Honestly, it is almost certainly the opposite. The vast majority of people use PayPal on a regular basis to pay for things they buy online without handing over a CC number. Those people generally have a perfectly fine experience and they never post about it. When people do post about their experience with a company, they are far more likely to post negative experiences than positive.

Putting that aside, I think PayPal should absolutely get reamed for this behavior. Even if they're only fucking over one out of 100k customers, it is still completely unacceptable and I hope they suffer for it.

I don't believe PP taking money is the outlier here. I know far too many people in real life who have had funds seized and never returned. I imagine it's happened to more people I know but who haven't spoken to me about it. I have had PP close one of my early accounts and keep the money.

As much as I hate Visa/MC/Amex et al they have never just stolen my money, or even left me holding the bag if someone got ahold of a number (as opposed to banks which have always left me hanging a la PP).

I would add that folks should have a bank account connected to PayPal (etc) that is separate from your day to day accounts.

Not only will it localize any problems[0] but it will limit snooping[1].

[0] If PayPal wrongly deducts money from an account that has basically no funds in it you’ll be able to deal with the problem without having your actual funds locked up.

[1] Seems like basically every non-bank is switching from ACH deposit verification to a service called Plaid that requires your bank username & password, which then screen scrapes your financial details. There’s no reason to hand over your real life financial data when you can just use a dummy account.

>service called Plaid that requires your bank username & password, which then screen scrapes your financial details

That is hefty accusation. Wouldn't doing that be illegal?

Edit: Looks like they have an entire controversies section on their wiki page and banks are suing them over said sketchy practices. Classy stuff.

Not if it’s not otherwise illegal and disclosed in the terms you agree to. As part of a settlement they now have a “privacy-centric” portal so you can manage what they know about you, ostensibly. But it’s difficult to find, and I would wager that most people who use the service don’t understand what they’re getting into.

Everyone seems to use it now, and it’s increasingly difficult to link accounts using ACH micro deposits because Plaid can be configured to disallow manual linking if the routing number corresponds to a bank they support logging into.

I simply don’t do business with companies that use Plaid in that manner, it’s a hard stop for me. My bank’s customer agreement specifically prohibits disclosing user credentials to any other party, and when support is confronted by that, they typically have no idea what to do with that other than say “Plaid is secure”.

I've never heard of this before, who's everyone? Which country are you talking about?

I’m not sure if they’re in other countries, but I’m referring to the US. As for who uses them: off the top of my head, for well known services: PayPal, Coinbase, YNAB, Truebill, Acorns, Venmo, Stripe has an integration, I think Mint?, the list goes on.

More often than not I encounter them when trying to link bank accounts to anything now, except with other banks.

They have a history of imitating bank login screens and not disclosing that they’re not your bank. They settled a few lawsuits about that in the past few years and are a little more upfront, but I wouldn’t expect the average user to reasonably understand the situation.

Visa tried to acquire them back in 2020 but dropped the plan.

Visa probably got a look at their infrastructure, and saw liabilities that could expand to consume all of Visa.

> Seems like basically every non-bank is switching from ACH deposit verification to a service called Plaid that requires your bank username & password,

Why would anyone EVER do this. That has to be the most insecure and possibly catastrophic possible way to verify information.

Handing over your bank username and password to anyone would be a breach of the banks terms. So no, never do this.

I've been wondering about this as more and more services are asking me to do it via this same "Plaid" service. (I don't do it. I can't use some services. Cashapp mobile didn't want to let me withdraw cash without it; I figured out a way to on cashapp desktop).

Plaid is a company/service literally built around asking people to supply their bank username and password to a third party. (who then stores them (in cleartext, right?) for continued use!) I find it pretty astonishing.

(It's also literally training users to be phished, no?)

I'd be curious to see an article about it, with some details and context.

Here's a StackExchange discussion on it, and what a nightmare it is https://security.stackexchange.com/questions/198005/is-plaid...

I see a link to a lawsuit against Plaid in that discussion, but it's from 2020.

Interestingly, this page has someone claiming it's possible to register on Plain using ACH info https://teslamotorsclub.com/tmc/threads/for-those-hesitant-t...

This method is sometimes allowed, sometimes not. I'm not certain if it's an option the client who is using Plaid sets or if it's sometimes available based on the financial institution.

> and then immediately withdraw the funds to a real bank account.

If you link your bank account, you're at risk of them pulling funds from your bank account due to [reasons].

There's been such cases.

Reply on news.ycombinator.com