Hacker News Reader

Brazil (1985 film) was not supposed to be an instruction manual!

The scale of these absurdities is just wild. Years ago I signed up for a domain for my blogger.com blog. At some point google decided to transfer the management of that domain to google workspaces ... I don't know how or why but they did. So when it expired I was told to login to google workspaces, but I don't have a google workspaces account at the email they kept emailing me at ... and their emails never told me what email to login with.

To get help on the website I was told to contact my google workspaces administrator ... but not who that is.

I figured out who the domain registrar was and told them my story and they helped me get a hold of the domain. Kudos to them to having a very fast and effective support team.

Now even more years later I get more emails from google workspaces that my account is expiring and sorta implying some consequences (but not actually saying) ... not that I can do anything about it.

At this point I have it in the back of my mind that any given day google could find this weird situation, assume malice, and ban me... a situation that 1. I didn't make happen. 2. I can't even fix. 3. I don't even know how it happened / what the problem is / google won't really tell me.

by the way https://www.youtube.com/watch?v=X27Sw7r6gB8 (DEF CON 30 - Paul Roberts - Brazil Redux - Short Circuiting Tech-Enabled Dystopia Right to Repair)

Are there options for small business payment processing that don't invite comparisons to dystopias? I think crowdsourced patronage is a great model for society to fund creative works now that copyright regulations have largely been captured, but with Patreon ignoring security, and paypal being this disfuncional... Is there a safe way to accept something like vinmo for micropayments?

Paypal owns venmo

I think Kafka's The Trial is an even better fit - in Brazil, you could at least see some of the machinations unfolding - in The Trial, like in reality, you only hit a wall of the bureaucrats telling you that your case is being studied with no way of knowing when or if you will ever get anything more.

This sounds like AWS support on a bad week.

Or Google support on a good week

I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to let me log in without it.

Surprisingly, customer support was very helpful and let me transfer out the (minimal) balance in the account to another, completely unconnected PayPal business account I happened to have. Which is even more disconcerting, because it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane.

I'm still (very, very occasionally) using that business account today, even though the underlying business also ceased to exist years ago. I wonder when the banhammer will drop?

Maybe for your account they registered the wrong number as well?

I could’ve gone on using it if I hadn’t told them. But in NL this is an issue (hence I tried so hard); bank accounts to companies need to be closed asap when the company gets closed and you definitely cannot pay or receive money with them as that will anger the tax office.

But PayPal is not a bank or registered as a bank, so would that matter?

They certainly are. From their NL terms and conditions [1]:

> Who provides the Service?

> The Service is provided by PayPal (Europe) S.à r.l.et Cie, S.C.A. (R.C.S. Luxembourg B 118 349) (“PayPal”) to registered users in the European Economic Area. For details on how to reach PayPal, please refer to this page on Customer Service, or in an emergency, see “What to do” below.

> PayPal is duly licensed in Luxembourg as a bank (or “credit institution” in legal terms). We are under the prudential supervision of the Luxembourg financial regulatory authority, the Commission de Surveillance du Secteur Financier or CSSF. The CSSF maintains a register of the organisations that it regulates at https://supervisedentities.apps.cssf.lu/index.html?language=.... PayPal is number B00000351 on the register, but you can also look us up on the register by our name.

[1] https://www.paypal.com/nl/webapps/mpp/ua/servicedescription-...

Does "very very occasionally" mean you use it frequently or infrequently?

It means infrequently.

Transferring money out is far lower risk than unauthorised account access.

If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small.

If they give unauthorised account access then there's far greater harm including risk they'll get penalised by regulators over data security as well as the damage being potentially hard to undo if further changes are made to the account.

The point is that requiring cvv for a login is stupid, not that the risk levels are different.

Does it become acceptable to require the blood of my first-born because the risk levels are different?

Of course not. They're not even allowed to store that in the US (PCI-DSS), so the other poster must not be in the US.

Your GP had "it meant they were sufficiently convinced about my identity to let me transfer money out, but not enough to let me login in. Insane", and your parent is explaining why that's a non-insane thing.

GP here. I found every part of the process insane. To enumerate:

1) getting locked out for not having the CVV of some random card that expired a decade earlier

2) being allowed to transfer money out, but not to login into the account

3) being allowed to keep my second account, even though they don't trust me enough to give me access to the first

None of these make sense individually, and they make even less sense as a whole.

They probably couldn't see the CVV but were going to run the card and see if it verified.

fair enough

In a large corporation, different precesses can be handled and developed by separate teams often working in silos.

After many years, there may not be a force to assure these processes are consistent, have rules that make sense in relation to one a other. I think the answer may just be it’s “dumb” because no one cares or has the power or will to look at things holistically.

> If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small.

But, once he'd learned that all of the other ½ cents are left floating around inside the megacorporation's database, Gorman hacked into the company's computer system and funneled them all into his next check, accruing the amount of $85,789.90, (a crime that would be later be known in slang as "salami slicing").

https://superman.fandom.com/wiki/Gus_Gorman

I closed my account when they discovered suspicious activity in my account, at least claimed so but apart from locking me out until I prove I am me with photo ID copy and independent sources about my address (bank statement, utility bill, ...), basically collecting more data on me, they did not make any steps tracking down this suspicious activity, not even explaining what it was, they did not report it to the authorities! It was complete unresponsiveness when I asked for details on the event, asking about reference to the case at the authorities, told them that I will report it myself to the authorities (someone doing something to my money!!) and need some info, nothing, complete silence!

My conclusion that they simply lied to my face!

I was around the time when PayPal got some bank like regulatory status in Ireland and might have needed some more data so they forced me to provide through a bullst claim. At least this is the only scenario I find feasible. I had very little money there, after gaining access again (giving them a lot of data on me) there was no sign of any activity there that not belonged to me, nothing.

I decided that their practices are shady and I will never ever trust them!

(I did not report it eventually to the authorities, even the preparation for it took time with little supporting material, and I already had an unrelated matter to tackle, it was simpler leaving them and spread their reputation. PayPal definitely did not bother reporting it as I was never approached or questioned about the suspicious activity in my account ever. It was about 10 years ago btw.)

This is normal for almost all (all?) large corps; they don't have to tell you why the account was terminated/blocked so it could be anything; something you said online (about them / founders etc), something you paid they don't agree with, just ROI vs TCO for your spending habits etc etc. They don't have to tell you and 'suspicious activities' is an easy one: adsense/adwords uses it as well. They use 'if we would tell you what it is exactly and how we measure it, it will allow evil actors to use that against us'.

Same happened to me. Did they keep sending emails you need to agree to their new terms of service and to refuse you need to agree to their new terms?

Same here, someone tried to transfer money to me and PayPal decided that they didn’t like that, and that they wanted my ID. Then, they wouldn’t let me close my account, and when I finally provided some sort of ID they claimed that my name is wrong and as such can’t do anything until I provide more ID with an account name change request. All of which apparently makes the account impossible to close. Or so I presume, having talked with support four separate times, receiving completely different reasons/answers, and then finally saying that they’ll force-close my account, which they never did.

Now when I do absolutely need to use PayPal, I use my card on a friend’s account (with their permission).

It's actually illegal to tell clients when a Suspicious Activity Report is filed. It's quite possible they filed one. It wouldn't necessarily trigger any investigation but it would be kept on file.

> I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to let me log in without it.

LOL, I kinda had the same issue, but I had to remember the last 4 numbers of some old credit card. Couldn't find it in any email, so yeah ... couldn't use my Paypal anymore.

This was a while ago, so maybe it was the four digits and not the CVV for me as we? Not sure, but I do recall that the card was waaaaay expired (as in, a decade ago) and it took me a while to figure out what card they were even referring to.

To be honest I'm surprised they even tried as hard as they did. Normally in my experience if you cost them more than about 30 minutes of staff time fixing any problem, they'll ban your account just on the basis that you're costing them more in customer service than the revenue you bring in.

The Dutch support is really very good. Before they had local support it was even worse. But the dutch support, as far as I have used them (quite a lot from begin ‘20 to begin ‘22 as I tried to convert my account), they were professional and nice, but have very little power and need to talk to their US counterparts all the time (which, I presume, is why the weeks/months fly by over something I would assume is a support-portal lookup).

Edit; I guess by having written this, if a PayPal manager reads this, the Dutch support will get an ‘urgent read now!’ email from their manager to not waste so much time on customers…

I'm glad your experience was better than mine. I had to get a lawyer involved after the Dutch support told me I would be refunded if I returned an item, and then after I sent it back, denied the refund.

Well, my story didn’t end well, but at least they were nice and courteous. Maybe I just got lucky there but my experience with US support was random phone hang ups, infinite queues to ‘I will just fetch this info, moment sir’, people being short, blaming me, barking insults etc.

I guess you found out as well, like me, the US has the last say in any matter and they don’t really listen to their overseas colleagues if their flagging algo/AI says ‘nope’.

Did the lawyer work? If it did, I am happy that at least it seems possible to go against them. I will never touch them again though.

The lawyer did work, thankfully.

Not if you want to get banned lol.

I've contacted one time PayPal Japan to transfer money to a personal account from PayPal Brazil because it gave me some error. They told me I should contact PayPal Brazil because the recipient account was not verified. On PayPal Brazil, they told me that I could only transfer personal money through Xoom, which is another service from PayPal. But when I tried, Xoom doesn't work with Japan. After I asked PayPal Japan again, they confirmed only business accounts can receive money in Brazil. It took around 3 weeks going back and forth until they could give me a clear statement saying that what I tried to do was impossible. I wondered why the interface was allowing me to chose this kind of transfer in the first place.

So it's a payment service that can't transfer money between accounts?

Probably because he is/was Dekasegi https://en.wikipedia.org/wiki/Dekasegi and there are some specific rules to move their money back to Brazil

This story has pushed me over the line, finally triggering me to close my PayPal account. I can't describe the sum total of stimuli that brought me here, it's a gestalt, a gut feeling.

Thanks. I feel lighter.

PayPal is excellent for buyers, horrible for sellers. Just don't keep any money in it and don't let them convert currency for you.

This i use it often when buying stuff overseas, every time there has been anything i just dispute and get my money back.

But not keeping money on them is NOT enough as a seller to extricate yourself from that morass.

They will find subtle ways to force-link your real bank account to paypal, and then its game over. They have the keys to the kingdom.

One day you will get some random charge on your account that keeps growing and growing and you don't recognize the transaction at all, but you can't do anything because they can pay themselves from your linked bank account.

I advise all businesses that use paypal that at worst case, link a completely unrelated bank institution to paypal, and then keep this secondary bank to low funds as often as possible.

Otherwise, you will never know when paypal may poison the well and your physical bank business operating account is suddenly unavailable!

Definitely. My second sentence was directed at buyers.

> They will find subtle ways to force-link your real bank account to paypal, and then its game over. They have the keys to the kingdom.

for most reasonable sized US banks, once you have one account that has enough money not to be charged fees, you can open additional accounts with them, and easily transfer money between them. You could open a paypal-only account and keep it empty. You could also close it, and open another one whenever you need to verify an account with PayPal again

Paypal owes me $200.

They locked an account and wouldn't unlock it.

Years later I get a letter from the State Comptroller about how they are about to receive my balance ($200) from PayPal because they (PayPal) haven't been able to contact me (Don't they have my email address?) There's a number to call, I call it, the PayPal employee says "How do you want your money, check or in your PayPal account?" I choose check, of course, because the account is locked.

And that's the last I ever heard of it. No check. No new letter from the comptroller. PayPal must have kept it. They found a loophole in the system.

It's literally not worth my time to pursue it, so instead I just mention this story in public from time to time.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

I have a business account that now has a whole series of notification boxes, some empty, one saying the account is permanently closed, and one saying I need to update KYC to restore the account.

Filling in the KYC sometimes restores it, but then it gets locked again because the KYC changes account details, which triggers the KYC process and reverts the changes.

I have been trying to upload some information they asked to verify my business account. For a new business account I opened

I already have 1 business and 1 personal account which is their limit and got permission from PayPal to open this one.

I kept getting an error when I go through the official form. Possibly because I have a linked account already.

So I talked to customer support and after a huge timesink and getting passed around between several agents and contacting them multiple times they gave me an alternative place to upload.

Which worked but I think no one saw the documents as that alternate form.

I contacted customer support again and they said that alternate upload form was just for personal accounts.

In the end I just decided not to accept PayPal as means of payment for that business.

Luckily wasn’t a big deal for me in this case.

you got off easy , friend

This is so quintessentially Paypal, were they upfront about their services, they'd put this testimonial on their home page.

They are not a "weird" company -- they are a piece-of-shit company

Exactly, they have a monopoly and abuse it in the worst possible way. I'm glad someone sued them and won, his politics don't matter to me.

What do they have a monopoly in? I've only used them as a consumer to pay for things and they are usually one of several options I have.

What monopoly? I've literally never used PayPal. I did use Venmo for a while til they said they were closing my account unless I provide them with information I already provided them with, I decided that I'd let them close it and now they won't stop offering me $10.

Same for transferring accounts to a different country. Can’t be done according to their useless help line. Has to be closed and reopened under a different email addr according to them

> PayPal is such a weird company...

I disagree. ETSY and eBay appear just as weird, crazy, and up to various odd machinations. The Internet is littered with tales of people completely baffled and perplexed at having their accounts suspended without explanation, then getting the runaround or cold shoulder from customer service.

There is also speculation about some type of secretive blacklist that is floating around and used by various companies for preemptive actions.

> 1 hour later I received an email from PayPal that I am permanently banned as I am trading with a business account of which the company no longer exists

I hate that I have to do this and to be viewed as defending a vile organization like PayPal but this specific incident here could be the result of another department/silo (compliance/anti-fraud?) within the corporation issuing an immediate ban for your account to avoid or limit any regulatory burden.

Yes in general

But in this case they knew it was a special case and should have informed the other parts of PayPal so this would not happen.

So this is not a good defense

I am not defending them at all, their total disregard for their customers, and lack of courtesy make them in my book one of the most awful companies to work with or patronize, but usually organizations of this gigantic scale are compartmentalized, and work in silos, and thus you have to figure it out yourself, or through an insider, how to navigate the bureaucratic maze, and accomplish the task at hand and not be disheartened with the initial frustrating response that you might get from the first line of contact with them.

It honestly doesn't really matter. That's a plausible explanation, but the customer shouldn't have to care / make special allowances because this is a big company with lots of people. It either does good things or it doesn't, and in this case it didn't.

I could be wrong, but isn't it flat-out illegal for a company to refuse to remove/delete your account on your request? I'm pretty sure GDPR, at least, requires this explicitly.