Hacker News Reader

Comment by crazygringo | Hacker News Reader

> It also seems like a convenience feature that PayPal should consider locking down. I immediately assumed this was some form of scam...

I don't really know how you'd prevent this or why anyone would fall for it. It's just sending an invoice. And PayPal clearly says you can safely ignore it if it's not for something you bought.

Sellers need to be able to send invoices, both for online and in-person things (like classes). And they need to be able to send them to any e-mail address, like a student who just signed up.

If you "lock it down", it doesn't work.

View on HN

They could force the invoice sender to verify an email address, and then include this email address in the invoice email. This way, nobody can pose as "coinbase" -- maybe as invoice@coinbase.fakedomain.com, but not as invoice@coinbase.com.

PayPal has dramatically improved this email since this scam started making the rounds a few months ago. Most of the safety notices weren't there originally, and they at the time allowed the seller to identify themselves as "PayPal", which made the email look a lot more legit.

> since this scam started making the rounds a few months ago.

A few months ago? I've been getting these intermittently for years.

I don't use Paypal for different reasons, but it still amazes me how popular it is as a tool for scammers. Someone on a different internet forum recently tried an unsophisticated scam impersonating an African aid worker and asking me to send money for the children. I was bored and baited them with computer generated replies. They wouldn't even take cryptocurrency, only Paypal. And it's a similar situation for other scams that are common in my city where they trick people in making bank transfers to the fraudsters account.

I don't understand how there can be so much fraud in legacy finance, and everyone simply accepts it without holding the companies responsible for not cracking down harder. Yet if it's on a public blockchain where everyone can observe the movements, it's supposed to be worse? Wonder how much more of it we'd see if bank books were public.

A few months ago was when I first saw it and it hit the tech news and PayPal finally did something about it. It wouldn't surprise me if it's been around much longer.

Imposing an up-front cost seems like a reasonable option.

> PayPal Invoicing has no set up or monthly fees. When a customer pays you online, you’re charged a fee based on the amount of the purchase. Fees vary by country or region.

[1]: https://www.paypal.com/us/cshelp/article/how-much-does-it-co...

At minimum they could check for sellers setting their name to “Coinbase”, or other well-known names. In theory it should also be possible to detect scam invoice messages with similar techniques to spam filters.

I guess they could severely rate limit based on previously undisputed transactions. If it's a new account or an account with 5 undisputed payments over the last year, it should not be possible to send out 10.000 bills. They could also charge an increasing deposit 10 cents for the first 10 bills, 20 for the next 10 or an increasing percentage of the amount billed. They can refund it if the bill has been paid and not disputed. Should not deter any real user, but gets expensive for someone hoping for this 0.001% success rate.

If a scammer is aware of a real transaction, they could spoof the amount and requester name.

Reply on news.ycombinator.com