Hacker News Reader

Comment by mcv | Hacker News Reader

Do they even know your mom's birthdate? Can't you just give them a random date?

Also, if you bought something at a webshop, why does PayPal know who it's being sent to? They just need to know you and the webshop, don't they? Who the webshop sends it to is between you and the webshop.

View on HN

Reminds me when I went to pick up my first UK passport when I gained citizenship. The passport office had no interest in looking at my foreign passport to verify my identity. Instead they asked me a series of question about my family, what profession they have, etc, that I know they couldn't have the answer to, unless they did some investigations that I think were highly unlikely given the volume of applications after the Brexit vote.

I think instead they were just checking if I looked like I was answering the question confidently or if I looked like I was trying to make things up.

Oh yeah, they do that all the time. I have dual citizenship and they’ve asked me a few times upon leaving the UK where I was staying, who I was with, what those people’s professions were, etc. I think it’s just random spot-checks to see if you look nervous. But if you get annoyed with them and tell them you’re a citizen they stop.

I was flying from the UK to the USA once, on my own. They asked me what my hobbies are and what the most recent movie I saw was.

A lot of online credit fraud schemes involve sending things to an unwitting 3rd party.

Sorry, could you go into more detail here? This happened to my mom several years ago, and we always wondered why.

One thing it could have been is the “brushing” scam

Creating fake orders to enable fake reviews for a product to be posted, boosting the product listing.

https://en.wikipedia.org/wiki/Brushing_(e-commerce)

Steal CC info from person A.

Buy item from using junk email address and shipping address of person B.

On delivery day, wait near person B's home, and grab the package when UPS delivers it. If person B manages to get to the package first, scammer is only out some time.

Junk email and 3rd party mailing address - harder to track scammer. Of course, this ignores IP address and similar - smart scammer would also use Tor and other tools to obfuscate the online transactions.

That's a good point, I don't actually know. I just assumed yes because they would ask. I also didn't want to complicate the process of releasing the funds – perhaps that was naive.

I believe in this checkout flow, it kicked me over to PayPal where I could specify the shipping address there. PayPal probably relays the address back to the merchant, akin to checking out with Apple Pay where you specify a shipping address via the Wallet app.

Sometimes when a credit card payment is handled by Paypal they ask for my first name. I enter my initials, since that's what actually on my credit card and is what I always use when making payments with it, but they don't accept it. Maybe somehow they know my actual first name, but I'm not going to give it to them so I then abort the payment.

In many cases, you can enter any name. Have fun.

> I enter my initials, since that's what actually on my credit card and is what I always use when making payments with it, but they don't accept it

They (or probably just the form) don't like dots and/or too few characters in the field.

As sibling says you can actually enter anything you want in the "CARDHOLDER NAME" field 99% of times. For years I type "$BANK NAME" or "$BANKNAME CARD" (note the space) there and I never been denied.

Interesting. I have tried all combinations with and without spaces or dots, but I don't think I ever considered entering something not truthful, even though I have done that in other online forms thousands of times (one favourite is entering the street address of the organization I'm interacting with instead of my own when ordering non-physical goods; and fake birth dates of course). There's something about payments that apparently I consider more "holy" than other things.

Back in the day you could [sometimes] see FIRSTNAME L. in the sales receipt, but that was when the magstripe was the only option. Apparently it was a form of anti-fraud measure back in 20th century so someone could see what is printed on the card and what is written in the receipt (aaaaand what?).

With the move to teh chip cards and later to PayPass (which doesn't even transmit your card number in any meaningful way) rendered inclusion of anything viable there meaningless.

> There's something about payments that apparently I consider more "holy" than other things.

WEll there is always some idiot what would make it hard for everyone else. Like web designers who do ahve a very... interesting understanding of the outside world (people with Verylonglastnames-SometimesDoubledUp? living on Cultist Monks Revolution of May 1111 year Street? Don't kid me, they don't exist!). Or admins who made you think twice to enter bullshit in the form because the scary red letters says you would need a national ID to receive the package (and names there and in the receipt should be the same!) only for the courier just give the package and be on his merry way not even bothering to check anything (and sometimes forgetting to take money for the package paid in cash, lol).

For now I only know where you need to give your real (ie printed on the card, not your real one, lolagain) name is when the card data is processed manually. The only country where I know it still exists is US of A, last year friend of mine needed to fill out a PDF form (thankfully electronic without the need to print and send it physically!) to pay for Untappd Business.

I learned recently that a common option for address verification is to concatenate all the numbers and compare that, disregarding all the words.

"Please fill out the STATE" is the bane for anyone who orders from the States, along with ZIP codes. Thankfully 90210 works most of the time.

And the UK's belief an entire street address always fits into a single short line is a bane for many foreigners. Every country seems to think they're the norm.

Indeed, if you use privacy.com to get a temporary credit card (this is for totally legit purposes, folks!), you can use any name and address on the form you enter it in. Only the credit card #, expiration date, and security code are verified.

> why does PayPal know who it's being sent to? They just need to know you and the webshop, don't they? Who the webshop sends it to is between you and the webshop.

No, it's not, because the buyer has chosen to use PayPal's services for protection, and in order for the merchant to fulfill their end of the deal and also receive PayPal's protection (against chargebacks, disputes, etc) the merchant is required to ship to the address on the order (which PayPal has a record of for verification).

If you offer PayPal as a checkout option, you are required to follow their rules for fulfillment, otherwise you risk losing a PayPal dispute if filed later on.

I've signed-up for dozens and dozens of things with January 1st 1900 as my birthday. They never check.

I’m using 1970-01-01, since it looks nice in their database. Could also switch to 1992-02-01 now.

> Could also switch to 1992-02-01 now

Huh?

696902400

It looks twice as nice in unix time ;)

1992-02-01T18:41:36.969Z Seems nice too, if you want to get specific.

If the merchant used PayPal checkout, then PayPal does all that processing then sends the information to the merchant.

Reply on news.ycombinator.com