Hacker News Reader

Comment by qingcharles | Hacker News Reader

This is why I'm setting up a reverse proxy on another host in front of my web site, in case I get some fake takedown request from a competitor that causes my host to delete my account. At least if I use a proxy I can spend a small amount of time setting up a new proxy.

I used to have a competitor who would email PayPal every couple of weeks to tell them our web site had CP on it just so PayPal would instantly shut off our payment gateway while they investigated and then several days later cleared us and put us back online. It's too easy for people to make fake requests to take your business down.

View on HN

So PayPal's policy is "guilty until proven innocent".

Nice, hope they go bankrupt.

That’s pretty much how all payment processors work. The issue for them is that letting fraudsters continue making payments will lead to big Ls for the payment processors, since they end up being on the hook for the money that card networks will clawback or liability from regulations and money laundering laws.

You're free to try running a payment processor with a mantra of "Innocent until proven guilty."

You'll be a honeypot for every scammer, fraudster, and con artist ready to take advantage of that policy, your processing fees will be through the roof because of chargebacks, and the only people who will use your platform will be the aforementioned scammers, fraudsters, and conmen.

I'm sorry for the GP poster's situation, but there's really no way to make everyone happy, here.

Payment processors could assign reputation to longtime users, and they could have a vetting process to users as well, just like banks do. Get their full credit history, all the info of their owners, etc.

They could also communicate problems more clearly and provide better support to those who are sanctioned.

It's a reasonably solveable problem.

See: crypto. Marvelous technology. Ruined in the public's eye because of the amount of scams in it. Those same scams were used as justification for strict KYC laws. Which did not do much to stop the fraudsters really, hurt legally operating investors' privacy instead.

> I used to have a competitor who would email PayPal every couple of weeks to tell them our web site had CP on it just so PayPal would instantly shut off our payment gateway while they investigated

Isn’t this sort of behaviour criminal? (I mean the competitor submitting a fake child pornography report, not whatever PayPal did to respond to it.) And if not, surely it ought to be.

Yes, but it was done anonymously. The competitor denied all knowledge of it, but the guy he paid to do the reporting would talk to me through chat every day to gloat about it.

I ended up paying 15000EUR bounty to track the guy down. Found him in Germany. 15 year old kid. Had somebody talk his mother about him. Never had a problem again after that.

Did you ever try to recover the amount spent on the bounty? That kid caused damages to your business.

No, I took it as a cost of doing business. I only went that far after he managed to find my wife's cell phone number and started calling to harass her.

What is considered criminal depends on the jurisdiction, but I doubt making false reports to a private company is criminal in very many. At least in the US, you could certainly get sued for continually disrupting someone else's business, but to sue another party, they'd need to also be in the US so they could be served and actually subject to being forced to appear in a US court and a judgment against them could be enforceable. Otherwise, you end up in a situation like some Chinese business owner just building their own McDonald's. Sure, it violates all kinds of US ip laws, but if their home jurisdiction doesn't care about US ip laws, there isn't shit you can do about it.

> What is considered criminal depends on the jurisdiction, but I doubt making false reports to a private company is criminal in very many.

I live in the Australian state of New South Wales. I just looked up our state law on this topic. Section 314 of the Crimes Act 1900 says: “A person who makes an accusation intending a person to be the subject of an investigation of an offence, knowing that other person to be innocent of the offence, is liable to imprisonment for 7 years.” I haven’t looked at the case law or anything, but just going by the wording of the statute, it seems broad enough to potentially include false accusations made to private companies in its scope.

Of course, probably none of the parties in the case under discussion live in my jurisdiction, so its laws are irrelevant. Still, if other jurisdictions don’t have a law like this on the books, maybe they should

That's fascinating, thank you. I've been involved with criminal law for a decade and not seen a law like that. I wonder if the accusation has to be made to a law enforcement agency, or whether it would apply in my situation where the person made an accusation to a private entity?

> I wonder if the accusation has to be made to a law enforcement agency, or whether it would apply in my situation where the person made an accusation to a private entity?

I can't find any case law which directly answers your question; as far as I am aware, no case has ever been prosecuted under that law for the type of scenario we are talking about (but just because it hasn't happened yet, isn't in itself a bar for it happening some day in the future). This law never says the false accusation has to be made to a law enforcement agency, even though similar laws in other jurisdictions do explicitly say that; I don't see why a court would insert that requirement when the text doesn't explicitly contain it. But of course, nobody can be certain unless some day the matter actually comes before a court to decide.

Illegal? Probably, but I'm not a lawyer. I imagine the words "unfair competition" might be present somewhere on the legal paperwork. And if it's illegal but not criminal, you have to sue the competitor yourself, which is expensive and time-consuming.

PayPal probably should have some kind of hold on your account saying "don't shut off the account until we've investigated" but that might itself be abusable (see Facebook Xcheck). If this behavior is illegal they might also have standing to sue whoever is sending the reports.

All of that requires you to have at least some amount of evidence tying the false reports to the competitor, too. Or at least enough evidence to survive a motion to dismiss so you can use discovery to get the rest of the story.

> Illegal? Probably, but I'm not a lawyer. I imagine the words "unfair competition" might be present somewhere on the legal paperwork

I was thinking more along the lines of “child pornography is a crime, and making a knowingly false report of a crime is a crime”.

I know it is a crime (in many jurisdictions) to make a knowingly false report of a crime to law enforcement; but PayPal aren’t law enforcement. I don’t think that should matter though - if it isn’t already a crime to make a knowingly false report of a crime to a business, then it should be

After the second false claim you should have had your legal department reach out to theirs, and to the FBI, and that would have solved both your takedown problems and created a huge legal headache for your competitor. And by "headache" I mean time spent in prison.

Paypal has long had the ability to whitelist websites that are subject to this kind of harassment. If you choose not to avail yourself of these options, it's not Paypal's fault.

maybe i missed it but after searching i see this mentioned nowhere public. just ips to whitelist for firewalls and junk like that.

so like i get they could contact support again and ask about avenues but not knowing about this seems unfair?

You, you wouldn't know about the whitelist, it's internal and I only know about it due to a previous client having had your issue.

But going through legal channels and contacting the FBI are both things you should have known about, if you were involved on the business or remedial side of this issue since that's standard operating procedure.

Curious, what line of work are you in where your competitors are using such a tactic to target your online sales site? Because... wow.

I have an unrelated question: I assume "CP" stands for card-present here. Why would Paypal shut off your payment gateway for having CP?

It must be nice having a brain not corrupted by years of Internet!

Reply on news.ycombinator.com