New PayPal policy opts you into getting robocalls | Hacker News Reader

New PayPal policy opts you into getting robocalls

washingtonpost.com

97 pointsSimplyUseless63 comments

I am utterly unsurprised. Normally, you'd expect a payments company to be one that needs to cultivate trust; however, PayPal seems determined to test out every scummy business practice they can.

Go ahead Paypal! Just try and get past my voice/dtmf Captcha system on my Asterisk PBX with your robocaller. I whitelist friends and family so they don't have to go through the Captcha if they call. So far, I've received no friends and family robocalls, but receiving one eventually would not be surprising.

This is awesome. I am pretty familiar with Asterisk and can think of a couple ways to do this, but I would love to see a blog post or something detailing how you accomplished this.

Seconded! Please take moment to write up how you accomplished this wizardry, for the benefit of mankind. (Or at least the Asterisk-using subset thereof...)

1. The following macro does the captcha:

[macro-captcha] exten => s,1,Answer exten => s,n(retry),Wait(2); exten => s,n,Set(pin3=${RAND(100,999)}); exten => s,n,Playback(reallivehuman); exten => s,n,Wait(1); exten => s,n,SayDigits(${pin3}); exten => s,n,Read(pinent,,4) exten => s,n,GotoIf($["${pin3}" = "${pinent}"]?ok:retry) exten => s,n(ok),Playback(queue-thankyou);

2. The whitelist jumps around the Captcha macro in the incoming context:

exten => 6199111111,n,GotoIf($["${CALLERID(num)}" = "2024561414"]?whitelist)

exten => 6199111111,n,Macro(captcha); * Do captcha exten => 6199111111,n(whitelist),Goto(inbound-calls-main,s,1);

This also buys me peace and quiet during the few days leading up to election day. (Political robocalls are what caused me to implement it).

Perfect! Your hard work has subsequently been stolen and implemented elsewhere. Thank you!

ah yes, asterisk <3 many fond memories of running a PBX in my basement and two cisco IP phones and a crappy VOIP trunk. I remember beefing up the wakeup reminder functionality too (that might have been asterisk@home specific; before they went and became jerks)

so tempting to set that up again!

That sounds like a fun weekend project. Any good Asterisk guides or just use the official documentation? I wonder if a Raspberry Pi could handle it.

The old Raspberry Pi was able to handle 1-2 simultaneous calls with no signs of trouble. We were able to run a 3 way call between 2 lines and a cell user without problems.

The newer Pi should be capable of handling ~3-5 calls, assuming similar scaling.

I was handling 3 calls on a PIII and 256MB of ram. the Pi, especially the second edition, should handle asterisk fairly well; it actually makes an ideal PBX server!

Welcome to the voice menu from Hell. We used to do that with AT&T Voice Power cards back in the day.

That only helps their stats. Robo dialing wants to avoid less than 6 second calls, and generally keep their average answer ratio and call duration up. The best bet is to answer and hangup within a few seconds

My wife has a small home business that ships internationally. PayPal is the best method for taking payments from her clients. She generates more revenue through that than from credit cards. Without any alternative, well, this just sucks.

Switch your number on file to a Twilio number.

There's a pretty solid chance PayPal will have predicted these switches, and keep the old numbers on file.

Because the new policy allows for calling no matter how they get your number, it probably won't help.

Can't hurt to spend a few minutes putting a Twiml file in S3 and buying a number for $1.

I closed my Paypal account today because of this. Not everyone can do that though.

Am I the only one who thinks this is likely for the purpose of additional Know-Your-Customer preverification, rather than for advertising?

If Paypal can be sure that fewer of the accounts pumping money through the system are doing so for anonymous multi-identity money-laundering, then the horrifying "we froze your account because started getting Real Money through it and that's suspicious" step can happen less often.

Though, thinking about it, even just switching to mandatory phone-based 2FA (with options to either call or text) would technically require a "we can robocall you" clause. The 2FA system is a robot!

I wouldn't have a problem with that but the terms specifically mention surveys and special offers.

Hmm, you're right.

> We may place such calls or texts to ... (v) poll your opinions through surveys or questionnaires, (vii) contact you with offers and promotions;

I'm pretty certain this same language is in my agreement with my bank, and with the VISA corporation. I rarely get calls from them (other than the occasional "hey was it you who made that e-transfer from your account just now") but I do get their spammy stuff via email. I think they prefer email as a channel for sending this stuff as long as they know your email, but will send it to your phone if they don't know it.

I don't know how that would work with Paypal, who obviously knows your email.

I'm pretty certain, on a second reading, that the original purpose of this is actually very clear, though:

> We won’t share your phone number with third parties for their purposes without your consent, but may share your phone numbers with our Affiliates or with our service providers, such as billing or collections companies, who we have contracted with to assist us in pursuing our rights or performing our obligations under this User Agreement, our policies, applicable law, or any other agreement we may have with you.

They want to be able to pursue people who have negative Paypal balances. Right now, a lot of them don't have a card attached to their account, or only have a prepaid card or something, so they have no idea who they are and can't really get their money back.

Why is Paypal always going out of its way to be horrible?

The only way to opt out is to cancel your Paypal account before July 1

From the BGR article referenced by WaPo (http://bgr.com/2015/06/02/paypal-user-agreement-robocall-rob...)

It is really convenient to automatically pay my bills through PayPal (or any widely available payment abstraction layer), but I may have to switch back to my debit card if they insist on this policy.

(My debit card is much less convenient because some new attack happens at least once a year where they have to send out a new card.)

Why not use a zero-fee credit card, rather than your debit card? If a problem happens with your debit card, your bank will eventually fix it, but in the meantime your account may be drained. If a problem happens with your credit card, you can dispute a charge before you pay.

Alternatively, check with your bank and see if they have a bill-pay service.

Most payees who you pay bills online with charge a fee to take a credit card (utilities, etc).

Interesting; I haven't seen that before. Thanks.

I have multiple checking accounts to avoid this problem.

Or pay bills with a credit card and get points on the card for your trouble. Plus an extra month to pay.

This is the only thing that would make it worthwhile. I have been wanting to get an Alaska Airlines card...

I'm not trying to be "that guy", but I would suggest not using a debit card. It's my understanding that debit cards are like cash, so they carry a lot of risk. If something happens and your account gets drained, you are likely not getting that back. Credit cards are much better to use.

For extra online security, use a virtual credit card with a preset limit.

Does anyone provide those anymore? A few credit card vendors used to do so, but seem to have stopped.

(I know you can obtain pre-paid cards in large increments, but that doesn't really help here.)

It's basically impossible these days to have a card without Zero Fraud Liability (in the US.) If you somehow have such a card, RUN. This is not a drill. You need to get yourself and everyone you don't wish death on the fuck away from that bank 30 years ago. Go literally anywhere else.

However, even at banks with good policies, "extra" security measures are excluded from Zero Fraud Liability. PIN transactions, Verified by Visa, etc. appeal to the HN spirit of "taking responsibility" for your own security. But you are doing just that - "taking responsibility." If the added layer of protection can be broken (hint: it can) then you will have no recourse. For a credit card, your loss is at least capped at your credit limit; some debit cards have transaction limits of $15k+. We're talking possibly your entire account, irrecoverable, because you were an idiot and tried to protect yourself instead of letting the rest of the system eat the loss.

The security of your credit card number is everyone else's problem. Treating it like your own problem is actively sabotaging your ability to recover from the inevitable fraud.

I've checked. All the normal credit card protections apply with my credit union.

um, what? Jeeze. I like the convenience of paypal, but I also like it when my phone doesn't ring with nonsense.

realllly don't want to have to cancel my account, but looks like no alternatives if they're going to play it that way.

So be it!

I'm actually really pissed off by this. If it wasn't clear. Are they TRYING to drive customers away? there's literally no way I can accept that shit.

Aaaaand canceled! had a paypal since I got on the internet, crazy that it's gone now.

Guess I'll have to keep my wallet by the computer now.

The "National Do Not Call List" can be useful in Canada.

Paypal may only contact you if you've requested info in the past 6 months or used their service in the past 18 months.

If they call, you can demand that you be put onto their internal Do Not Call list. They must honour that and you can make a complaint if they do not.

http://www.crtc.gc.ca/eng/info_sht/t1031.htm

do politicians and some charities get a free pass when it comes to ignoring it like they do in the US?

They do.

The do not call list has an exception for robo-campaign call. Isn't it interesting that our lawmakers would put in such an exception?

Couldn't having an account be construed as having used their service, though?

so, what are some PayPal alternatives?

Depends on the functionality you need. For payment processing, try Stripe. To send money between individuals, try your bank's "send money to anyone" mechanism if they have one; I don't know of good alternatives there.

Venmo is evidently popular for interpersonal transfers. I haven't used it, but then again I'm right on the "Venmo line:" http://qz.com/277509/read-what-happens-when-a-bunch-of-over-...

(TL:DR; effectively everyone at QZ under the age of 30 is using Venmo regularly, and those over 30 are kind of baffled.)

Venmo is owned (indirectly) by PayPal. Braintree bought Venmo, and PayPal bought Braintree.

Transferwise. I have used it internationally to great effect. It is incredibly easy and fast. Another option here for easy and fast is Popmoney.

Square Cash. Ridiculously good. https://cash.me/ Payments show up magically in your bank account.

Downside: transfer limit is like $2k.

Google Wallet lets you send money to individuals, even as an attachment in GMail, but not CC backed; you need to back it with a debit card IIRC.

Disclosure: I work for Google, but not on Wallet.

Many banks have free billpay services, you can send a check to someone for free, they can use their bank's mobile deposit to save the trip to the bank. Not ideal, but it also doesn't robocall you.

For instant, worldwide, international transfers in the 21st century... You suggest cheques and snail mail.

For real?

This blew me away upon moving from the UK to the USA. In the UK, my (old school, household name, bricks and mortar) bank's online service lets me wire money to any other British account completely free, up to multiple thousands of pounds. They all do. It's instant to many banks, up to 3 days for others. It has digital signatures for payments using a little pinpad device. It is how moderate sums of money moves around between friends and family and invoicers.

In the USA, the same facility causes the bank to mail a paper cheque. I was flabbergasted when I discovered that. In 2015, cheques (checks) are still absolutely everywhere. My debit & credit cards don't have chips. It's like the country is 15 years behind Europe.

Things are moving in the right direction though: many stores no longer take checks, and a new account I opened with a major institution lets me wire money to (and draw from, which is terrifying) nominated accounts with other institutions online for free, and their card has a chip on it.

For small personal transactions, I like Square Cash [1] because I can pay by sending a simple email. Deposits also seem to be pretty fast.

[1] https://squareup.com/help/us/en/article/5372-square-cash-wit...

For interpersonal transfers, I had good luck with Dwolla for a while before switching back to Paypal for faster transfers. If they go through with this, though, I guess I'm back to Dwolla if they haven't yet gone evil. Was pretty happy with them other than for the speed.

Surprised that no one has mentioned Google Wallet (https://www.google.com/wallet/send-money/). You may have issues sending money outside of the US, and a Google account is required. No fees and I've never had a problem with it.

> You may have issues sending money outside of the US

So basically the only reason why people use PayPal is because of international transfers, and as an option to that you propose something which only works in one country.

Sounds great.

Surprised no one has mentioned it!!

> So basically the only reason why people use PayPal is because of international transfers

Huh?

Does that make me the only one who uses PayPal solely because a bunch of people selling things online use PayPal and it's somewhat more convenient than having to fork over my credit card info every time I want to buy something?

> Does that make me the only one who uses PayPal solely because a bunch of people selling things online

Selling things online, on the internet, where there are no country borders.... Sounds like international transfers and payment to me.

Am I missing something?

The vast majority of my PayPal transactions are domestic.

Sure. Yours are. Are at least so you think. If they weren't, you wouldn't know.

Now try to repeat that trick with a nationalized bank-service.

My point was that my use of PayPal - and presumably that of many others - is not explicitly because of the ability to do international transfers, but because of the convenience of not having to send my credit card information to dozens or even hundreds of different merchants. Whether or not international transfers are allowed has little bearing on the reason PayPal exists in the first place; it's just a nice feature on top of the core feature of not having to manage so much risk on one's own.

> basically the only reason why people use PayPal is because of international transfers

[citation needed]

Amazon payments?

In addition to the other recommendations, there's also Bitcoin (and other cryptocurrencies), which (for the time being) is the only option that's mostly immune to PayPal-style dickery (depending on how you manage your wallet and what methods you use to turn USD into Bitcoin and vice-versa; most formal American exchanges, for example, do have to collect quite a bit of information per relevant laws).

Unfortunately, cryptocurrencies have their own convenience issues.

I'm out!

Reply on news.ycombinator.com