Bank account tied to PayPal? Beware.

[MJ DeMarco]

I pulled this from another forum ... this made me realize that someone could login to my paypal account and initiate a transaction, totally cleaning out my bank account. If that happens, I'm STUCK WITH PAYPAL'S dispute resolution. And PayPal's assurances? "Don't worry, we will send you an email" -- really? They sent this poor guy an email and they f*cked him over, refusing to refund over $1,000. Imagine if this was $10,000 ... remember, this is your bank account!

As a result, I removed my bank account from PayPal -- there's no way in hell I'm giving these bozo's and their "dispute policies" any chance. Control, control, control...

.
.
.
.
.
.
.

Board Message

Paypal users beware. 100% buyer protection is BS. I am going through one of the most ridiculous situation of my life, and I hope by writing this, I might save someone from dealing with the same thing.

I usually don't keep any money in my Paypal account, but about a week ago, I sold an item on Ebay for $1400 and they paid by Paypal. Later that night, I receive a confirmation email from Paypal about two payments I made. One was for $12 and the other was for $1200. I immediately assumed it was one of those scam emails where they try to get you all riled up so you will log into your account from the email and then they will have your account info, so I close the email and went to Paypal.com. After logging in, I confirmed that two payments had been taken out of my account for $12 and $1200. I immediately disputed the transactions. The next day, I called Paypal (during business hours) to confirm the disputes. They told me that it would take about 3 days to reach their decision.

The next day, I received an email saying that they decided in my favor on the $12 charge and refunded the money back to my account. Great. It wasn't until a day later that I get the next email from Paypal. This one says that after investigating the situation, Paypal has decided that I did approve the $1200 payment, I would not be getting the funds back, and the case was closed. You can imagine how I felt about that one.

The next day, I called Paypal to try and figure out what was going on. They told me that they confirmed that I did, in fact, send John Smith (obviously not his name) a payment for $1200. I told them that I have never heard of John Smith, and I have never communicated with anyone at his email. They told me that someone from my computer authorized the payment. I told them that there was no way that a payment was authorized by me for $1200 to John Smith. They told me that a room mate or someone else in the house must have done it. I told them that the only people in my house are me and my wife, and that she did not use it. He finally broke it down for me by telling me that they decided against me because when you login to your Paypal account, their system records info about the computer you are using. If it is from the same computer you have always used, it is proof that you are the one sending the money.

At this point, I am a bit baffled. I know that I did not send this money to someone I do not know. I know that my wife is the only other person with access to my laptop, and she did not do it. I start to get paranoid. Did someone get close to my house and hack into our wireless networks? I ask Paypal what I purchased from John Smith. They said that it was a "personal payment". You mean I just gave someone $1200 for nothing in return? Yep. I said that I did not know John Smith, I do not know that email, I did not send him $1200, and I have no idea why it shows that the payment came from my computer. They said that they would would reopen the investigation and get back to me. Later that day, I receive an email stating that they have re-reviewed the case and decided against me, again. I call again and they now treating me like a criminal with short snippy answers.

I ask them for John's contact info. They told me that they cannot give out that information. Let me get this straight. Someone can accept $1200 as a personal payment from me, but I can't ask for their phone number? I can understand not giving out contact info to just anyone, but you have now decided that I intentionally sent this person $1200 with nothing in return, but I shouldn't have access to their phone number or address?! That is absurd. I asked them what do I need to do next, and they basically told me that there was no "next". This is their decision and that's that. I asked them for the IP address they have for my computer so I can investigate on my end to try and come up with something. Anything. They told me that they cannot release the details of the investigation unless I write a letter to some office. My blood was absolutely boiling! Paypal, the safe payment company, the 100% buyer protection company, had just left me out to dry in the worst possible way. I was baffled.

Just for the hell of it, I decided to email John Smith. I told him that I did not authorize the payment, and I would be going to the local authorities the next day if I did not hear from him. I told him that I just wanted my money returned to me. It was a shot in the dark, and I really did not expect a response. Finally, the heavens parted and tiny sliver of light shone down on this dismal situation. John Smith actually emailed me back! This is what he sent…

"I don't know if the transaction is Unauthorized or not, but i already send $1200 to maximazorrxxxx@xxxx.com alertpay account. As this guy send me $1200 for exchange transaction. I already send $1200 to his account.
Contact him and recover the money from him, because he send this money to my account and i send $1200 to his alertpay account.
I am providing PayPal to Moneybooker, AlertPay and Liberty Reserve Exchange Service. My Blog is xxxx.blogspot.com"
(I x'ed out the email and web address)

After reading that email, I am guessing that I have gotten caught up in some sort of scheme involving a chain of payments from one Paypal account to another making it difficult to find the person responsible. I call Paypal back and tell them about the email. After some coaxing, they allow me to forward both emails (to and from John) to them and they reopen the case. As I am writing this, I still have not heard their decision about this. The last fraud specialist I spoke with told me to do a spyware scan on my computer. I told her that I am running security software, but I would do a fresh scan. She told me that there is a certain virus that can get onto your computer that will find out your login info, and send information from your computer. She made it sound like this is probably what has happened here. She also made it sound like they are not responsible for security issues on my end, and they might try to use that angle to get out of making this right for me.

No matter how this winds up, I have been made to feel like a criminal by Paypal. They have done very little to help me out here, and if I wouldn't have contacted the crook, or if he would have been dumb enough to respond, I would have been dead in the water. They had decided the case was closed. Forget the fact that I didn't purchase anything from the guy. Forget the fact that the $12 charge that was made at the same time was reversed. Oh yeah, and what about John's email? If what it said is true, he has $1200 payments coming and going in and out of his account. Wouldn't that look a little suspicious? And if I am that adamant about this, what would be the harm in asking John Smith to forward some email correspondence proving that I agreed to send him the payment. I mean, surely we would have had some kind of communication about the transaction before I sent him a personal payment for $1200, right?

The entire situation is absurd! If they do wind up reversing the charge, I am going to transfer the funds to my bank account and cancel my Paypal account immediately. I hope this story keeps someone from going through what I have experienced.

Oh, and by the way, I came home and did a complete virus scan (took about 1 1/2 hours) and it found three items. One was a "worm", and the other two were "trojan horses". Make sure to do the complete scan, and not the quick scan that it normally does. The quick scan was obviously overlooking these.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[theag]

I think I mentioned this here before, but I never had problems with PayPal and do about 50-60% of my revenue with them. A few weeks ago I talked to an account rep (I'm in some kind of business program with better support) and she said that it was so refreshing to see an account with barely any chargebacks, complaints, etc. Seems to be rare. Guess thats a big part of why I never had problems. If you sell shitty products you will have problems with every payment processor.

Still use daily automatic withdrawal to my bank account (asked the support to set up a minimum amount of a few k to stay in the account for some subscriptions and possible refunds), added 2 factor auth and removed the direct debit after reading this thread. Better safe than sorry.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[MJ DeMarco]

FYI...

Anyone who has had their cash tied up and *held* by PayPal in the past might be entitled to reimbursement from a class-action lawsuit.

https://www.accountholdsettlement.com/

Lawsuits such as these sometimes pay two bucks, but sometimes they pay hundreds. While I tend to think the class-actions only make big dollars for the lawyers, this one probably had some merit as PayPal has done some ridiculous things with people's accounts, many times, unwarranted.

 

[biophase]

I got this email yesterday. It's a dispute from a purchase from July 2012. And yes they took the $300 from my account. I don't even see how the credit card company of the buyer can file a chargeback on this?

I go one step further. It's not enough to just withdraw your paypal account to your bank account because they can go into your bank account and move funds back to Paypal. So I withdraw to my bank account and then immediately transfer from that account to another account. I don't do that everyday, I only do it when my funds hit $5k. Which is how they got the $300 from me.

The UPS tracking number of the product I shipped doesn't even work anymore. I don't know how long UPS keeps their tracking records available. So how do you prove you shipped it? I am tempted to go into all my Paypal accounts and dispute every single charge from 2000 on till 2014 and see how many of those I win.

 

[AllenCrawley]

Speaking of Paypal...

Someone logged into my account 2 days ago, changed all the bank information over to their account (chequing AND credit card), and deposited a little over $600.

All of this was sorted out through PayPal and I got my money back, but my banking information is still listed as the crooks. I am going to be taking this information to the bank AND the police.

I did not think what would have happened had he made large purchases on the account instead, and taken money from my bank! Wow, could have been bad.

Someone mentioned this, but I want to write about
it again:

Use KeyScrambler against keyloggers:
http://www.qfxsoftware.com/index.html

I've been using it for about 2 years.

Even if they capture your keystrokes on your
keyboard, they will just see random characters.

It protects your browsers, FTP credentials, bank
accounts, anything important.

Security programs can only protect you if they
can detect the malware, but this is a proactive
approach. A good addition to your security posture.

Basicly when someone tries to capture your
keystrokes, they will just see random stuff.

This happened to me a long time ago. Back in the early 2000's.

I've been using a Paypal Security Key since then with no problems.

https://www.paypal.com/webapps/mpp/security/security-protections

 

[MJ DeMarco]

If PayPal every held your money unfairly, you could be a party to a class-action.

https://www.accountholdsettlement.com/

Might be worth your time to register to be in the class. The last time I was apart of a class with a class-action payoff for misdealings, I got a check that totally unexpected.

 

[theag]

What payment options are better?

All payment options have risk.

Credit card processors can shut you down and hold your money, too.

Even bank account based payments are not completely "safe". With direct debit inside the EU for example, customers can get their money back immediately with a click of a button in their online banking withing 8 weeks or more. Of course it has legal consequences if they do (its basically fraud), but the possibilty is there. But in Germany its the most commonly used payment method with a very very large lead (basically the equivalent to credit cards in the US), so you cant ignore it.

Safest is obviously advance payment via wire. But who likes to pay with that? Some of my customers do, but I have to cancel a lot of these orders because they simply dont pay/forget about it.

You have to find a balance between risk/control and conversion rates. Because most customers like paypal/directdebit/credit card... Diversify. Build a relationship with your payment processor when you start doing higher volume. Have alternatives set up ready to go in case somebody shuts you down for whatever reason.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[RHL]

Paypal is one of those shit businesses where they create almost zero actual value, and instead use near-monopolies (on things like eBay) to force customers to accept a vastly inferior product. Compare the PayPal system to what's in place on, say, Amazon for buying from third party vendors. Their fees are absolutely outrageous, they favor the buyer over the seller 99.99% of the time (I was forced to accept the return of an obviously worn and sweated in $300 set of designer jeans after attempting to dispute the claims of the buyer), their dispute system is a joke, and it generally functions like a relic of the Web 1.0/AoL era.

I hated Paypal when it first rolled out, and I still do.

 

[Tiger TT]

Someone mentioned this, but I want to write about
it again:

Use KeyScrambler against keyloggers:
http://www.qfxsoftware.com/index.html

I've been using it for about 2 years.

Even if they capture your keystrokes on your
keyboard, they will just see random characters.

It protects your browsers, FTP credentials, bank
accounts, anything important.

Security programs can only protect you if they
can detect the malware, but this is a proactive
approach. A good addition to your security posture.

Basicly when someone tries to capture your
keystrokes, they will just see random stuff.

 

[randomnumber314]

I ran a software company that did 100% of revenue through PayPal. We had a program that would log in and withdraw all the money in the account over $5k everyday. I know of a larger company ($50mm annually) that withdraws 100% of the account at COB every day.

Moral being: if you have to use paypal, take steps to put your money in your pocket asap.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[JamesSJ]

Once I reached a certain monthly threshold I got a personal account manager at PP. No need to contact customer support, it's a direct number. Any issues i've had on my account has been cleared up within a couple of hours. I am using PayPal in Hong Kong though, so not sure if that account manager is unique to that region.

Issues have been account locked when using account abroad, account locked when I changed some personal details, account not accepting a large amount of money, account locked when receiving/withdrawing unusual amounts. All recovered after speaking with PP.

 

[Ninjakid]

I have many beefs with PayPal.

Their customer service is shit. My dad tried to activate his account with them and all he kept getting a message saying that the server is down. When we called the tech support, the woman said, in these exact words, "well the server is sometimes wonky." It was on speaker-phone, so I asked, "it's 'wonky'? What the hell is that? Does your server work or does it not? If it's a bug, then get them to bloody fix it." She said that after she put us on hold for 20 minutes and that's the best advice she could offer. So after going through a few different people, someone fixed the issue. Can't remember what it was.

And considering who easy it is for hackers to get access to people's passwords and login names, PayPal is very irresponsible and I don't really trust a company like that to be accountable with my money.

As a person who specializes in cyber-security, I will tell you this: it is NOT VERY DIFFICULT to get access to someone's PayPal account, and in fact, very amateurish hacking techniques will get you full access to someone's account. And as an organization, I think PayPal is neither equipped, nor very responsible to be held accountable for such a thing.

 

[andviv]

I for example used a total of 7 paypals. 4 from family and friends and 3 illegal ones.

You have 3 "illegal" accounts?

 

[exon]

I never have any money on PayPal account and when I pay for something they take money directly from my credit card, so PayPal is for sure tied to bank account. Thanks for advice.

 

[Tengen]

Has anyone tried using two-factor authentication?

They don't seem to advertise it very well, had to google this, but the link is here

https://www.paypal.com/us/cgi-bin/webscr?cmd=_security-key

Looks like you can get a keychain thing or just register your mobile.

Only downside I see is that I prefer to use Google Authenticator, as it works even if you don't have phone reception. Also seems you can't recognise your home computer as safe, so you'll have to get an SMS code each time you want to log into PayPal

 

[BlakeIC]

Paypal is one of those shit businesses where they create almost zero actual value, and instead use near-monopolies (on things like eBay) to force customers to accept a vastly inferior product. Compare the PayPal system to what's in place on, say, Amazon for buying from third party vendors. Their fees are absolutely outrageous, they favor the buyer over the seller 99.99% of the time (I was forced to accept the return of an obviously worn and sweated in $300 set of designer jeans after attempting to dispute the claims of the buyer), and it generally functions like a relic of the Web 1.0/AoL era.

I hated Paypal when it first rolled out, and I still do.

I wonder what paypal would be like if elon musk never sold it

 

[Andy Black]

I withdraw to my bank account and then immediately transfer from that account to another account.

Thanks for the tip @biophase

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[theag]

I withdraw to my bank account and then immediately transfer from that account to another account.

Just send my banker an email that I need another sub-account . Thanks for the tip.

Also just activated 2-step authorization after rereading this thread. Didnt even knew they offered this.

 

[Yoda]

I think I mentioned this here before, but I never had problems with PayPal and do about 50-60% of my revenue with them.

I can also speak highly of them. Never had a single issue.

I opened a credit line with them (technically BillMeLater, or PPCredit, not sure), and they just keep upping it. I never request it.

Just a quick note for anyone looking for interest arbitrage... PPCredit has a rolling no interest for 6 months on purchases. I like that.

 

[The-J]

EDIT: Guy on the phone reopened my claim. I initiated a stop payment with my Canadian bank, because the foreign transaction has not hit my bank account.

I'll be livid if it doesn't go through: Paypal gives you no discourse. But in case it doesn't, I'm about to initiate a stop payment with my business bank.

According to Paypal, the transactions were done on my device. Now, this is impossible since I was not even awake at the time. The guy on the phone said that even the IP address matched, but the investigation was quick because it was on my device.

I found some viruses on my computer (and I remember a suspicious macro file someone sent to me the previous day). So the only thing that could have happened was that the hacker was able to log into my machine remotely and do all the transactions himself.

My computer was on, as well. So that's another mistake.

I set up 2-factor (I mistakenly thought I had it set up, I did not. Now I do). That will add a small layer of security to my account.

I will get this issue resolved, but it's still a giant headache.

So, some lessons learned:

1) Never open suspicious files. Scan every file as soon as you download it. And even then, you're not guaranteed to be in the clear.

2) Never give hackers a gateway into your system. Don't leave your computer on. Don't allow remote access.

3) In case they DO get into your system, set up 2-factor authentication with a phone not linked to your name, but a phone that is on your person at all times.

4) Don't trust Paypal to have your best interests in mind. They're just people trying to do their job and go home.

5) If you suspect anything might be hitting your bank account, call your bank right away. I should have called my business bank yesterday. I foolishly trusted Paypal to have things done.

Lesson learned. I should lose $0 at the end of the day, but I've lost sleep over this bullshit. F*ck Paypal.

EDIT: It's possible to spoof someone's MAC address (your unique device ID on your network card) and someone's IP address (the ID given to you by your internet provider that interacts with the Internet). So people don't actually need to hack into your computer: they just need to look up your MAC address and your IP address. They can do this by creating signups to a fake website. They can easily get these ID numbers.

Databases get leaked all the time. Remember the LinkedIn database leaks? Ashley Madison? Tumblr? JP Morgan Chase? Even F*cking LastPass has been breached (luckily, that breach didn't make your passwords known to everybody because decrypting is all done locally, and not over the cloud).

If someone has your password, and can spoof your MAC and IP addresses, then they can make it look like they did everything from your computer or your location.

I don't know exactly how these hackers got my Paypal login and were able to make transactions. But all I know is that they did, and I'm livid, and Paypal doesn't want to do anything about it.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[Darkside]

Yea, PayPal is horrible. Never use them. Use Authorize.net instead.

 

[sharper]

wow and i thought paypal was safe thanks for this mj

 

[Rocky]

Paypal is the worst from past experiences, another company that's just as bad is eBay at least for the seller eBay always takes the side of the customer even when the customer is wrong.

Also those companies charge too much.

 

[biophase]

On the subject of paypal... I recently opened a business account with the plan to switch over to authorize.net and a merchant account in the future. I'm only using paypal to get a startup going. Anyways, does anyone know if when receiving money in a business account through a shopping cart, does paypal charge a fee for all transactions including transfers from a paypal balance rather than using a credit card/bank account?

Paypal charges for every time you receive money. I believe its 2.9% + .20 for each transaction. BTW, you should leave paypal as a payment option even if you have authorizenet. For some reason during this Xmas season the percentage of customers paying with paypal is very high.

 

[DaRK9]

On Screen Keyboard.

Use it for all banking and sensitive info.

 

[BlakeIC]

On Screen Keyboard.

Use it for all banking and sensitive info.

lol those arent even safe

in fact the ability to crack those is very well known


If you are worried about key loggers, just down keyscrambler

 

[SBS.95]

That's crazy. Even the encrypted ones? Not ones that just pass the data through to the field?

Yes.

But I hope you realize the underlying security threat here is the fact that PayPal is such an incompetent conglomerate that they themselves should not be trusted with $1, yet along $1000.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[LOYD]

Glad this got bumped! Anyone know if Stripe is in the clear?

I'm using Stripe for my online store and it's way better than PayPal. One of the reasons I used it instead is because of how much PayPal sucks. Definitely recommend it.

 

[Mike Kavanagh]

I should have specified. On Screen Keyboard in browser. Most loggers do keystrokes and screenshots, but most have the screen shots timed too far apart to capture any real data.

Key-loggers are a bigger deal than you would think. I had my Gmail hacked that way once.

I'll have to look at that software and try it out. Thanks.

Most Trojan kits I've ever mess with when I was in high school have full screen record capability. That's not even safe.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[AndrewNC]

I think the bottom says it all "Please don't reply to this email. It'll just confuse the computer that sent it and you won't get a response.

Sounds kind of like their customer support when I tried to get $10,000 out of my account last November-February.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.