I rarely use Paypal, but was forced to use it recently for something with no other payment option. Whilst there I decided to change my password, and was horrified to find that they limit passwords to 20 characters.

It got me thinking about the standard assumption that any system limiting chars in a password must be storing passwords in plaintext and not hashing them, else there would be no logical reason to do so (since hash length is constant regardless of input length) - with the only exception being placing a really large limit (say 1024 chars) just to avoid performance issues with hashing really massive passwords.

But.. I refuse to accept that's what's happening here. It simply can't be the case that Paypal is storing plaintext passwords, can it? So there must be another explanation - but what is it?

The only thing I can think is that perhaps they are encrypting passwords, instead of hashing them, or started out doing this in the early days and have since switched to hashing passwords, but there were by then so many layers of validation cruft and/or dependent systems that somehow relied on the 20 char limit being enforced, that they were unable to remove the limit without breaking everything, and they've decided the tradeoff of just sticking with a 20 char limit is worth it.

Does anyone know of or can think of a better explanation for this?

Learned the hard way you make a separate bank account to link to PayPal. You turn off overdraft and you keep that sucker empty.

It's like living with a drug addict. They may be family but you sure as hell dont leave cash or valuables laying about...

I very rarely have to contact PayPal for anything, but I’ve had to talk to them a couple times. My experience is that they absolutely will not answer any question they don’t have a pre-written response for, instead choosing whatever they think is closest to what I am asking, even if it doesn’t answer the question. I’ve even had them send me the same response again when I explain that it didn’t answer my question the first time. If I need something specific like the fedwire tracking number for a transfer, I’m basically SOL because they don’t have a response for that, they just send me links on how to view my statement.

I don’t know why companies do this but I notice that companies that don’t compete with Amazon tend to have horrible customer support, but as soon as Amazon enters the market suddenly everyone picks up the phone second ring, has chat, and sends out hand written e-mails.

This is not a customary experience - Pretty much any interaction with Paypal support that doesn't involve you losing hundreds or thousands of dollars is an uncommonly good experience.

Paypal is a well-oiled machine until you trigger some exception that creates a case with their legendarily incompetent support - at that point, the results will be essentially random and often apparently malicious, no matter the facts of the case.

Once I ordered some expensive gear from UK and only option to pay was PayPal. I ordered and paid for the goods, order shipped and a few days later I get a mail from the selling company asking why I locked their account for fraud protection or some such. PayPal sent me the money back and I got the goods. Offcourse I didn't use PayPal again and sent them a normal bank transfer instead. Was also a better exchange rate than PayPal.

Whoa, I just got off of a call from PayPal as to why my account was banned.

Turns out, 15 years ago when I signed up, I was 15 (I am 30 now) and that is against their terms of service. So my account is permabanned and they said to make a new one with a different email.

I can understand they don't want people under 18 to sign up, but for fucks sakes, it was 15 years ago, this feels like a fairly stupid policy.

I would like to add that the customer service experience in this instance was pretty good - they had a queue system where you can leave your number and they call you back instead of keeping you on hold forever, and they representative was helpful and professional and told me straight up that I could make another account.

I recently had a similar experience with eBay, though it got resolved:

-I had an old eBay account that was closed through inactivity

-I wanted to buy some headphones so I decided to create a new account

-When I went to eBay it had already given me a username through some sort of linked google account feature that used the google account I was logged in to

-I tried to buy 2 $40 headphones and it wouldn't let me, saying I was over my temporary purchase limit

-I figured maybe you can only buy one item at a time as a new user so I tried to buy a single pair of $40 headphones and got the same response

-I thought it might be my VPN, but my VPN was off at the time.

-I created a normal account linking it to my normal email and everything seemed well. I purchased the headphones successfully

-A few minutes later, I got an email that the first account had been suspended for suspicious activity. I first thought this was fine, until I read that I was not allowed to use any other eBay account ever again in my entire life. There were no options listed for recourse. Reading internet threads suggested that they were serious about this and that even if my other account still worked, they would eventually find it and close it.

Eventually I called and got a rep. I got the feeling he didn't believe me, but he fixed the issue so now I can use eBay again without worry. The whole experience left me a bit shaken though that triggering some automated flag nearly resulted in being cut off from one of the largest marketplaces in the world for the rest of my life.

I’m going against the consensus here, but why was this guy so concerned about the reversal of a transaction that never should have happened in the first place? It wasn’t his money. Someone at PayPal obviously manually reversed the transaction when they realized the mistake. These things happen.

I’ve been using PayPal personally for 10+ years without issue. I also own a company and have processed hundreds of transactions and withdrawals through a business account with them without a single problem. I’m not saying that dealing with PayPal is without risks, but it’s also possible that we’re hearing a vocal minority here.

No, most people would not be this agitated about a mistaken transaction being silently refunded. At best they'd probably assume the notification went to spam or something and went on with their day

My bank doesn't notify me about any transactions, I have to check my bank book manually. Once a mistaken transaction showed up and disappeared a few hours later, with no trace left behind at all. I just assumed it was a mistake and didn't bother getting angry.

This is standard PayPal. They don’t give a crap about their merchants and it’s been widely documented in the past. See https://www.google.com/search?q=paypal+horror+stories

I just got an invoice from Google Account. Basically, scammers send people invoices stating that they exceeded their 5GB and people have to pay $120 not to lose their Google account. I'm sure there are tons of rich idiots who will pay $120, but I wonder why:

- There was no merchant contact info. They managed to upload Google's logo and use Google Account as the merchant name. Isn't PayPal doing any basic blacklist check, etc. or check against stock logos (there are tons of companies now, which provide logo by provided company name).

- There's not way to report the invoice as scam attempt - I can only "cancel" or "archive", which sends the "merchant" an email and they can know that my email belong to a valid PayPal account after that as the email is sent by PayPal.

In general, after so many in business, PayPal is a lazy, slow, and stupid company. I am sorry to say that, but it's the truth. Their developers are a bunch of old timers, who have entrenched into the company and there's no innovation going on. There are many, many, many complains about PayPal, which I can list here. Most of the are very simple to spot and fix by PayPal, but, no, they are untouched for years.

I feel like their dev teams is maybe a dozen people who just do maintenance of critical issues and that's it. Their recent interface upgrade took years and it still sucks and feels like in the dawn of DotCom. Compare PayPal to Stripe, let's say - there's no room for comparison! Stripe innovates at a huge pace, they provide a much better DX (Developer Experience), and are so much nicer to work with!

PayPal recently acquired Xoom - a very expensive and shady money transfer company. Compared to TransferWise, they are a total joke. In general, I think PayPal is managed by technological morons!

P.S. PayPal Here is also a disaster compared to the rest. I bought the device (as PayPal gives nonprofit discounts like Stripe but unlike Square) and many of our transactions failed, so, we switched back to Square. Now we're integrating with Stripe's reader, so, we'll get the best of both.

Similar to my experience, especially the ping-ponging between eBay and PayPal. In my case, I _did_ actually sell something, but then the buyer decided to return it. Somehow both my eBay and PayPal accounts got into a 'locked' state, with no way to resolve it instead of contacting customer service. The experience with their CS department was beyond frustrating - they're happy to send 'red' letters demanding refunds and transaction fees despite cutting off all my ability to do anything about it.

Reading this post has given me the final nudge I need to look into closing both those accounts.

Is it too much to ask for regulations for payment transactions to step in, at least in EU? I know we're not too regulation-friendly here, and I haven't made up my mind yet, but I tend to think it's only consequential that digital payment transactions are considered a field where governments should exercise authority, on similar grounds that give (or doesn't give) government authority over establishing a currency in the first place.

Note this isn't a snark at paypal specifically. I'm just interested if anyone with an economic background has an opinion to share.

It’s difficult to understand why people are even using this service anymore. PayPal is not your ‘pal’ and to use them safely you need insurance and leverage all the way. The only reason I can imagine is that it works most of the time. But the times where it fails are invariably a disaster.

PayPal manipulating, removing, or holding hostage the balance of your account?

Yes that’s normal for PayPal.

Getting a the runaround about how and why it happened?

Yep, that’s expected too.

Actually getting a non-form letter response of any type?

That’s just lucky. We couldn’t get an account rep on the phone for almost 4 days when ~35k was suddenly deducted from the account. Nor when they accidentally cancelled all of our customers subscriptions while working an an unrelated fraud incident. Of course in both of these instances the customers blamed us for not being able to process refunds and being unable to reactivate their subscriptions.

PayPal, working as intended.

A few years ago, I sent my youngest son to a well-known online retailer to buy some computer gear.

What he got was a counterfeit, a fake that was broken.

He started the refund process, but I was pretty miffed that my reputation with my kid got mixed up in these poor business practices. So I emailed management and asked that they apologize to the kid.

It took almost forever to get them to figure out that I was not asking for a refund. I was asking for somebody to explain what happened, apologize, and take steps for it not to happen again.

He finally got a refund, although whether it was from my actions or his nobody knows. He said it came in three chunks, as if various departments were each pitching in a bit.

I thought my point was pretty clear: as leadership, when you take your company and allow its reputation to suffer like that, this is something you are responsible for and need to take action to fix. The money has nothing to do with anything. But they only have certain predefined channels that they seem to be able to communicate through. Anything outside of those channels causes a weird org fault.

I've worked with call centers before, and it continues to amaze me the strange place we are putting humans. They're paid to answer the phone, but after that? They're basically little robots, paid to execute a predefined program, adding in a bit of human-sounding noises now and then to make things slightly more palatable to the person on the other end.

I processed a few hundred thousand in revenue through PayPal subscriptions starting around 2008. Everything went fine for a few years, then I moved to Stripe because of the horror stories that kept popping up about PayPal (frozen accounts for 6mo+ with no recourse, inability to contact anyone, etc.).

It just isn’t worth the risk, IMO. At least with Stripe I know I can talk to somebody if a problem arises.

Yeah, had this happen to me. Currently my account is limited, they want me to send proof that I have shipped things that do not exist. I am not a merchant or anything like this, I just sent money to my gf and she sends money to me. It's fucking stupid. These companies are absolute shit.

Paypal may, under good circumstances, fix problems they have themselves caused.

However, the concept of explaining to a customer why they did something is utterly alien to them. This just does not seem to be part of any process they have. It bewilders them to no end if you ask them for an explanation of anything.

Yup. This is why I left eBay and PayPal.

PayPal charged me £400 which I was lucky I spotted. Eventually after a week got the money back.

I never got an explanation why it happened or how I or they would prevent it in future. I prevented it by leaving eBay and Paypal.

Yes, my experience with PayPal has involved inconsistent UIs, bad UX, locked funds, and incompetent customer service. I only use paypal where absolutely necessary, such as for selling on ebay.

I avoid PayPal, but in the rare case where there is no other payment method possible and i really need something, i simply create an account, do the transaction, and immediately delete the Paypal account again.

I find this the best way to deal with them :)

That sounds like normal procedure from a bank. If someone deposited a million to my account in error, the bank would (and should) most certainly just correct the error even if it means "decreasing the balance" on my account.

I expect them not to hide it though, i.e. I expect to see the transaction log to say "+1000 deposit -1000 correction", and I expect them to be open about the mistake IF I ask. I do not expect them to give me a call to explain what happened, however.

This is behavior I expect from any entity where I have an account with a balance, whether it's a commercial bank, PayPal, or anyone else.

Every time I relocated, I ran into countless issues with my Paypal account being tied irreversibly to the country where it was first opened.

So I end up opening a new Paypal account -- which must use a new email address, and can't have my old credit cards added to it.

Now I'm stuck in a situation where my newest account doesn't accept the credit card from my local bank because

  This card is linked to another PayPal account.
  Please remove the card from the other account
  or try a different payment method.

And I'd bet their fraud detection machine learning bingo tool will learn "owner did not contact us after the ban" as a correct ban and continue to be more obnoxious to all the other customers.

Oh well, whoever are still using Paypal should know by now what they are risking.

A bit like chargeback without any consultation.

Planet Money just had a story from the other side, one of the producers made a payment on another service in error, and tried to get it refunded.[0]

[0] https://www.npr.org/2019/06/26/736352315/episode-922-the-cos...

You could read one of these stories and come away passionately more pro or more against chargebacks, but the real solution for both situations is just more transparency and communication.

In SG's case, if they're right that the money ended up at the right place, fine, just let everyone involved know what happened, how PP came to that conclusion, and what options there would be for the parties to appeal in the case of fraud or mistake. It sounds like in the PM story that that approach would have resolved everything faster there too.

Transparency isn't going to kill you in this situation. You may be worried about privacy risks, but just make a clear policy as to what you can and can't say during the initial phases of disputes.

Transparency will resolve the easy cases, but there are real dilemmas here between buyer and seller rights. I feel like some of the tech that is taking over the roles of payment systems are just pretending these dilemmas don't actually exist. eBay definitely stumbled through buyer vs seller rights for a while, maybe still doesn't have it right.

Cryptocurrency is an interesting spin. In some ways its stance is that chargebacks are so anathema that they will design them completely out of consideration.

Recently had a terrible experience with PP Dispute process.

1 - Bought tickets for a show via twickets.live 2 - Seller (supposedly) sent a transfer request to me via the ticketmaster portal. 3 - I received, nothing, tried to contact seller, got no reply till after event. 4 - Open a dispute as I paid for something and received nothing. 5 - PP sides with the buyer citing ‘evidence’ the tickets were sent to me 6 - PP won’t share ‘evidence’ with me, wont reopen my dispute, no option to create a new one.

Now I’m down a wad of cash, didn’t go to the show, and got no opportunity to do anything about it. Closed my account immediately afterwards.

PayPal is horrible, both as a merchant and a customer. In every single way possible. From APIs to service, to explanations to everything. It's time for someone else to take their place and everyone stop using PayPal.

I'm not surprised. I accidentally created a seller account trying to create a test account for a project I was working on. I never verified the account as I realised quite soon. I've never sent or received any money.

But can I close the account? Nope! I have to send official paperwork to prove it is a valid seller account before I can close it.The only reason I want to close it is so I can reuse the email address. But you can't even change the email address.

Their process is flawed and lacks common sense.

I still sometimes make the mistake of trying to login to paypal without a VPN. I once lived 50km westwards in another country and if I try to login to my account accidentally, it'll lock me out, also after I VPN back into the original country I still can't login. It is randomly resolved after a cool-off period.

When you call support, either in the original or the new country, they both offer the same thing:

- change your password (I know my password, and though they seem to understand, their script seems to tell them to offer this)

- close your account (what, after telling you my email address and the last 4 digits of my bank account (not even a credit card)? That's password-equivalent?!)

Support tells me it's not supported to login to your paypal account from another country. Don't thousands of people do this every day? On holiday, while traveling for work, or moving countries like me... doesn't this happen thousands of times a day? I live an hour driving from five different countries, it's not uncommon for anyone here to be somewhere in, y'know, the EU.

A few years ago I remember being locked out of a PayPal account (which I just forfeited) for not knowing my security questions. Like, duh, you think I answer truthfully what my favorite food is for a payment account after I (the 13 year old leet haxxor) 'hacked' a classmate's Hotmail by guessing a very common favorite food? They still use security questions, but these days I enter my current password there so I can at least answer when prompted.

Completely expected. As a developer that has been forced to integrate with PayPal numerous times I'm not surprised the customer service side is as abysmal as the developer side. Terrible service, run-arounds, just shitting all over the bed in general. Don't even get me started on their fraud resolution.

They are simply the biggest name in the business and have been around the longest. There is absolutely no other reason they deserve the market share they have.

I had a similar experience with Uber Eats. Though I despise PayPal, I think this problem is common to these large companies that outsource all customer support. There is no venue to actually reach someone who gives a damn and at the top, they like it that way because they don't care about anything except how much money they are making. It is deeply flawed. I wish there was a good alternative to PayPal.

PayPal is stuck between a rock and a hard place. At their scale they are are constantly targeted for all kinds of criminal activity and are under enormous pressure to follow rigorous laws pertaining to handling money.

They keep trying to balance this with good customer service, but I'm not sure you can do any better ... and I hope nobody thinks that cryptocurrencies are the answer.

Same thing happened to me. I git charged for a “refund” for a sale I never made. It took myaccount into the red and they demanded money and even more ID from me so I closed it. Stuff like this is why I don’t keep money in any place other than my bank acct. They also instantly and without warning locked my account after receiving 2000 dollars from a friend before that and demanded official documentation after I started investigating what happened citing EU laws. I wouldn’t have minded that since I’m not a criminal but surely locking away someone’s account without explanation is not a good way to take care if users. Especially if you’re basically a bank.

Maybe I am in the wrong here but my approach each and every time to a project where I deal with someone elses' money is to try and figure out the most secure and most informative way to do everything, afterall it's one of the biggest responsibilities you can take on as an online service provider.

If anyone wanted a de facto software monopoly to break up, this would be a good one.

I have to say that I have been lucky with PayPal so far and I have a PayPal account for a long time. I only use it as a buyer though. I really like it when a website has a PayPal option so I don't have to give yet another site my card numbers including the security number on the back. I think that maybe twice over the years I have needed to get a refund and apart from the process being a bit drawn out I had no problem. But then the unhappy stories are usually from vendors so maybe my experience is nothing special

Just avoid Paypal, I’ve always had issues with them from funds being blocked for no reason to my account being blocked, their support is an absolute nightmare, also my friend sold something on eBay the buyer said she didn’t get it so PayPal took the money back from my friend, she sent it and it was signed for but not at the address listed on PayPal the address that has been given by the buyer so it’s not protected. Shady shady business

> I guess it's easier to pretend they fight crime when they just target the easier target they can find.

That is the story of the whole western world at the moment…

I got once a mistaken transaction on Paypal, the "buyer" contacted me to ask me to refund their money because it was a mistake. I issued a refund and Paypal took 30 cents fees because of the refund. I contacted paypal to ask why I was charged for a mistaken transaction and they just told me this is how it works and there's no way to avoid that.

I once ordered a domino's pizza via paypal. The app did not complete the transaction. I did find however 20 transactions to dominos on my paypal account. I tried to reason with Paypal that I did not authorize 20 transactions (just one), but Paypal did not want to reason with me. In the end, Dominos refunded 20 transactions.

I now pay with credit card.

If you do a calculation of the number of Ebay purchases that are handled by PayPal, it's certainly in the millions, and probably hundreds of millions. The rate of outright fraud is unfortunately very high, and the average person is so prone to error that PayPal must employ many people to handle all the cases.

Once you have a very large organisation, consisting of many staff handling cases, all of whom need to be acting consistently, you face the real statistical likelihood of fraud within the company itself. Any sufficiently large company will have employees that try to defraud it.

The upshot of this is that large companies handling many transactions like this, especially ones that will often be disputed, must implement security not just to prevent fraud from outside the company, but also inside.

Such security measures are often very difficult to work around by employees trying to do the right thing by customers who are in the right, but where something unusual has happened that those security systems didn't anticipate. I can imagine this often frustrates the intention to have a smoothly working system.

You also can't easily make changes to accommodate such corner cases without opening other security holes, both within and without the company. And it takes a long time to formulate and disseminate new protocols that your employees should work to. And then you have to communicate any changes in the way you handle things to your customers.

Running a company like this must be an absolute nightmare of logistics. And it is surely made worse in that Ebay seems to have the ability to authorise chargebacks and refunds in disputed cases that can then be appealed to PayPal itself.

But the alternative is in my opinion worse. As a buyer, you must pay for an item before receiving it. I am aware of so many complaints online of fraudulent sellers making off with tens of thousands from fraudulent sales, and there being nothing anyone can do about it because of banking privacy laws. Having a service like PayPal seems essential to reducing fraud in such online transactions.

In summary, I can perfectly understand PayPal wanting to perform a security check for every long time customer for whom a flag was raised by some security protocol.

And naturally, there are going to be many false positives, and many unfair decisions taken at such scale.

Independent arbitration would indeed seem like a good idea. But who is going to pay for independent arbitration for potentially millions of disputed transactions? The reality is, almost every single transaction that has already been appealed to PayPal that can be appealed easily to an independent arbiter, will be. So you simply double the (already high) cost of such a service.

Paypal has taken thousands of dollars from me and won't let me access my account with a pre-paid phone. It's hard, but avoid them if you can. I inherently distrust Facebook's Libra project because of Paypal's involvement.

Similar (worse) things happen to relatively small organizations relying on PayPal: https://minifree.org/paypal/#paypalbastards

I guess someone inside PayPal is using random people’s accounts to launder money. Deposit dirty money into innocent account- let it sit for awhile then take fresh clean credits out. In Greece? My guess is that it’s an arms dealer

Yeah, I dropped paypal a while back after Adobe made charges to my account which I had cancelled.

Paypal makes it very easy for subscription services to keep sneaking those charges in.

Closing my Paypal made it very easy to stop that nonsense.

Paypal strategy to get the ID: 1. Ask the user to sign up. 2. Pretend everything is complete. 3. Wait for the user to get a payment or money. 4. Block the account and ask for the ID.

> it's not like Paypal will miss me, I know, I would just feel too "dirty" to keep it open after all that happened

It's comforting to know that other people feel the same way.

PayPal owes me $200.

Details: https://news.ycombinator.com/item?id=19773036

This sounds like what happens if the buyer does a CC chargeback IIRC. You get no notifications, money just disappears.

I worked PayPal Trust & Safety in my rebellious youth, and I wouldn't use PayPal now if you paid me to do so.

"If you want a vision of the future, imagine a boot stamping on a human face - forever." - Orwell.

What a timeline we live in, where people choose to post their complaints about random bs on GitHub or Twitter...

Yes, yes it is.

I've long stopped using Paypal, except where absolutely necessary because of this sort of thing.

This served as a swift kick in the butt for me to remove money from my Paypal account. Done.

Very weird case. The person got angry even though it was not his money to begin with. Absolutely no harm was caused to him. The person demanded explanation why an erroneous amount of money visited his account. Yet it's none of his business. There was a moment in this incident where any reasonable person would have just moved on.

Could get much much worse.

if it's an infrequently used account linked to an email address from 20 years ago it probably had an easy-to-guess password

paypal is horrible, once an issue happens forget about resolutions. Their customer service is one of worst

Yes, this is approximately customary.

If you don't like PayPal's service, choose another company instead. That's how capitalism works, right?

(Yes, I know that's impossible. My point is PayPal is effectively a monopoly.)

tl;dr: 1. Erroneous deposit appears in account 2. Soon after, the money is removed 3. Account holder makes a big fuss and falls out with paypal about it

I tried to pay my Indian contractor through Paypal. Their system flagged the transaction, so I contacted support. After several days of trying to get anyone to respond, I was literally told that there is nothing that they can do and that I should use a different service :D One of the worst services I've ever used.

Oh man I sent some 30 EUR because the counterparty was retarded to have onkly Paypal listed and and paypal took 40 or something when I counted all the hidden costs. WTF

Getting offended, emotional, indignant, and angry about any of this was completely uncalled for, and if this is how you go through life, you're going to continue to have these kinds of problems at a rate much higher than the average person has these kinds of problems.

Yes. Next question.

https://paypalsucks.org/toon1.shtml

This is why people should support real cryptocurrency.

This is why people should support (real) cryptocurrency.

You never heard of bank transactions going sideways before? You should have opened the issue when you saw the funds, but you let your greed get the best of you and now your pissed you lost....what exactly?