I've had the most surreal PayPal experience over the last week or so.

I've long had a US PayPal account, but last week needed to create a Japanese PayPal account because I wanted to have a purchase shipped to my house (in Kyoto) from a vender that ships only to the verified “home address” of the paying PayPal account. So, I created a Japan PayPal account, and registered my credit card with it. The credit card's Kyoto billing address provided the requisite PayPal address verification.

After the credit-card registration was successful (which entailed them placing a small charge on the card, and my reporting details about the charge that only the account holder could know), I transferred $100 from my US PayPal account to the new Japan PayPal account, and paid for my purchase.

Almost immediately, the Hong Kong vender of camera accessories sent a “we got your payment, we'll ship your order soon” message.

Everything seemed just peachy, until half an hour later, I got this very odd email....

Date: Sat, 30 Aug 2008 12:25:02 -0700
From: service-jp@paypal.com
To: me
Subject: Notification of Limited Account Access

Dear Jeffrey,

As part of our security measures, we regularly screen activity in the
PayPal system. During a recent screening, we noticed an issue regarding
your account.

Our system detected unusual charges to a credit card linked to your PayPal
account.

Case ID Number: PP-378-596-231

For your protection, we have limited access to your account until
additional security measures can be completed. We apologize for any
inconvenience this may cause.

To review your account and some or all of the information that PayPal used
to make its decision to limit your account access, please visit the
Resolution Center. If, after reviewing your account information, you seek
further clarification regarding your account access, please contact PayPal
by visiting the Help Center and clicking "Contact Us".

We thank you for your prompt attention to this matter. Please understand
that this is a security measure intended to help protect you and your
account. We apologize for any inconvenience.

Sincerely,
PayPal Account Review Department

I get dozens of phishing mails a day, which, like most everyone else, if it gets past the spam filter, I just dispatch with the delete key at a reflexive level. But since I'd just done a bunch of PayPal stuff, I actually gave it a moment's look, and the lack of a click-on-me-so-we-can-trick-you url caught my eye.

Gee, maybe it's actually real?

I logged into my new PayPal account, and was greeted with:

Even though I typed the url myself, and logged in with my own credentials, I still kept checking to see whether I was really at the real PayPal site. The original email really, really smelled like phishing spam, but gee, now it seemed to be real.

PayPal, of course, has absolutely no insight into my credit card activity, at least not beyond transactions that PayPal initiates itself, or brokers on my behalf. They can't “monitor” a third-party credit-card account any more than any other merchant that accepts credit cards. For example, they can't monitor your credit-card activity any more than a gas station or restaurant that accepts your card can.

Yet, here they are telling me: “Our system detected unusual charges to a credit card linked to your PayPal account”

Clearly this is not true. It can't be true. It is the real PayPal, but it's a blatant lie. What's going on?

PayPal still showed the payment I'd just made as “completed”, but to be safe, I sent a note to the vender asking whether they really did get the money. The immediate reply was no, PayPal had “un-completed” the payment, putting a hold on it.

So, here I was with PayPal telling me that they'd transferred my money away, yet the vender not having received it. I had no further access to my account, with no truthful hint as to why.

Gee, what on earth could the problem be?

Whatever it was, the “resolution” section of PayPal's site said that I would need to provide all kinds of my personal information, like copies of my passport, my Japanese-government proof of foreigner registration card, and a copy of my credit-card statement.

There are a host of problems here, including:

• If all this stuff was required, why didn't they tell me ahead of time, such as before I created the account, before they told me that my credit-card registration was “successfully verified”, before they let me transfer $100 in, before they allowed me to make a payment with it, or before they told the vender that I'd paid them?
• PayPal made it explicit that they would not accept online credit-card statements, only ones sent via postal mail. What if I'd opted for the non-paper electronic-delivery option?
• What if I was traveling (say, in Ohio or in Vancouver) and didn't have access to my postal mail?

But mostly, I wondered why they would come up with a fictitious reason to demand this additional personal information. The phishing-like nature of it felt absolutely surreal.

So, I sent a note to PayPal asking what the problem was. I eventually received a boiler-plate response “to lift the limitation, please provide your passport, ....” that simply repeated what was on the web site.

I sent another note...

Hi.

Your note is just a copy of what's on the web site, which I already read.
I asked, and I would hope you could answer, what this means:

      "Our system detected unusual charges to a credit card linked
       to your PayPal account."

I don't recall having given PayPal any permission to inspect charges on my
credit card, nor do I believe PayPal has the ability to inspect charges on
my credit card. So what does "detected unusual charges" mean?

I'd very much like to know what, exactly, it means. What problem does
PayPal perceive exists?

I went on to repeat what I'd written in the first two notes, that I was traveling and had no access to my postal mail at home.

The reply to that only added to the surrealness:

Dear Jeffrey,

Thank you for contacting PayPal. My name is Nestor Wilson. From reading
your email, I know this is regarding PayPal's security measures. I'm
sorry if the situation caused any inconvenience, I'll be glad to help
you.

Please send to us the email that you received regarding the
unusual charges in your account so that we could give you a detailed
explanation. Upon checking your account I wasn't able to locate any
limitation placed on your account that may lead to us sending you that
email.

We appreciate your assistance in resolving your question.

If you have any further questions, please feel free to contact us again.

Sincerely,
Nestor Wilson
PayPal Resolution Services
PayPal, an eBay Company

I replied, and eventually got another boiler-plate robot reply listing the things that I have to send in (passport, credit-card statement, etc.), but this time they added an item:

- Submit a copy of a current utility bill. The bill must show your name and
  address exactly as they appear in your PayPal account.

Wow, I didn't realize that having a utility in your name was a prerequisite to keeping a PayPal account open for more than an hour!

Again, had they made this clear up front, I would have just abandoned the whole thing. This new utility-bill requirement was a double bummer for me, because even if I were in Kyoto at the moment, it wouldn't do me any good because I don't have any of our utilities in my “English” name. I am legally allowed to use a Japanese name in Japan, a right I avail myself of because using a Japanese name makes everything more convenient.

I was rapidly losing hope, but I sent a third note, asking that if a human were to actually read the email, please explain the problem to me.

Eventually, I got a fourth note from PayPal:

Dear Jeffrey,

Thank you for contacting PayPal.

We're so sorry that we could not tell you more details about PayPal's
security methods as many bad persons are trying to detect our security
protection methods by creating fake account and asking restriction
reasons.

And you could only agree to cooperate and provide additional documents or
just refuse to cooperate and ask PayPal to deny your appeal at once.

Thanks again for writing, and thank you for being part of the PayPal
community.

Sincerely,
PayPal Account Review Department
PayPal, an eBay Company

Huh?

I don't quite understand the broken English about “your appeal”, but it started to dawn on me that PayPal Japan and PayPal America were somehow sharing some information (my emails), but not others (that there's a hold on my account).

In any case, this was encouraging in one sense because the message was clearly written by a human in response to something I wrote, so I was getting somewhere. I crafted a reply with clearly-worded, simple English that explained the very odd situation I was finding myself in, appealing for information. The whole “detected unusual charges” falsehood still weighted heavily.

The next reply from PayPal was less ambiguous: they were kicking me out, but keeping my money:

Date: Tue, 02 Sep 2008 17:54:21 -0700
From: service-jp@paypal.com
to: me
subject: Limited Account Access Appeal Denied

Dear Jeffrey,

We understand risk is inherent in doing business. However, as of right now,
we're not comfortable with the amount of risk your business is exposed to.

With that in mind, we have decided to end our business relationship while
minimizing disruption to your business.


-----------------------------------
Disbursement Options
-----------------------------------

Option 1. If you owe refunds to any of your buyers, you can use the money
in your PayPal account to refund them.

To refund your buyers:
1. Log in to your PayPal account
2. Click "Contact Us" at the bottom of any page
3. Click "Contact Customer Service"
4. Under "Choose a Topic," select "Sending/Receiving Money"
5. Under "Choose a Subtopic," select "Refund/Cancel a Payment"
6. Click "Continue" and follow the instructions to refund payments

Option 2. Money in your PayPal account will be held for 180 days. After 180
days, we'll email you with information on how to receive your funds.

We regret any inconvenience this may cause.
Sincerely,
PayPal Account Review Department

Please do not reply to this email. This mailbox is not monitored and you
will not receive a response. For assistance, log in to your PayPal account
and click the Help link in the top right corner of any PayPal page.

I about blew a fuse.

What right did they have to keep my money? Why would they hold it for six months? What if I no longer have access to that email account by then?

WHAT THE FUCK IS GOING ON HERE?

It's only a hundred dollars at stake, but the wrongness just galls me. It pissed me off so much that I was losing sleep.

When you register a credit card with PayPal, as part of the verification that it's really your card, they make a small charge to the card, and you then have to tell them the secret code they used in the “merchant name” associated with that charge. I'd successfully done this when I created the account, before the problems arose. In looking back at those transactions on my credit card's website, I noticed that PayPal had also included a phone number in the “merchant name”, so I gave it a try.

Shockingly, and to PayPal's great credit, I was able to reach a human being fairly quickly, an exceedingly pleasant Christine in Nebraska. We talked for quite a long time, as I explained the whole ordeal, offered all kinds of ways to authenticate myself to them, etc. She was chatty and interested in Japan. I was more than happy to talk up Kyoto, but it was always in the back of my mind that her interest was perhaps just part of an anti-social engineering strategy. I'm all for combating social-engineering, and I enjoyed the conversation, and in any case, I was so very relieved to be talking to a real person who seemed to understand the frustration of the situation.

What she didn't seem to understand (or admit) was how ludicrous the whole “detected unusual charges” claim was, but in any case, she made a lot of notes on my account, and suggested that everything would be fine if I were to fax a copy of my passport and Japanese driver license. I scanned them, redacted anything that they didn't need to know about, and uploaded it to their server.

I eventually got another broken-English reply thanking me for my passport, but reiterating the need for a utility bill and the credit-card statement. Arrrrrrrrrrgh! I tried calling PayPal again, but being 2:30am by this time, they were closed.

I called again the next morning (this morning) and again quickly reached a human (!!!). I explained the whole long drawn-out story, and was bumped up to someone else. I explained the whole story again, and was again bumped up, this time to a “limitation specialist”. This was getting encouraging! Someone who could perhaps do something!

I explained everything all over again, and the heavens opened up and the angels sang: she lifted the hold on my account!

Un-be-friggin'-lievable.

The “completed” payment (that I'd created the account for in the first place) now really did go through, but here's the kicker: somewhere during this ordeal I'd hedged my bets and enlisted the help of a Kyoto friend, who PayPal'd the funds to the merchant for me. So, my order was shipped and I already had a tracking number. This newly (re)completed payment was now a duplicate.

The merchant, who was really understanding throughout, immediately issued a refund. Assuming that I do get the shipment and it's not a box of rocks, I'll be writing a glowing post about the vender [here it is]. They were really top notch, as if they really cared about running a good business. PayPal America wasn't bad, either.

PayPal Japan, though? Abysmal.

What a week.

Update one month later: See this followup post for more about this, from the Director of Account Protection at PayPal.