{"id":926,"date":"2008-09-04T14:56:01","date_gmt":"2008-09-04T05:56:01","guid":{"rendered":"https:\/\/regex.info\/blog\/2008-09-04\/926"},"modified":"2008-09-04T14:56:01","modified_gmt":"2008-09-04T05:56:01","slug":"surreal-and-exceedingly-unpleasant-paypal-experience","status":"publish","type":"post","link":"https:\/\/regex.info\/blog\/2008-09-04\/926","title":{"rendered":"Surreal (and exceedingly unpleasant) PayPal Experience"},"content":{"rendered":"\n\n<p>I've had the most surreal PayPal experience over the last week or so.<\/p>\n\n<p>I've long had a US PayPal account, but last week needed to create <span class='nobr'>a\nJapanese<\/span> PayPal account because <span class='nobr'>I wanted<\/span> to have <span class='nobr'>a purchase<\/span> shipped to my\nhouse (in Kyoto) from <span class='nobr'>a vender<\/span> that ships only to the verified &#8220;home\naddress&#8221; of the paying PayPal account. So, <span class='nobr'>I created<\/span> <span class='nobr'>a Japan<\/span> PayPal\naccount, and registered my credit card with it. <span class='nobr'>The credit<\/span> card's Kyoto\nbilling address provided the requisite PayPal address verification.<\/p>\n\n<p>After the credit-card registration was successful (which entailed them\nplacing <span class='nobr'>a small<\/span> charge on the card, and my reporting details about the\ncharge that only the account holder could know), <span class='nobr'>I transferred<\/span> $100 from my\nUS PayPal account to the new Japan PayPal account, and paid for my\npurchase.<\/p>\n\n<p>Almost immediately, the Hong Kong vender of camera accessories sent a\n&#8220;we got your payment, we'll ship your order soon&#8221; message.<\/p>\n\n<p>Everything seemed just peachy, until half an hour later, <span class='nobr'>I got this<\/span> very\nodd email....<\/p>\n\n<style type='text\/css'>\n  .e926 {\n      color:black;\n      background-color: #666;\n      border-color: #C88;\n      border-style:solid;\n      border-width: 1px 1px 1px 8px;\n      font-size:95%;\n      margin:20px 5em 20px 3em;\n      padding: 15px 2em;\n  }\n  .jf926 {\n      border-color: #8CC\n  }\n<\/style>\n\n<pre class='e926'>\nDate: Sat, 30 Aug 2008 12:25:02 -0700\nFrom: service-jp@paypal.com\nTo: <i>me<\/i>\nSubject: Notification of Limited Account Access\n\nDear Jeffrey,\n\nAs part of our security measures, we regularly screen activity in the\nPayPal system. During a recent screening, we noticed an issue regarding\nyour account.\n\n<span style='color:white'>Our system detected unusual charges to a credit card linked to your PayPal\naccount.<\/span>\n\nCase ID Number: PP-378-596-231\n\n<span style='color:white'>For your protection, we have limited access to your account until\nadditional security measures can be completed.<\/span> We apologize for any\ninconvenience this may cause.\n\nTo review your account and some or all of the information that PayPal used\nto make its decision to limit your account access, please visit the\nResolution Center. If, after reviewing your account information, you seek\nfurther clarification regarding your account access, please contact PayPal\nby visiting the Help Center and clicking \"Contact Us\".\n\nWe thank you for your prompt attention to this matter. Please understand\nthat this is a security measure intended to help protect you and your\naccount. We apologize for any inconvenience.\n\nSincerely,\nPayPal Account Review Department\n<\/pre>\n\n<p>I get dozens of <a href=\"http:\/\/en.wikipedia.org\/wiki\/Phishing\"\nclass='quiet'>phishing<\/a> mails <span class='nobr'>a day,<\/span> which, like most everyone else, if\nit gets past the spam filter, <span class='nobr'>I just dispatch<\/span> with the delete key at <span class='nobr'>a\nreflexive<\/span> level. <span class='nobr'>But since<\/span> I'd just done <span class='nobr'>a bunch<\/span> of PayPal stuff, <span class='nobr'>I actually<\/span> gave it <span class='nobr'>a moment's<\/span> look, and the lack of <span class='nobr'>a\nclick<\/span>-on-me-so-we-can-trick-you url caught my eye.<\/p>\n\n<p>Gee, maybe it's actually <i>real<\/i>?<\/p>\n\n<p>I logged into my new PayPal account, and was greeted with:<\/p>\n\n<img loading=\"lazy\" decoding=\"async\" src=\"\/i\/s\/PayPal-Lie.gif\" width=\"629\" height=\"311\"\nclass=\"ic tight\"\nid=\"iPayPal_Lie\"\nindexhint=\"left\"\/>\n\n<p>Even though I typed the url myself, and logged in with my own\ncredentials, <span class='nobr'>I still<\/span> kept checking to see whether <span class='nobr'>I was<\/span> really at the real\nPayPal site. <span class='nobr'>The original<\/span> email really, really smelled like phishing spam,\nbut gee, now it seemed to be real.<\/p>\n\n<p>PayPal, of course, has absolutely no insight into my credit card\nactivity, at least not beyond transactions that PayPal initiates itself, or\nbrokers on my behalf. They can't &#8220;monitor&#8221; <span class='nobr'>a third<\/span>-party credit-card\naccount any more than any other merchant that accepts credit cards. For\nexample, they can't monitor your credit-card activity any more than <span class='nobr'>a gas<\/span>\nstation or restaurant that accepts your card can.<\/p>\n\n<p>Yet, here they are telling me: <span style='font-family:times;color:#DDD'>&#8220;Our system detected unusual charges to <span class='nobr'>a credit<\/span> card linked to your PayPal\naccount&#8221;<\/span><\/p>\n\n<p>Clearly this is not true. It can't be true. It <i>is<\/i> the real PayPal, but it's <span class='nobr'>a blatant<\/span> lie. <i>What's going on?<\/i><\/p>\n\n<p>PayPal still showed the payment I'd just made as &#8220;completed&#8221;, but to be\nsafe, <span class='nobr'>I sent a<\/span> note to the vender asking whether they really did get the\nmoney. <span class='nobr'>The immediate<\/span> reply was no, PayPal had &#8220;un-completed&#8221; the payment,\nputting <span class='nobr'>a hold<\/span> on it.<\/p>\n\n<p>So, here I was with PayPal telling me that they'd transferred my money\naway, yet the vender not having received it. <span class='nobr'>I had no<\/span> further access to my\naccount, with no truthful hint as to why.<\/p>\n\n<p>Gee, what on earth could the problem be?<\/p>\n\n<p>Whatever it was, the &#8220;resolution&#8221; section of PayPal's site said that <span class='nobr'>I\nwould<\/span> need to provide all kinds of my personal information, like copies of\nmy passport, my Japanese-government <a\nhref=\"\/blog\/2006-05-18\/194#card\">proof of foreigner\nregistration card<\/a>, and <span class='nobr'>a copy<\/span> of my credit-card statement.<\/p>\n\n<p>There are a host of problems here, including:<\/p>\n\n<ul><li>If all this stuff was required, why didn't they tell me ahead of time, such as <b>before<\/b> <span class='nobr'>I created<\/span> the account,\n     <b>before<\/b> they told me that my credit-card registration was &#8220;successfully verified&#8221;,\n     <b>before<\/b> they let me transfer $100 in,\n     <b>before<\/b> they allowed me to make <span class='nobr'>a payment<\/span> with it,\n     or <b>before<\/b> they told the vender that I'd paid them?<\/li>\n\n<li>PayPal made it explicit that they would not accept online credit-card statements, only ones sent via postal mail. What if I'd opted\n     for the non-paper electronic-delivery option?<\/li>\n\n<li>What if <span class='nobr'>I was<\/span> traveling (say, <a href=\"\/blog\/2008-07-26\/881\">in Ohio<\/a> or <a href=\"\/blog\/2008-08-20\/914\">in Vancouver<\/a>)\n     and didn't have access to my postal mail?<\/li>\n\n<\/ul>\n\n<p>But mostly, <span class='nobr'>I wondered<\/span> why they would come up with <span class='nobr'>a fictitious<\/span> reason to\ndemand this additional personal information. The phishing-like nature of it\nfelt absolutely surreal.<\/p>\n\n<p>So, <span class='nobr'>I sent a<\/span> note to PayPal asking what the problem was. <span class='nobr'>I eventually<\/span> received <span class='nobr'>a boiler<\/span>-plate response &#8220;to lift the limitation, please provide\nyour passport, ....&#8221; that simply repeated what was on the web site.<\/p>\n\n<p>I sent another note...<\/p>\n\n<pre class='e926 jf926'>\nHi.\n\nYour note is just a copy of what's on the web site, which I already read.\nI asked, and I would hope you could answer, what this means:\n\n      \"Our system detected unusual charges to a credit card linked\n       to your PayPal account.\"\n\nI don't recall having given PayPal any permission to inspect charges on my\ncredit card, nor do I believe PayPal has the ability to inspect charges on\nmy credit card. So what does \"detected unusual charges\" mean?\n\nI'd very much like to know what, exactly, it means. What problem does\nPayPal perceive exists?\n<\/pre>\n\n<p>I went on to repeat what I'd written in the first two notes, that <span class='nobr'>I was<\/span>\ntraveling and had no access to my postal mail at home.<\/p>\n\n<p>The reply to that only added to the surrealness:<\/p>\n\n<pre class='e926'>\nDear Jeffrey,\n\nThank you for contacting PayPal. My name is Nestor Wilson. From reading\nyour email, I know this is regarding PayPal's security measures. I'm\nsorry if the situation caused any inconvenience, I'll be glad to help\nyou.\n\nPlease send to us the email that you received regarding the\nunusual charges in your account so that we could give you a detailed\nexplanation. <span style='color:white'>Upon checking your account I wasn't able to locate any\nlimitation placed on your account<\/span> that may lead to us sending you that\nemail.\n\nWe appreciate your assistance in resolving your question.\n\nIf you have any further questions, please feel free to contact us again.\n\nSincerely,\nNestor Wilson\nPayPal Resolution Services\nPayPal, an eBay Company\n<\/pre>\n\n<p>I replied, and eventually got another boiler-plate robot reply listing\nthe things that <span class='nobr'>I have<\/span> to send in (passport, credit-card statement, etc.),\nbut this time they <i>added<\/i> an item:<\/p>\n\n<pre class='e926'>\n- Submit a copy of a current utility bill. The bill must show your name and\n  address exactly as they appear in your PayPal account.\n<\/pre>\n\n<p>Wow, I didn't realize that having <span class='nobr'>a utility<\/span> in your name was <span class='nobr'>a\nprerequisite<\/span> to keeping <span class='nobr'>a PayPal<\/span> account open for more than an hour!<\/p>\n\n<p>Again, had they made this clear up front, <span class='nobr'>I would<\/span> have just abandoned\nthe whole thing. This new utility-bill requirement was <span class='nobr'>a double<\/span> bummer for\nme, because <i>even if<\/i> <span class='nobr'>I were<\/span> in Kyoto at the moment, it wouldn't do me\nany good because <span class='nobr'>I don't<\/span> have any of our utilities in my\n&#8220;English&#8221; name. <span class='nobr'>I am legally<\/span> allowed to use <span class='nobr'>a Japanese<\/span> name in\nJapan, <span class='nobr'>a right<\/span> <span class='nobr'>I avail<\/span> myself of because using <span class='nobr'>a Japanese<\/span> name makes\neverything more convenient.<\/p>\n\n<p style='margin-top:40px'><span class='nobr'>I was<\/span> rapidly losing hope, but <span class='nobr'>I sent<\/span> <span class='nobr'>a third<\/span> note, asking that if <span class='nobr'>a human<\/span> were\nto actually read the email, <i>please<\/i> explain the problem to me.<\/p>\n\n<p>Eventually, <span class='nobr'>I got a<\/span> fourth note from PayPal:<\/p>\n\n<pre class='e926'>\nDear Jeffrey,\n\nThank you for contacting PayPal.\n\nWe're so sorry that we could not tell you more details about PayPal's\nsecurity methods as many bad persons are trying to detect our security\nprotection methods by creating fake account and asking restriction\nreasons.\n\nAnd you could only agree to cooperate and provide additional documents or\njust refuse to cooperate and ask PayPal to deny your appeal at once.\n\nThanks again for writing, and thank you for being part of the PayPal\ncommunity.\n\nSincerely,\nPayPal Account Review Department\nPayPal, an eBay Company\n<\/pre>\n\n<p>Huh?<\/p>\n\n<p>I don't quite understand the broken English about &#8220;your appeal&#8221;, but it\nstarted to dawn on me that PayPal Japan and PayPal America were somehow\nsharing some information (my emails), but not others (that there's <span class='nobr'>a hold<\/span>\non my account).<\/p>\n\n<p>In any case, this was encouraging in one sense because the message was\nclearly written by <span class='nobr'>a human<\/span> in response to something <span class='nobr'>I wrote,<\/span> so <span class='nobr'>I was<\/span>\ngetting somewhere. <span class='nobr'>I crafted<\/span> <span class='nobr'>a reply<\/span> with clearly-worded, simple English\nthat explained the very odd situation <span class='nobr'>I was<\/span> finding myself in, appealing\nfor information. The whole &#8220;detected unusual charges&#8221; falsehood\nstill weighted heavily.<\/p>\n\n\n<p style='margin-top:40px'>The next reply from PayPal was less ambiguous: <span style='color:white'>they were kicking me out, but keeping my money<\/span>:<\/p>\n<pre class='e926'>\nDate: Tue, 02 Sep 2008 17:54:21 -0700\nFrom: service-jp@paypal.com\nto: <i>me<\/i>\nsubject: Limited Account Access Appeal Denied\n\nDear Jeffrey,\n\nWe understand risk is inherent in doing business. However, as of right now,\nwe're not comfortable with the amount of risk your business is exposed to.\n\nWith that in mind, <span style='color:white'>we have decided to end our business relationship<\/span> while\nminimizing disruption to your business.\n\n\n-----------------------------------\nDisbursement Options\n-----------------------------------\n\nOption 1. If you owe refunds to any of your buyers, you can use the money\nin your PayPal account to refund them.\n\nTo refund your buyers:\n1. Log in to your PayPal account\n2. Click \"Contact Us\" at the bottom of any page\n3. Click \"Contact Customer Service\"\n4. Under \"Choose a Topic,\" select \"Sending\/Receiving Money\"\n5. Under \"Choose a Subtopic,\" select \"Refund\/Cancel a Payment\"\n6. Click \"Continue\" and follow the instructions to refund payments\n\nOption 2. <span style='color:white'>Money in your PayPal account will be held for 180 days.<\/span> After 180\ndays, we'll email you with information on how to receive your funds.\n\nWe regret any inconvenience this may cause.\nSincerely,\nPayPal Account Review Department\n\nPlease do not reply to this email. This mailbox is not monitored and you\nwill not receive a response. For assistance, log in to your PayPal account\nand click the Help link in the top right corner of any PayPal page.\n<\/pre>\n\n<p>I about blew a fuse.<\/p>\n\n<p>What right did they have to keep my money? <span class='nobr'>Why would<\/span> they hold it for\n<i>six months<\/i>? What if <span class='nobr'>I no<\/span> longer have access to that email account by then?<\/p>\n\n<p><b>WHAT THE FUCK IS GOING ON HERE?<\/b><\/p>\n\n<p>It's only a hundred dollars at stake, but the <i>wrongness<\/i> just\ngalls me. <span class='nobr'>It pissed<\/span> me off so much that <span class='nobr'>I was<\/span> losing sleep.<\/p>\n\n<p style='margin-top:40px'>When you register <span class='nobr'>a credit<\/span> card with PayPal, as\npart of the verification that it's really your card, they make <span class='nobr'>a small<\/span>\ncharge to the card, and you then have to tell them the secret code they\nused in the &#8220;merchant name&#8221; associated with that charge. <span class='nobr'>I'd successfully<\/span> done this when <span class='nobr'>I created<\/span> the account, before the problems arose. <span class='nobr'>In looking<\/span> back at those transactions on my credit card's website, <span class='nobr'>I noticed<\/span> that\nPayPal had also included <span class='nobr'>a phone<\/span> number in the &#8220;merchant name&#8221;, so <span class='nobr'>I gave<\/span>\nit <span class='nobr'>a try.<\/span><\/p>\n\n<p>Shockingly, and to PayPal's great credit, <span class='nobr'>I was able<\/span> to reach <span class='nobr'>a human<\/span>\nbeing fairly quickly, an exceedingly pleasant Christine in Nebraska. <span class='nobr'>We talked<\/span> for quite <span class='nobr'>a long<\/span> time, as <span class='nobr'>I explained<\/span> the whole ordeal, offered all\nkinds of ways to authenticate myself to them, etc. <span class='nobr'>She was chatty<\/span> and\ninterested in Japan. <span class='nobr'>I was more<\/span> than happy to talk up Kyoto, but it was\nalways in the back of my mind that her interest was perhaps just part of an\nanti-<a\nhref=\"http:\/\/en.wikipedia.org\/wiki\/Social_engineering_(security)\">social\nengineering<\/a> strategy. <span class='nobr'>I'm all for<\/span> combating social-engineering, and <span class='nobr'>I\nenjoyed<\/span> the conversation, and in any case, <span class='nobr'>I was so<\/span> very relieved to be talking\nto <span class='nobr'>a real<\/span> person who seemed to understand the frustration of the\nsituation.<\/p>\n\n<p>What she didn't seem to understand (or admit) was how ludicrous the whole\n&#8220;detected unusual charges&#8221; claim was, but in any case, she made <span class='nobr'>a lot<\/span> of\nnotes on my account, and suggested that everything would be fine if <span class='nobr'>I were<\/span>\nto fax <span class='nobr'>a copy<\/span> of my passport and Japanese driver license. <span class='nobr'>I scanned<\/span> them,\nredacted anything that they didn't need to know about, and uploaded it to\ntheir server.<\/p>\n\n<p>I eventually got another broken-English reply thanking me for my\npassport, but reiterating the need for <span class='nobr'>a utility<\/span> bill and the credit-card\nstatement. Arrrrrrrrrrgh! <span class='nobr'>I tried<\/span> calling PayPal again, but being 2:30am by\nthis time, they were closed.<\/p>\n\n<p>I called again the next morning (this morning) and again quickly reached\n<span class='nobr'>a human<\/span> (!!!). <span class='nobr'>I explained<\/span> the whole long drawn-out story, and was bumped\nup to someone else. <span class='nobr'>I explained<\/span> the whole story again, and was again\nbumped up, this time to a &#8220;limitation specialist&#8221;. This was\ngetting encouraging! Someone who could perhaps <i>do something<\/i>!<\/p>\n\n<p>I explained everything all over again, and the heavens opened up and the\nangels sang: she lifted the hold on my account!<\/p>\n\n<p>Un-be-friggin'-lievable.<\/p>\n\n<p>The &#8220;completed&#8221; payment (that I'd created the account for in\nthe first place) now really did go through, but here's the kicker:\nsomewhere during this ordeal I'd hedged my bets and enlisted the help of <span class='nobr'>a\nKyoto<\/span> friend, who PayPal'd the funds to the merchant for me. So, my order\nwas shipped and <span class='nobr'>I already<\/span> had <span class='nobr'>a tracking<\/span> number. This newly (re)completed\npayment was now <span class='nobr'>a duplicate.<\/span><\/p>\n\n<p>The merchant, who was really understanding throughout, immediately\nissued <span class='nobr'>a refund.<\/span> Assuming that <span class='nobr'>I do<\/span> get the shipment and it's not <span class='nobr'>a box<\/span> of\nrocks, I'll be writing a <i>glowing<\/i> post about the vender [<a\nhref=\"\/blog\/2010-09-22\/1623\">here it is<\/a>]. They were\nreally top notch, as if they really cared about running <span class='nobr'>a good<\/span> business.\nPayPal America wasn't bad, either.<\/p>\n\n<p>PayPal Japan, though? Abysmal.<\/p>\n\n<p>What a week.<\/p>\n\n<p><b>Update one month later<\/b>: See this <a href=\"\/blog\/2008-10-01\/951\">followup post<\/a> for more about this, from the Director of Account Protection at PayPal.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>I've had the most surreal PayPal experience over the last week or so.<\/p> <p>I've long had a US PayPal account, but last week needed to create a Japanese PayPal account because I wanted to have a purchase shipped to my house (in Kyoto) from a vender that ships only to the verified \"home address\" of the paying PayPal account. So, I created a Japan PayPal account, and registered my credit card with it. The credit card's Kyoto billing address provided the requisite PayPal address verification.<\/p> <p>After the credit-card registration was successful (which entailed them placing a small charge on the [...]","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/posts\/926"}],"collection":[{"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/comments?post=926"}],"version-history":[{"count":0,"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/posts\/926\/revisions"}],"wp:attachment":[{"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/media?parent=926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/categories?post=926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/regex.info\/blog\/wp-json\/wp\/v2\/tags?post=926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}