Live data from Hacker News

PayPal and zero-dollar invoice spam

troyhunt.com

31–40 of 77 posts

Re: PayPal and zero-dollar invoice spam

#31

Has PayPal just not tried to fix anything or add features other than a CSS refresh in, like, ever?

They acquired Venmo, which was pretty big for adding users to their ecosystem. They've kept it pretty quiet and have not tried to link the brands together, which probably says something about the current state of Paypal's brand.

Venmo was actually acquired by Braintree, which in turn was later acquired by PayPal.

Re: PayPal and zero-dollar invoice spam

#32
post #5

On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.

Actually a simpler fix is to hold $10 in the user's paypal account for each $0 invoice they send, and if the invoice is reported back as spam they keep the $10, otherwise after 90 days they release it back to the (potential) spammer. Doing this with funds in the account, rather than with a (likely) stolen credit card, works very well.

For accounts which keep an average balance > $minimum you could wave the $10 hold and just confiscate $10 every time someone reported their $0 invoice as spam.

Re: PayPal and zero-dollar invoice spam

#33

> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

Re: PayPal and zero-dollar invoice spam

#34
post #33

> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

I mean, it does slightly increase your rate of spam. I have a private email that I only give out to RL people that has never received a spam message.

Re: PayPal and zero-dollar invoice spam

#35
post #33

Earlier quoted context omitted.

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

I mean, it does slightly increase your rate of spam. I have a private email that I only give out to RL people that has never received a spam message.

Wow I love this idea! Can't believe I haven't thought of it

Re: PayPal and zero-dollar invoice spam

#36

> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

Hanlon's Razor dictates to "Never attribute to malice that which is adequately explained by stupidity".

Re: PayPal and zero-dollar invoice spam

#37
post #33

> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

If you can keep your email address off the front page of the internet, I figure that will help reduce spam.

Re: PayPal and zero-dollar invoice spam

#38
post #33

Earlier quoted context omitted.

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

If you can keep your email address off the front page of the internet, I figure that will help reduce spam.

At this point, that's like trying to reduce flooding by not dumping a bucket into the river. There's so much spam out there that your only hope is effective filtering.

Re: PayPal and zero-dollar invoice spam

#39
PayPal employee here (and I'm hiring Node.js developers :P ).

I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix.

The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our product worse for our many legitimate customers by going too far in trying to stop this spam.

Re: PayPal and zero-dollar invoice spam

#40

> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

From the perspective of PayPal, it's not that his personal email address is made public. It's that the fact that he has a PayPal account associated with that email address is made public.

It's similar to advice for "forgot password" forms not to acknowledge whether or not an email address or username actually exists--simply tell the user an email was sent for that account regardless.

Post reply on HN