Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal and zero-dollar invoice spam

troyhunt.com

Post reply on HN
Print view View original

51–60 of 77 posts

Re: PayPal and zero-dollar invoice spam

#51

Post by shostack »

wheaties wrote: post #5

On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.

Yeah, as much as I hate it, I always find myself appreciating the ingenuity that goes into these things.

Another similar spam hack (that unless I'm mistaken is also legal) is the recent plague of Google Analytics referrer spam targeting people who pay attention to their GA referral reports.[1] It has actually caused some issues given that the volume can be quite significant and can easily skew your overall numbers by quite a bit if left unfiltered.

[1] https://moz.com/blog/how-to-stop-spam-bots-from-ruining-your...

Re: PayPal and zero-dollar invoice spam

#52

Post by tempestn »

bcrescimanno wrote: post #40
xentronium wrote: post #19

> @AskPayPal: I recommend deleting that tweet, it has your personal info > @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email! This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

From the perspective of PayPal, it's not that his personal email address is made public. It's that the fact that he has a PayPal account associated with that email address is made public. It's similar to advice for "forgot password" forms not to acknowledge whether or not an email address or username actually exists--simply tell the user an email was sent for that account regardless.

Fair enough, but it's a reasonable guess that any given primary email address has a paypal account associated with it. It's also not really secret, because you share that information with people to allow them to send you money.

Re: PayPal and zero-dollar invoice spam

#53

Post by HillRat »

bcrescimanno wrote: post #39

PayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our…

It seems like only allowing a zero-dollar invoice after two parties have conducted another non-zero legitimate transaction might be a solution.

Re: PayPal and zero-dollar invoice spam

#54

Post by samstave »

asfakeaccount wrote: post #48
samstave wrote: post #45

Earlier quoted context omitted.

Don't know if you can answer this: Why can I venmo people money instantly and paypal holds my money for days or weeks at a time?

You can not venmo money instantly. The UI makes it seem that way, but it takes a few days for payment to process and as such, Venmo has become a target for scams: http://time.com/money/4036511/venmo-more-check-than-cash/ So do not use Venmo for commercial transactions (buying things of Craiglist for example) and do not assume the money transfers immediately. Also shame on Venmo for misleading their users; they should…

I only use it to transfer money between myself and friends. The most time I've ever had to wait to get money from venmo to bank is 24 hours.

the longest I've had to wait from Paypal is 24 DAYS

Re: PayPal and zero-dollar invoice spam

#55

Post by panorama »

samstave wrote: post #54
asfakeaccount wrote: post #48

Earlier quoted context omitted.

You can not venmo money instantly. The UI makes it seem that way, but it takes a few days for payment to process and as such, Venmo has become a target for scams: http://time.com/money/4036511/venmo-more-check-than-cash/ So do not use Venmo for commercial transactions (buying things of Craiglist for example) and do not assume the money transfers immediately. Also shame on Venmo for misleading their users; they should…

I only use it to transfer money between myself and friends. The most time I've ever had to wait to get money from venmo to bank is 24 hours. the longest I've had to wait from Paypal is 24 DAYS

This is a bit misleading - PayPal's 21-day hold only applies if you received the funds as payment for goods and services. Even in that case, the funds can be expedited to release in 3-5 days once the buyer marks the item as received. It's more for buyer protection than anything.

If you're in the US and receive money via a "Friends and Family" transfer, it's just as 'instant' as Venmo.

Re: PayPal and zero-dollar invoice spam

#56

Post by ikeboy »

magicmu wrote: post #11
wheaties wrote: post #5

On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.

It can, however, be useful to get invoices for purchases that were discounted down to $0.00. At the startup I'm with we often give new customers a $0.00 trial rate, but they still want invoices so their billing department can keep track. Of course, this billing system isn't using PayPal, but just a thought.

Not invoices per se, but if you buy something on eBay using only eBay gift cards, it processes as a PayPal "transaction" of $0.00. I've got a bunch of those in my email, always interesting to see "You sent a payment of $0.00 USD to X".

Re: PayPal and zero-dollar invoice spam

#57

Post by everfree »

bcrescimanno wrote: post #39

PayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our…

Genuine question: What are the legitimate uses of $0 invoices? The only thing I can think of is a product that usually costs money (and thus has an invoice workflow), but has been marked as free for some promotion.

Re: PayPal and zero-dollar invoice spam

#58

Post by jtchang »

everfree wrote: post #57
bcrescimanno wrote: post #39

PayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our…

Genuine question: What are the legitimate uses of $0 invoices? The only thing I can think of is a product that usually costs money (and thus has an invoice workflow), but has been marked as free for some promotion.

It is very common to send $0 invoices. Some instances I can think of are receiving replacement goods / tracking if a service was rendered but not billable / making sure an account is zero'ed and you are fully paid up / etc

Re: PayPal and zero-dollar invoice spam

#59

Post by jtchang »

HillRat wrote: post #53
bcrescimanno wrote: post #39

PayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our…

It seems like only allowing a zero-dollar invoice after two parties have conducted another non-zero legitimate transaction might be a solution.

I can see a lot of cases where you have a $0 legitimate transaction.
Post reply on HN