Live data from Hacker News

A failure of security systems at PayPal is causing concern for German banks

nordbayern.de

131–140 of 222 posts

Re: A failure of security systems at PayPal is causing concern for German banks

#131
post #57

Recently I found out that one of my friends had his identity stolen, thousands and thousands drained from his bank accounts. After thorough investigation it was traced to a PayPal breach, and he had to fight hard to get them to admit it was their fault. He got everything back, eventually, but the whole process was a nightmare.

Do you know how this exactly went down? How can a PayPal breach result in money being stolen from a bank account? Genuinely interested to understand

Re: A failure of security systems at PayPal is causing concern for German banks

#132
post #122

Earlier quoted context omitted.

That's a simplistic way of understanding "best interest." The optimal amount of fraud is neither zero nor "let it all through." Their "best interest" is a balance between allowing legit transactions to get through and blocking enough fraudulent ones that fraud doesn't become too common.

This is an important concept. More you push to zero fraud, the more inconvenience you put on your customer. You can cut bunch of fraud if you only allow shipments to the billing address but then you inconvenience people who want to buy gifts, recently moved or have a vacation home. You can block all traffic from cloud providers but you'll end up blocking outbound proxies for people on military bases or corporate prox…

Personally I'd like to see a move away from just giving your card details to a website and having them charge it for whatever they want. Because it just ends up that stolen details go around and get used for fraud easily.

Should be moving to a system where setting up payments with a new provider has them request access to charge you, and then on the bank app you approve it. Australia has this as a fairly new system called PayTo, where you can approve and later unapprove individual merchants the ability to charge you.

Re: A failure of security systems at PayPal is causing concern for German banks

#133

Earlier quoted context omitted.

The resistance against instant payments mostly has to do with technicalities around bank balance sheets and inter-bank settlement systems. It's a bit complex for a comment, but the TLDR is: * funds in transit (called "positive float") are held in the banks account, and can be used by the bank to earn interest * liquidity management - there are a bunch of considerations here, but the longer settlement periods enable b…

This comment is not towards you but there's always an excuse with the big German banks. For example, during Covid when interest rates where negative - some major German banks like Commerzbank charged interest from customers when their balance exceeded an amount like 50000€. Now that the interest rates have gone up - they are not even close to passing on those high interest rates. The same Commerzbank now asks for 500…

To be clear: I didn't mean they have to drag their feet. They just do it because they will lose some income.

Re: A failure of security systems at PayPal is causing concern for German banks

#134
post #39

Earlier quoted context omitted.

The + of PayPal was in 2005 when you could use it to hide your card number from the merchant. But now, you can generate one-time use cards, which are safer than assigning a card on your PayPal account. The other thing, is that you can do chargebacks more easily, when you buy on eBay, but this comes at the cost of higher fees (which is basically insurance) Other than that, it's a platform that cannot be trusted

I can't speak to how other European countries did only payments, but you never gave your credit card number to the merchant in Denmark. It was always done via a 3rd. party payment provider, initially mostly DIBS, then came WorldPay and later many more. Charge backs was also always fairly easily done via your bank. Though you did have to call them, so yes PayPal was/is easier. I don't know, the trust in PayPal was alw…

It was before 2006 (enforcement of PCI DSS), at that time, a lot of merchants just created and hosted themselves a payment form and stored bank card numbers themselves, numbers that they often collected on non-HTTPS pages

Re: A failure of security systems at PayPal is causing concern for German banks

#135
post #131
post #57

Recently I found out that one of my friends had his identity stolen, thousands and thousands drained from his bank accounts. After thorough investigation it was traced to a PayPal breach, and he had to fight hard to get them to admit it was their fault. He got everything back, eventually, but the whole process was a nightmare.

Do you know how this exactly went down? How can a PayPal breach result in money being stolen from a bank account? Genuinely interested to understand

PayPal very strongly tries to make you give them your full bank info (remember that the banking system has absolutely no security as the computer world knows it - this is a feature required for checking to work - so this means anybody with access to your bank id numbers in PayPal's records can do arbitrary transactions to/from your bank account). When I last used it it was possible to avoid on the buyer end and just use a credit card, but I haven't used it for years and I think it was different on the seller end even then.

Re: A failure of security systems at PayPal is causing concern for German banks

#136
post #11

Earlier quoted context omitted.

The existing giro system is the real Paypal competitor. Most Europeans had access to Paypal-style money transfers before they had email. Merchants probably want to rely on another party to maintain their integration, but there is no real need for another centralized service similar to Paypal. (The U.S. really is an outlier among developed nations in that its giro system is not widely used, and many residents would no…

> The existing giro system is the real Paypal competitor. Most Europeans had access to Paypal-style money transfers before they had email. Not at all, not even close! In most cases, that's wrong even today. Want to sell something online? A book you wrote, a game you made? There's no way for people to pay you via giro and automatically receiving the good on the page where the payment process was initiated. Giro is not…

SEPA Instant Credit Transfer allows instant sepa transfers, and soon all transactions will be required to be ict if possible.

Banks have APIs you can integrate with, which e.g. KDE's money app used to support in the past.

The actual underlying transaction system is extremely well designed and reliable, it's just missing the nice APIs that other payment systems have.

Re: A failure of security systems at PayPal is causing concern for German banks

#137
post #105

Earlier quoted context omitted.

I'm trying to think of any bank that I've used that would not have "address book"-like functionality, and I can't think of one. All of them have this, and have had the feature for as long as I've used their online banking. Perhaps the banks you're used to aren't very modern? SEPA transfers are (at least mine have been) max. 1h until the transfer is complete (some limit this to "banking hours"). Instantaneous transfer…

That's also not my experience. Giro was a nightmare compared to paypal 15 years ago and the only reason it slightly improved was regulations, not because the german banks cared about the customer experience. Now in 2025 Giro is dead as banks like DKB don't even hand out those cards by default. The system in germany is a big mess despite so many fintechs in germany.

> Now in 2025 Giro is dead as banks like DKB don't even hand out those cards by default.

Mastercard has started to punish banks that support Girocard by default, demanding that banks drop support.

This is not an issue with Giro or Girocard, but with the existing payment monopolies.

Re: A failure of security systems at PayPal is causing concern for German banks

#138
post #76

Earlier quoted context omitted.

> The existing giro system is the real Paypal competitor. Most Europeans had access to Paypal-style money transfers before they had email. Not at all, not even close! In most cases, that's wrong even today. Want to sell something online? A book you wrote, a game you made? There's no way for people to pay you via giro and automatically receiving the good on the page where the payment process was initiated. Giro is not…

ideal will handle that. But it’s only in NL.

ideal is being shut down, and merged with German GiroGo/PayDirekt and Danish Dankort into Wero, which is what this entire subthread is about.

Re: A failure of security systems at PayPal is causing concern for German banks

#139

Earlier quoted context omitted.

The resistance against instant payments mostly has to do with technicalities around bank balance sheets and inter-bank settlement systems. It's a bit complex for a comment, but the TLDR is: * funds in transit (called "positive float") are held in the banks account, and can be used by the bank to earn interest * liquidity management - there are a bunch of considerations here, but the longer settlement periods enable b…

This comment is not towards you but there's always an excuse with the big German banks. For example, during Covid when interest rates where negative - some major German banks like Commerzbank charged interest from customers when their balance exceeded an amount like 50000€. Now that the interest rates have gone up - they are not even close to passing on those high interest rates. The same Commerzbank now asks for 500…

As a reluctant Commerzbank customer, there's some inaccuracies. The amount was 100k€ re: negative interest, and the subscription charge only applies if you're not moving a certain amount of money each month (which is very low, even unemployment payments would be enough to clear that hurdle).

So you're only paying for your second or third account.

Re: A failure of security systems at PayPal is causing concern for German banks

#140
post #54

Earlier quoted context omitted.

Just delete it. I used to have an account, and my experience using “guest payments” (which are usually, but not always, supported) is generally more reliable than logging in and paying.

This requires a bank that will issue one time use card numbers. PayPal is less friction for the benefit of proxying your credentials.

Or you just put your regular credit card number into PayPal and tell it that you want to check out as guest. There's a little option that you need to uncheck so it doesn't try to make you an account.
Post reply on HN