Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A failure of security systems at PayPal is causing concern for German banks

nordbayern.de

Post reply on HN
Print view View original

171–180 of 222 posts

Re: A failure of security systems at PayPal is causing concern for German banks

#171

Post by indigo945 »

Dylan16807 wrote: post #166
tomschwiha wrote: post #153

Earlier quoted context omitted.

You are not required to accept the tracking. You can pay to remove tracking with their "Pur-Abo".

That is definitely a GDPR violation (for users in the EU). And heise.de has already gotten in trouble for this before.

That is not a GDPR violation, no. Most German newspapers do this, and it has been tried in court - it's legal. The court only mandated that the subscription fee cannot be substantially higher than the value of the data that would have otherwise been sold.

Re: A failure of security systems at PayPal is causing concern for German banks

#172

Post by FeepingCreature »

indigo945 wrote: post #171
Dylan16807 wrote: post #166

Earlier quoted context omitted.

That is definitely a GDPR violation (for users in the EU). And heise.de has already gotten in trouble for this before.

That is not a GDPR violation, no. Most German newspapers do this, and it has been tried in court - it's legal. The court only mandated that the subscription fee cannot be substantially higher than the value of the data that would have otherwise been sold.

Yeah it is, if courts decided otherwise then courts decided wrong, the GDPR is very clear and explicit about this:

> Consent is presumed not to be freely given if [...] the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

Re: A failure of security systems at PayPal is causing concern for German banks

#173

Post by pbmonster »

korhojoa wrote: post #94
pbmonster wrote: post #66

Earlier quoted context omitted.

> The existing giro system is the real Paypal competitor. Most Europeans had access to Paypal-style money transfers before they had email. Not at all, not even close! In most cases, that's wrong even today. Want to sell something online? A book you wrote, a game you made? There's no way for people to pay you via giro and automatically receiving the good on the page where the payment process was initiated. Giro is not…

I'm trying to think of any bank that I've used that would not have "address book"-like functionality, and I can't think of one. All of them have this, and have had the feature for as long as I've used their online banking. Perhaps the banks you're used to aren't very modern? SEPA transfers are (at least mine have been) max. 1h until the transfer is complete (some limit this to "banking hours"). Instantaneous transfer…

> a banking barcode (or EPC QR if you prefer) displayed on the seller's webpage with unique reference + reading it with your phone and making the payment is that internet payment method via giro. The webshop uses PSD2 open banking to get notified of new transactions and knows when it is transferred.

Yes, that's what I'm talking about. This is how services like Twint in Switzerland or PayPal in Germany have worked for the last decade+.

You're saying this is currently possible, with any arbitrary two German/European banks on either end? Your customer scans the QR code, hits a button, and the QR code is replaced by a download link, and the delay is Do you have a link for the tech stack to built this?

Re: A failure of security systems at PayPal is causing concern for German banks

#174

Post by tchalla »

kuschku wrote: post #139
tchalla wrote: post #100

Earlier quoted context omitted.

This comment is not towards you but there's always an excuse with the big German banks. For example, during Covid when interest rates where negative - some major German banks like Commerzbank charged interest from customers when their balance exceeded an amount like 50000€. Now that the interest rates have gone up - they are not even close to passing on those high interest rates. The same Commerzbank now asks for 500…

As a reluctant Commerzbank customer, there's some inaccuracies. The amount was 100k€ re: negative interest, and the subscription charge only applies if you're not moving a certain amount of money each month (which is very low, even unemployment payments would be enough to clear that hurdle). So you're only paying for your second or third account.

> the subscription charge only applies if you're not moving a certain amount of money

This has changed since May 2025. Talk about inaccuracies ;)

Btw, as much as I appreciate the “correction” it doesn’t change overall direction of the comment.

Re: A failure of security systems at PayPal is causing concern for German banks

#175

Post by Dylan16807 »

indigo945 wrote: post #171
Dylan16807 wrote: post #166

Earlier quoted context omitted.

That is definitely a GDPR violation (for users in the EU). And heise.de has already gotten in trouble for this before.

That is not a GDPR violation, no. Most German newspapers do this, and it has been tried in court - it's legal. The court only mandated that the subscription fee cannot be substantially higher than the value of the data that would have otherwise been sold.

Even under that idea, I very strongly doubt the subscription fee is in that range.

Re: A failure of security systems at PayPal is causing concern for German banks

#176

Post by adornKey »

chatmasta wrote: post #110
raphman wrote: post #87

Earlier quoted context omitted.

Better link: https://www.heise.de/en/news/Paypal-German-banks-apparently-...

Maybe it’s a better link, but I can only read the content if I accept their sharing my data with 180 partners.

South Park once had a good scene about just not accepting random things that pop up (in HumancentiPad). If you see something popping up on a website - maybe just delete the pop-up from the HTML. (Click on Inspect - Examine - Delete).

Heise is a bit nasty with technology, and it's a bit harder to get rid of their thing, but I can read everything without accepting anything.

Re: A failure of security systems at PayPal is causing concern for German banks

#177

Post by tgsovlerkhgsel »

tomschwiha wrote: post #154
tgsovlerkhgsel wrote: post #77

Earlier quoted context omitted.

Also protect themselves (or rather, PayPal's bank). These were almost certainly SEPA debits. Consumers could reverse unauthorized transactions (think "chargeback" but on steroids - customer says to revert, it gets reverted, no discussion) and their bank would then have to try to get the money from PayPal's bank, which would then have to get it back from PayPal.

I think the bank of the consumer is also completely automatically getting the money back. The risk is on the initiator if the payment (=PayPal).

Yes, I may not have described it well. The "try" only refers to "if the other bank is bankrupt, they get stuck with the loss" - they don't have to argue with the other bank. So unless PayPal's bank fails, it's a very simple process for the customer's bank.

In general, the bank of the entity initiating the debit will only let someone initiate debits to the extent to which they'd be willing to give them a loan.

Re: A failure of security systems at PayPal is causing concern for German banks

#178

Post by bratwurst3000 »

pbmonster wrote: post #173
korhojoa wrote: post #94

Earlier quoted context omitted.

I'm trying to think of any bank that I've used that would not have "address book"-like functionality, and I can't think of one. All of them have this, and have had the feature for as long as I've used their online banking. Perhaps the banks you're used to aren't very modern? SEPA transfers are (at least mine have been) max. 1h until the transfer is complete (some limit this to "banking hours"). Instantaneous transfer…

> a banking barcode (or EPC QR if you prefer) displayed on the seller's webpage with unique reference + reading it with your phone and making the payment is that internet payment method via giro. The webshop uses PSD2 open banking to get notified of new transactions and knows when it is transferred. Yes, that's what I'm talking about. This is how services like Twint in Switzerland or PayPal in Germany have worked for…

? I open my bank app go to new transaction scan the IBAN of the seller and send the money. I think the time I made a paypall account added to the paypal transfer time is more then 20sec. I have my banking app anyway.

dude honestly no idea what your point is. since instant and free giro transfer with more or less 3 clicks is the death pf anything else.

why the fuck should I have an extra layer to my bank? Its insecure ;)

I would like to know are you american? This thread is about europe

Re: A failure of security systems at PayPal is causing concern for German banks

#179

Post by Freak_NL »

indigo945 wrote: post #171
Dylan16807 wrote: post #166

Earlier quoted context omitted.

That is definitely a GDPR violation (for users in the EU). And heise.de has already gotten in trouble for this before.

That is not a GDPR violation, no. Most German newspapers do this, and it has been tried in court - it's legal. The court only mandated that the subscription fee cannot be substantially higher than the value of the data that would have otherwise been sold.

It's basically the status quo for German websites. This seems legally settled for now unless some appellate court strikes it down, and even that won't happen any time soon.

As a user it's just odd to see German websites do this so differently from Dutch or British websites.

What should be made illegal is how all those German popups do this really grating 3D animation effect upon closing. Do you know what I mean? Not the one at heise.de, but most of these forms seem to have this built in.

Re: A failure of security systems at PayPal is causing concern for German banks

#180

Post by fransje26 »

the_duke wrote: post #69
tchalla wrote: post #15

Earlier quoted context omitted.

German banks (and in general businesses) are amazing. They won't do anything until legally required to do so and even then will drag their feet. There has been instant bank transfers (transfers in 10 seconds) available for a while - launched in November 2017. German banks kept charging 1.5€ for this instant transfer or some didn't have them available at all. They didn't build any of these systems and yet this was the…

The resistance against instant payments mostly has to do with technicalities around bank balance sheets and inter-bank settlement systems. It's a bit complex for a comment, but the TLDR is: * funds in transit (called "positive float") are held in the banks account, and can be used by the bank to earn interest * liquidity management - there are a bunch of considerations here, but the longer settlement periods enable b…

> The delay also means systems have more time to catch fraudulent transactions, and to block them before they happen.

Which is complete nonsense as the transaction is actually forward-payed, and guaranteed by the central European bank, exactly for that reason.

So, in fact, the only reason why certain banks delay payments is so that they can keep the funds "in transit" to earn interests.

Plenty of banks don't play that game, so if your bank does, they are taking the piss and it's time to change.

Post reply on HN