Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A failure of security systems at PayPal is causing concern for German banks

nordbayern.de

Post reply on HN
Print view View original

201–210 of 222 posts

Re: A failure of security systems at PayPal is causing concern for German banks

#201

Post by ta12653421 »

anal_reactor wrote: post #146
weinzierl wrote: post #56

Earlier quoted context omitted.

Wero looks very much like a bureaucratic paper tiger to me. I do not know a single person that uses it despite the massive advertising campaign they are running. What really replaces Paypal in my everyday life is Revolut.

Half of Europe has widely used national systems for instant payments, the other half does not. The idea behind Wero is to unify this to one single system, available across whole Europe. For reference, I use these systems for like 80% of my online payments. Of course nobody's using Wero now because the whole thing isn't really online yet, just a pilot program on a few websites with a few banks.

mainly wrong:

WERO is an application/UI layer on top of SCT INST payment scheme, which adds some additional features like "send to email" etc. as well as other pay-specific features in the future (pay-per-request, which is also a defined way in the SEPA/EURO rulebooks and processing docs)

Re: A failure of security systems at PayPal is causing concern for German banks

#202

Post by ta12653421 »

heisenbit wrote: post #51

It is worth remembering that PayPal not only handles payments but also provides a degree of assurance to receive the goods. A pure payment system does not. From a customer perspective this can provide real value as filing a claim with PayPal gets merchants definitely to listen more closely.

you could integrate such a function easy in any other payment product flow

Re: A failure of security systems at PayPal is causing concern for German banks

#203

Post by kuschku »

tchalla wrote: post #174
kuschku wrote: post #139

Earlier quoted context omitted.

As a reluctant Commerzbank customer, there's some inaccuracies. The amount was 100k€ re: negative interest, and the subscription charge only applies if you're not moving a certain amount of money each month (which is very low, even unemployment payments would be enough to clear that hurdle). So you're only paying for your second or third account.

> the subscription charge only applies if you're not moving a certain amount of money This has changed since May 2025. Talk about inaccuracies ;) Btw, as much as I appreciate the “correction” it doesn’t change overall direction of the comment.

> This has changed since May 2025. Talk about inaccuracies ;)

It has? I've never paid a subscription charge, and I've never been above that amount.

Re: A failure of security systems at PayPal is causing concern for German banks

#204

Post by xtiansimon »

dev_l1x_be wrote: post #79
tpurves wrote: post #75

Arbitraging fraud has always been PayPal's game. For the mass market of small-scale sellers there's a threshold, whre the cost of onboarding, verifying, underwriting and eating fraud exposure is greater than the revenues you could ever expect to make from them at their low volume. So these segments went un-served, same with many other segments of transactions or transactors. PayPal's model has always been to accept a…

Ebay and Paypal are full of scam. Simply it is thei best interest to keep this up because it generates revenue for them.

eBay is full of fraud? What are you buying?

Re: A failure of security systems at PayPal is causing concern for German banks

#205

Post by dathinab »

tomschwiha wrote: post #153
Dylan16807 wrote: post #149

Earlier quoted context omitted.

If I have to accept it I think that's even worse than doing typical tracking behind my back. Also requiring acceptance from EU users would be a GDPR violation, I think? But it didn't ask me at all so I can't evaluate it well.

You are not required to accept the tracking. You can pay to remove tracking with their "Pur-Abo".

yeah, but a choice between "ad+tracking" and "no-ads,no-tracking,payment" is not GDPR compliant. It's just that a huge part of EU newspapers do not like it leading to very long outdrawn court proceedings, and other issues.

Basically GDPR says you have to make it as simple to use your site with and without "tracking".

The important part here is it says "without tracking" not "without ads", so the choice presented is intentional deceptive and misleading. There is no technical reason to not have GDPR complaint ads, it's just that web ad market is dominated by a few quasi monopolies (leading Google) and they don't like "not targeted" advertisement at all.

What they theoretically have to provide is the choice between "targeted ad, tracking", "untargeted ad, no tracking" or "no ad, no tracking, payment".

Re: A failure of security systems at PayPal is causing concern for German banks

#206

Post by dathinab »

indigo945 wrote: post #171
Dylan16807 wrote: post #166

Earlier quoted context omitted.

That is definitely a GDPR violation (for users in the EU). And heise.de has already gotten in trouble for this before.

That is not a GDPR violation, no. Most German newspapers do this, and it has been tried in court - it's legal. The court only mandated that the subscription fee cannot be substantially higher than the value of the data that would have otherwise been sold.

> That is not a GDPR violation, no. Most German newspapers do this,

and pretty much all of them are in GDPR violation

just due to long dragged out court proceeding and a lot of lobby power or lets be honest corruption there have been no wide spread consequences

btw. a lot of them have a very hidden 3rd "no tracking, no payment" option which might display non-targeted ads based on the content viewed and is the actual legal required alternative (instead of the "pure abo") this is still not quite legal but much easier to worm yourself through the legal system with

Re: A failure of security systems at PayPal is causing concern for German banks

#207

Post by dathinab »

FeepingCreature wrote: post #172
indigo945 wrote: post #171

Earlier quoted context omitted.

That is not a GDPR violation, no. Most German newspapers do this, and it has been tried in court - it's legal. The court only mandated that the subscription fee cannot be substantially higher than the value of the data that would have otherwise been sold.

Yeah it is, if courts decided otherwise then courts decided wrong, the GDPR is very clear and explicit about this: > Consent is presumed not to be freely given if [...] the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

exactly IMHO this whole thing being dragged out/tolerated for this many year needs to criminal investigation into corruption and bribes

Re: A failure of security systems at PayPal is causing concern for German banks

#208

Post by korhojoa »

thirdsun wrote: post #186
bratwurst3000 wrote: post #93

Earlier quoted context omitted.

? IBAN transactions are instant and free. All three of my banking apps offer adresse books. why couldnt i sent money back? I see the sender and the IBAN I can even in some cases cancell payments where are you at? me france germany italy and switzerland. Are you from the states or canada? The parent talked about europe.

> ? IBAN transactions are instant and free. Instant transactions are a very recent development and are only starting to become common because banks are required by law to support them for free come October. Up until rather recently instant SEPA transfers were often either not supported or came with additional fees attached.

Based on the replies I've been seeing in this post, I'm starting to think that my banks (or I've somehow lucked out) have been very proactive in providing users with desirable features.

Instant transfers have been the default for quite a while, and possible (for a fee) for as long as I can remember.

Online payments with instant confirmation have been really easy for 15+ years.

Re: A failure of security systems at PayPal is causing concern for German banks

#209

Post by Magi604 »

baxtr wrote: post #131
Magi604 wrote: post #57

Recently I found out that one of my friends had his identity stolen, thousands and thousands drained from his bank accounts. After thorough investigation it was traced to a PayPal breach, and he had to fight hard to get them to admit it was their fault. He got everything back, eventually, but the whole process was a nightmare.

Do you know how this exactly went down? How can a PayPal breach result in money being stolen from a bank account? Genuinely interested to understand

I'll have to ask him for the details

Re: A failure of security systems at PayPal is causing concern for German banks

#210

Post by korhojoa »

pbmonster wrote: post #173
korhojoa wrote: post #94

Earlier quoted context omitted.

I'm trying to think of any bank that I've used that would not have "address book"-like functionality, and I can't think of one. All of them have this, and have had the feature for as long as I've used their online banking. Perhaps the banks you're used to aren't very modern? SEPA transfers are (at least mine have been) max. 1h until the transfer is complete (some limit this to "banking hours"). Instantaneous transfer…

> a banking barcode (or EPC QR if you prefer) displayed on the seller's webpage with unique reference + reading it with your phone and making the payment is that internet payment method via giro. The webshop uses PSD2 open banking to get notified of new transactions and knows when it is transferred. Yes, that's what I'm talking about. This is how services like Twint in Switzerland or PayPal in Germany have worked for…

Should be, yes. As long as instant transfers are enabled (which, reading this thread seems to not be as common as I thought).

I don't have a complete solution but this is all public information.

Barcode to read with your bank app (guide is in Finnish) https://www.finanssiala.fi/wp-content/uploads/2021/03/Pankki...

Example Bank API: https://op-developer.fi/p/psd2-info

The user will likely take ~20 seconds to get their phone out, unlock it, log in to the bank app, confirm the transaction and set their phone down. The PSD2 API shows the transaction immediately (again, instant transfer being enabled is a prerequisite) and the seller can confirm that payment is complete.

Post reply on HN