Live data from Hacker News

PayPal and zero-dollar invoice spam

troyhunt.com

61–70 of 77 posts

Re: PayPal and zero-dollar invoice spam

#61
post #60

[deleted]

Which banks are offering throwaway credit card numbers? And where do you see wide scale deployment 3Dsecure for online checkouts? Certainly not in the US.

And what online payments processors are offering less than PayPal's 2.9% + $0.30? Seems pretty standard across the industry.

Re: PayPal and zero-dollar invoice spam

#62

Earlier quoted context omitted.

Don't know if you can answer this: Why can I venmo people money instantly and paypal holds my money for days or weeks at a time?

You can not venmo money instantly. The UI makes it seem that way, but it takes a few days for payment to process and as such, Venmo has become a target for scams: http://time.com/money/4036511/venmo-more-check-than-cash/ So do not use Venmo for commercial transactions (buying things of Craiglist for example) and do not assume the money transfers immediately. Also shame on Venmo for misleading their users; they should…

[deleted]

Re: PayPal and zero-dollar invoice spam

#63

Earlier quoted context omitted.

Don't know if you can answer this: Why can I venmo people money instantly and paypal holds my money for days or weeks at a time?

Holding onto funds is how you mitigate risk as a bank or money transmitter.

Do you think they're running loads of security tests all the while or something? I'd imagine a majority (if not all) of the checks are done up front- especially given it's 2015.

Pretty sure they get a nice bump on their balance sheet for cash "in-transit" - and keeping the timeframe to 3-5 business days only magnifies that effect.

Re: PayPal and zero-dollar invoice spam

#64

PayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our…

Genuine question: What are the legitimate uses of $0 invoices? The only thing I can think of is a product that usually costs money (and thus has an invoice workflow), but has been marked as free for some promotion.

In the case of periodic invoicing but you haven't crossed into the billable threshold.

Let's say you get 2 hrs of support per month free, after that it costs $100. If you don't use the full 2 hrs, you'd get a $0 invoice - but there may still be detail and record of work performed (which you would want)

Re: PayPal and zero-dollar invoice spam

#65
All of these approaches are used to take advantage of the email deliverability rates of large reputable companies that send lots of email. Paypal is a new one, but Hotmail and Facebook have in the past been used for similar things. With Hotmail, you could define a custom "I've changed my email address" message, which would contain your spam message, and then it would send it to up to 5,000 "contacts" for you with near-100% deliverability. Some people automated this, and with that they were able send millions of messages per day. I haven't looked recently, but Facebook's "invite friends" feature has been used similarly in the past.

Re: PayPal and zero-dollar invoice spam

#66
post #53

PayPal employee here (and I'm hiring Node.js developers :P ). I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix. The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our…

It seems like only allowing a zero-dollar invoice after two parties have conducted another non-zero legitimate transaction might be a solution.

[deleted]

Re: PayPal and zero-dollar invoice spam

#67
post #60

[deleted]

Which banks are offering throwaway credit card numbers? And where do you see wide scale deployment 3Dsecure for online checkouts? Certainly not in the US. And what online payments processors are offering less than PayPal's 2.9% + $0.30? Seems pretty standard across the industry.

Any bank. No banks publicize this, but most will give businesses as many credit cards as they like for a reasonable fee.

Re: PayPal and zero-dollar invoice spam

#68
For a PayPal employee to post here and say he made a team aware and they are working on this it's utterly laughable.

There was a post here on hn over two years ago for the same issue which was top post and generated a lot of news.

https://news.ycombinator.com/item?id=6526481

It is obviously very well known to them for years but they continue to do it

Re: PayPal and zero-dollar invoice spam

#69
post #68

For a PayPal employee to post here and say he made a team aware and they are working on this it's utterly laughable. There was a post here on hn over two years ago for the same issue which was top post and generated a lot of news. https://news.ycombinator.com/item?id=6526481 It is obviously very well known to them for years but they continue to do it

Obviously well known?

Guy at PayPal sees post, tells a technical person about it, said person forgets about it. Suddenly PayPal doesn't know about it anymore.

Or a person wants to work on fixing this but a manager says no, because there are other priorities.

Or a person starts working on this, quits, and it gets lost among the things they were working on.

It's so easy for things to get lost in a company, even with all the bug trackers in the world.

Re: PayPal and zero-dollar invoice spam

#70
post #59
post #53

Earlier quoted context omitted.

It seems like only allowing a zero-dollar invoice after two parties have conducted another non-zero legitimate transaction might be a solution.

I can see a lot of cases where you have a $0 legitimate transaction.

That require PayPal?
Post reply on HN