6 ms·

What a time to be alive where you have to worry about how you generate your license keys as to not be labeled a terrorist.

hnlmorg 3y ago
It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions? I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.
- ChrisMarshallNY 3y ago
  > I know you should never underestimate human stupidity Those of us “of a certain age,” will remember the old adage ”To err is human, but it takes a computer to really f*** things up.”
- B1FF_PSUVM 3y ago
  https://www.google.com/search?q=begs+the+question https://www.google.com/search?q=begs+the+question
- TheNorthman 3y ago
  That's hilarious. "Payment of vest and explosives for ISIS attack"
- epgui 3y ago
  I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.
  - hgsgm 3y ago
    "terrorist" is an opinion or a judgment, not an objective fact. A better term in a KYC context "sanctioned entity" or somesuch. If someone X is comfortable doing business with/as entity Y but a bank Z is not, it's totally sensible that X would say Y to the bank Z and bank Z would block them.
    - Koshkin 3y ago
      > "terrorist" is an opinion or a judgment More importantly, "terrorists" is often used by some governments in reference to protesters or any group that they see as unfriendly to them.
  - A4ET8a8uTh0 3y ago
    It is highly unlikely, but not impossible. Anecdotally, I did see a case of a business that put a real location of the business they are working with, which happened to be in a sanctioned country. Needless to say, it generated all sorts of questions and eventual OFAC contact. Bottom line is: it happens, but I agree with you that people that know what they are doing are not putting "Pay for assasination by Osama Bin Laden on 03/28/23" in reference field.
- msm_ 3y ago
  Not really responding to your question, but one of my friend jokingly returned money to another friend with a bank transfer titled "for jihad". Needless to say, both banks were not amused. They both were "verified" on the phone and confirmed they are not, in fact, actually terrorists. I wonder how many people-years banks waste on pranks like this.
  - lazide 3y ago
    How could you verify someone was not a terrorist on the phone?
    - iforgotpassword 3y ago
      Well, he sounded kinda like a nice guy.
- PeterisP 3y ago
  Many such organizations are legitimate legal entities in some country and handle purchases; and of course there are sanctioned people as well, and a payment from or to them does include their name.
mcv 3y ago
Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.
- rvba 3y ago
  If you buy multiple keys it makes life easier - you know which payment is for which key and for which invoice. This way you have an unique identifier to match them. Without unique identifiers you have big problems. The payment description should at least mention the invoice number or order number. Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.

hnlmorg 3y ago

It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions? I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.

ChrisMarshallNY 3y ago
> I know you should never underestimate human stupidity Those of us “of a certain age,” will remember the old adage ”To err is human, but it takes a computer to really f*** things up.”
B1FF_PSUVM 3y ago
https://www.google.com/search?q=begs+the+question https://www.google.com/search?q=begs+the+question
TheNorthman 3y ago
That's hilarious. "Payment of vest and explosives for ISIS attack"
epgui 3y ago
I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.
- hgsgm 3y ago
  "terrorist" is an opinion or a judgment, not an objective fact. A better term in a KYC context "sanctioned entity" or somesuch. If someone X is comfortable doing business with/as entity Y but a bank Z is not, it's totally sensible that X would say Y to the bank Z and bank Z would block them.
  - Koshkin 3y ago
    > "terrorist" is an opinion or a judgment More importantly, "terrorists" is often used by some governments in reference to protesters or any group that they see as unfriendly to them.
- A4ET8a8uTh0 3y ago
  It is highly unlikely, but not impossible. Anecdotally, I did see a case of a business that put a real location of the business they are working with, which happened to be in a sanctioned country. Needless to say, it generated all sorts of questions and eventual OFAC contact. Bottom line is: it happens, but I agree with you that people that know what they are doing are not putting "Pay for assasination by Osama Bin Laden on 03/28/23" in reference field.
msm_ 3y ago
Not really responding to your question, but one of my friend jokingly returned money to another friend with a bank transfer titled "for jihad". Needless to say, both banks were not amused. They both were "verified" on the phone and confirmed they are not, in fact, actually terrorists. I wonder how many people-years banks waste on pranks like this.
- lazide 3y ago
  How could you verify someone was not a terrorist on the phone?
  - iforgotpassword 3y ago
    Well, he sounded kinda like a nice guy.
PeterisP 3y ago
Many such organizations are legitimate legal entities in some country and handle purchases; and of course there are sanctioned people as well, and a payment from or to them does include their name.

mcv 3y ago

Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.

rvba 3y ago
If you buy multiple keys it makes life easier - you know which payment is for which key and for which invoice. This way you have an unique identifier to match them. Without unique identifiers you have big problems. The payment description should at least mention the invoice number or order number. Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.