5 ms·
About a year ago, I bought clothes online using PayPal for my mother (and shipped to her address). PayPal blocked the transaction and temporarily suspended my a
by chang1 3y ago
About a year ago, I bought clothes online using PayPal for my mother (and shipped to her address). PayPal blocked the transaction and temporarily suspended my account until I could verify a detail. When I logged in to verify, it was asking for the recipient's (my mother's) birth date. I thought it odd that they would ask, and also know, the birth date of someone PayPal has no association with.
I called their support (finding a human to talk to was difficult) to ask for the reason why I would need to give out my mother's birth date. I was asking for other ways I could verify and that I shouldn't be asked to give out someone else's PII. The support person started to become defensive, sarcastically asking "you don't even know your mom's own birthday!?".
I could tell this person saw nothing wrong with the ask and thought I was being intentionally combative. I ended up conceding and giving the information. Since then, I've stopped using PayPal as a payment method.
I always thought this incident strange and have wondered about how their verification method works.
- mcv 3y agoDo they even know your mom's birthdate? Can't you just give them a random date? Also, if you bought something at a webshop, why does PayPal know who it's being sent to? They just need to know you and the webshop, don't they? Who the webshop sends it to is between you and the webshop.
- vajrabum 3y agoA lot of online credit fraud schemes involve sending things to an unwitting 3rd party.
- cglong 3y agoSorry, could you go into more detail here? This happened to my mom several years ago, and we always wondered why.
- mike 3y agoOne thing it could have been is the “brushing” scam Creating fake orders to enable fake reviews for a product to be posted, boosting the product listing. https://en.wikipedia.org/wiki/Brushing_(e-commerce) https://en.wikipedia.org/wiki/Brushing_(e-commerce)
- alistairSH 3y agoSteal CC info from person A. Buy item from using junk email address and shipping address of person B. On delivery day, wait near person B's home, and grab the package when UPS delivers it. If person B manages to get to the package first, scammer is only out some time. Junk email and 3rd party mailing address - harder to track scammer. Of course, this ignores IP address and similar - smart scammer would also use Tor and other tools to obfuscate the online transactions.
- WirelessGigabit 3y agoOr: Steal credit card. Sell new stuff on eBay. Wait for purchaser. When someone buys from you on eBay, you go to a merchant, and order stuff with the stolen credit card, and have it shipped to the buyer. You have your money from eBay. Person has their stuff. Owner of stolen card gets refunded. Only the merchant has lost some money. Which makes this hard to stop.
- mynameisvlad 3y agoIf the merchant used PayPal checkout, then PayPal does all that processing then sends the information to the merchant.
- 1970-01-01 3y agoI've signed-up for dozens and dozens of things with January 1st 1900 as my birthday. They never check.
- wruza 3y agoI’m using 1970-01-01, since it looks nice in their database. Could also switch to 1992-02-01 now.
- jackmoore 3y ago> Could also switch to 1992-02-01 now Huh?
- superturkey650 3y ago696902400
- wruza 3y agoIt looks twice as nice in unix time ;)
- orthecreedence 3y ago1992-02-01T18:41:36.969Z Seems nice too, if you want to get specific.
- gpvos 3y agoSometimes when a credit card payment is handled by Paypal they ask for my first name. I enter my initials, since that's what actually on my credit card and is what I always use when making payments with it, but they don't accept it. Maybe somehow they know my actual first name, but I'm not going to give it to them so I then abort the payment.
- AlbertCory 3y agoIndeed, if you use privacy.com to get a temporary credit card (this is for totally legit purposes, folks!), you can use any name and address on the form you enter it in. Only the credit card #, expiration date, and security code are verified.
- blep_ 3y agoIn many cases, you can enter any name. Have fun.
- justsomehnguy 3y ago> I enter my initials, since that's what actually on my credit card and is what I always use when making payments with it, but they don't accept it They (or probably just the form) don't like dots and/or too few characters in the field. As sibling says you can actually enter anything you want in the "CARDHOLDER NAME" field 99% of times. For years I type "$BANK NAME" or "$BANKNAME CARD" (note the space) there and I never been denied.
- gpvos 3y agoInteresting. I have tried all combinations with and without spaces or dots, but I don't think I ever considered entering something not truthful, even though I have done that in other online forms thousands of times (one favourite is entering the street address of the organization I'm interacting with instead of my own when ordering non-physical goods; and fake birth dates of course). There's something about payments that apparently I consider more "holy" than other things.
- 3y ago
- chang1 3y agoThat's a good point, I don't actually know. I just assumed yes because they would ask. I also didn't want to complicate the process of releasing the funds – perhaps that was naive. I believe in this checkout flow, it kicked me over to PayPal where I could specify the shipping address there. PayPal probably relays the address back to the merchant, akin to checking out with Apple Pay where you specify a shipping address via the Wallet app.
- cm2187 3y agoReminds me when I went to pick up my first UK passport when I gained citizenship. The passport office had no interest in looking at my foreign passport to verify my identity. Instead they asked me a series of question about my family, what profession they have, etc, that I know they couldn't have the answer to, unless they did some investigations that I think were highly unlikely given the volume of applications after the Brexit vote. I think instead they were just checking if I looked like I was answering the question confidently or if I looked like I was trying to make things up.
- dabinat 3y agoOh yeah, they do that all the time. I have dual citizenship and they’ve asked me a few times upon leaving the UK where I was staying, who I was with, what those people’s professions were, etc. I think it’s just random spot-checks to see if you look nervous. But if you get annoyed with them and tell them you’re a citizen they stop.
- mike-cardwell 3y agoI was flying from the UK to the USA once, on my own. They asked me what my hobbies are and what the most recent movie I saw was.
- Alupis 3y ago> why does PayPal know who it's being sent to? They just need to know you and the webshop, don't they? Who the webshop sends it to is between you and the webshop. No, it's not, because the buyer has chosen to use PayPal's services for protection, and in order for the merchant to fulfill their end of the deal and also receive PayPal's protection (against chargebacks, disputes, etc) the merchant is required to ship to the address on the order (which PayPal has a record of for verification). If you offer PayPal as a checkout option, you are required to follow their rules for fulfillment, otherwise you risk losing a PayPal dispute if filed later on.
- yayr 3y agoOne assumption could be that there are certain products/services that have age related regulations and Paypal needs to comply. Maybe, if your product or supplier wasn't on that list but you still got asked for a birthdate there was a misconfiguration in that regulation rule set...
- LawTalkingGuy 3y agoOne should assume that while they have your money they'll look for anything to use to keep it. Companies are literally legal devices for diffusing responsibility and hiding what the right hand knows from the left hand to remove the intent from what would be fraud. They play all the games people here report - support reps who are nearly unreachable and who all refuse to read previous communication so everything starts from scratch, randomly just closing the case, etc. It'd be hilarious if you could torture a paypal exec with their own company's treatment. Put a wheel lock on their car because you claim a similar looking car was stolen on the other side of the country. Refuse to take the lock off their car until they can explain the origin of the car's brandname. Relock the car immediately after unlocking it because they attempted to drive away too soon. Relock it the next time because they didn't drive away soon enough. Lock all of their cars because there's been "too much activity" on their vehicles.
- n_u_l_l 3y ago> ## Confirm some info about yourself > You’ll need to answer some questions to verify your identity. These questions come from a public database dating back as far as 20 years. They may be about property, places, or people you know. We don’t save or store the questions or answers in our system. https://www.paypal.com/us/cshelp/article/why-do-i-have-to-complete-a-security-check-help171 https://www.paypal.com/us/cshelp/article/why-do-i-have-to-co... Interesting. This would mean that they actually have the data to confirm whether it is correct.
- TOMDM 3y agoI might be misunderstanding, but what's the value in asking someone to verify identity via info available in a public database?
- feoren 3y ago> You’ll need to answer some questions to verify your identity. These questions come from a public database dating back as far as 20 years. Wait, I need to verify my identity by regurgitating public information about me? However PayPal scraped up that information, an attacker could as well. This is absolutely security theater.
- neltnerb 3y agoNot only are you correct, their database has wrong info about me that I've had to memorize the wrong answers to in order to prove who I am. It's not great.
- buildbuildbuild 3y agoMakes you wonder how much KYC data is being used for ad tech. There’s a perverse incentive to do more KYC, for more than compliance reasons.
- jjeaff 3y agoMost likely all of it. It is usually laundered through startups and other types with little to lose or who put little effort into reading or complying with legal agreements. These companies then sell it to more legitimate companies who don't realize where the data comes from and it all just ends up in a bunch of big databases that sell access to whoever wants it.
- lejohnq 3y agoThis sounds awful. I honestly don’t know my mom’s birthday and perhaps interestingly she doesn’t technically know it either. Papers lost (and probably made up) multiple times when her family fled her home and then country before ending up here. And she definitely has a birthday on her driver’s license now, but I think she might have to look at it to make sure she got it right.
- pengaru 3y agoOn a long enough time line, we probably all don't know our own birthday, if still alive....
- LorenPechtel 3y agoI'm sure there are plenty of people refugeed young that don't know.
- withinboredom 3y agoI stopped keeping track after 21. I have no idea how old I am as I don’t really celebrate my birthday. All I know for sure is that I turned 21 over ten years ago…
- PaulDavisThe1st 3y agoSounds pretty certain that you would never be asked this question, since it is not a matter of public record (or at least, not the public records these systems tend to use)
- kernal 3y ago>and shipped to her address This is what likely triggered it. People that steal PayPal credentials change the shipping address to something other than the address on the PayPal account.
- dharmab 3y agoI also got yelled at when trying to get a quote on auto insurance over the phone because I didn't know my dad's birthday. (Identity verification?) The man ardently supports <anti LGBT political party> and me and half my friends are LGBT, you think I buy him gifts?
- savagedata 3y agoWas PayPal trying to verify your identity or that you know your recipient's identity (who's coincidentally your mother)? I'm surprised if PayPal expected you to know your recipient's birthday, but "What's your mother's birthday?" would be a common question to verify your identity. They should have moved on to another question if you had a moral objection. On the other hand, scammers will often ship goods to a nearby address and pick them up off the porch, so verifying that you know your recipient might actually be a fraud countermeasure.
- paulddraper 3y ago> give out someone else's PII They ask about information related to your identity. In this case "someone else's" PII is on your birth certificate.
- Arrath 3y agoReminds me of a property management company reaching out to verify some details from one of my guys, who had applied to rent one of their properties. Did they call and ask to verify his listed employment? Naw. They sent me an email with a scan of his whole-ass rental application, complete with SSN and everything, unredacted. I called them out on it and they completely brushed off my complaints.