[jacquesm]

> Were you not allowed to _send_ money with only your credit card on the paypal account?

Yes. They kept asking for a verification of the account, without that no further processing possible. Please note that this is a corporate account, not a personal account.

> Sadly, the "paypal drained my bank account" story is repeated regularly.

ouch.

[jcroberts]

Ahhh, though you said "corporate account," I'm betting you actually mean a "Merchant Services" account. There are actually a number of different types of paypal accounts, each with their own set of rules and features. Paypal --very intentionally-- tries to confuse people by not clearly listing both the various types of accounts and the various risks associated with them. They also very intentionally do _EVERYTHING_ they can to get your bank account credentials.

For example, in your situation, there may have been a somewhat hidden link to "other payment options" but of course, the only default you saw was "enter your bank account number." Paypal pulls this shit constantly, and all it takes is one wrong click (or less than careful reading) to trap you into an endless page reloads of "please enter your bank account" nonsense. --It's extremely scammy and they use every anti-pattern in the book, heck, they probably wrote the book.

I should also note, NEVER use a bank account debit card with paypal or online. These are also another way your bank account can be completely drained by attackers or less than honorable businesses.

[jacquesm]

> to trap you into an endless page reloads of "please enter your bank account" nonsense.

That pretty much describes what happened.

I will take your information to heart and get paypals access revoked and I'm going to close that account and open a new one just to be sure.

Thank you very much for the helpful info, I knew paypal was bad, I always thought the 'bad' limited itself to my balance on their end (which I made sure I never had).

This is a bit of a shocker really.

[jcroberts]

I wish it wasn't such an unpleasant shock for so many people, but very few people even think about how something actually works and the risk models being used. In the case of paypal Max Levchin (sp?) created a brilliant fraud detection (risk analysis) system, and also made sure to mitigate risks to his company by making sure someone else could be put on the hook when something goes wrong (i.e. why they press so hard for direct access to your bank accounts). Even though it is a brilliant design, and a profitable business, the entire company is dubious because it profits from putting normal people (users) at risk without ever informing them of the risks.

[cosmicray]

> I will take your information to heart and get paypals access revoked and I'm going to close that account and open a new one just to be sure.

To be fair, PayPal transactions to/from your bank account happen via ACH. ACH (automated clearing house) has been around long before PayPal existed. It is also used by various other entities for periodic payments (like insurance, utilties, etc).

I was once told that a common savings account can have inbound ACH (money sent to you) but not outbound (money sent from you). Might want to talk to your bank about this.