Hacker News new | ask | show | jobs
by patio11 5028 days ago
To the extent this perception represents actual reality:

You know how every time a new payment provider comes up and people kvelch that it isn't available in their country and how no provider is? This is because every payment provider which attempts to hit as many countries as Paypal does dies. They're killed by fraud. (Fraud kills domestic ones, too, all the time, but it's marginally less frequent.)

Luckily, Paypal is an anti-fraud AI company which also happens to run credit cards sometimes. When in doubt, they will always come down on the conservative side. This is why they still exist. (Early in their corporate history they lost -- no kidding -- one hundred million dollars to fraud.)

This perception does not actually match reality, though: most people bitten by this are unaware that similar activity would get them shut down by the fraud department at e.g. a bank. See comments by dangrossman, etc.

4 comments

My paypal account has been hacked twice, and both times I had to catch the ensuing fraud on my own. This was about 3 and 4 years ago. Two months ago they shut down my account because they think I'm high risk. I've had my Chase account frauded twice too (I know, I AM high risk) and Chase hasn't shut down my account.

IMO Paypal swung quickly from being too sloppy to being too conservative. The fraud they missed a few years ago was easy to catch - it was from sketchy sites and the products were being shipped to PO boxes nowhere close to where I live. Paypal is playing a dangerous game now by shutting down people's accounts because their strength comes from a network effect within a potential monopoly (unlike Chase); every person they ban from paypal removes the legitimacy of their service a little.

BTW Paypal's fraud team was only built up to a solid point in the past 3-4 years. I know this because I used to work in the industry.

Luckily, Paypal is an anti-fraud AI company which also happens to run credit cards sometimes

The thing is, it shouldn't take much in the way of "AI" to recognize that a company that has already been doing business for several months or even years is probably not going to wake up one morning and start defrauding people. Criminals are lazy, and running a business is a lot of work. It would take about 30 seconds' worth of review time on the part of a moderately low-paid staffer at PayPal to avoid most of these PayPal Media Debacle of the Week stories.

I simply cannot believe that it's that hard to distinguish between a fraudulent user and a real one, given the presence of a significant transaction history. New accounts opened by people with no discernible history? Yes, they should freeze/ban/lock first and ask questions later. Accounts that are clearly used as part of a business? Give the customer the benefit of the doubt, or at least a 5-minute phone call.

You're wrong. A common type of fraud on ebay is for an account to build up a reputation buying/selling low cost items (or high cost items between a group of criminal partners) before using the account to scam on high price items.

Criminals are perfectly willing to put time and effort to create fake accounts or just buy stolen accounts.

To accept your statement that I'm "wrong," I'd need to see some examples of false business fronts that were not obviously bogus from day 1.

On eBay, yes, it was pretty easy to play the "Sell a bunch of stuff for 99 cents and then pull the big scam" game. But none of the widely-publicized cases where PayPal has basically attempted to wreck the lives of startup founders fall into that pattern. These people have all had independent web sites selling actual products, and/or a background in other ventures that could be checked if PayPal were to spend 5 minutes doing due diligence on them.

It's a relatively common thing for criminals to do, and is known as a 'long firm': http://en.wikipedia.org/wiki/Long_firm

1) Run a legit business for a few months

2) Build up credit history with suppliers

3) After a while, buy a huge amount of stock on credit

4) Sell all of the stock for cash at massive discounts

5) Disappear with the cash, leaving a pile of unpaid debt in your wake

Sure. Someone does that when they are looking to steal hundreds of thousands of dollars, or millions of dollars.

Someone looking to put one over on PayPal is not going to do all that crap. Sorry. I need to hear some actual examples if I'm going to change my mind.

Selection bias. You do not see all the times paypal has successfully frozen an actual criminal organisation (i have no idea the numbers). If paypal's accuracy was 99%, then there would be 1 innocent startup squashed for every 99 successful defections. Do you think paypal need 100% accuracy?
At the end of the day, letting criminals dictate how you do business with legitimate customers is not OK.

Simple due diligence will either eliminate the genuine criminals, or it will not. If five minutes' worth of due diligence by humans fails, then so will any conceivable AI algorithm.

Some criminals are after a quick buck. Some criminal organisations (eg Mafia) are a lot of work and go on for years. It's illogical to then assuming "There is lots of activity, ergo they must not be criminals".
Having a large base of clients willing to buy through their services is ultimately what matters, and I think they achieved that partially by siding with the customer most of the time. Making a purchase through their services, you know that you more or less protected, and if you start jumping up and down, you will probably get your money back. Businesses put up with their less-than-fair treatment because until recently, there weren't any alternatives on nearly the same level of "respectability", as far as buyers are concerned.

I'm willing to bet that in the beginning, when they were mainly trying to court businesses to implement their service, the situation was different.

This post makes me very very happy, knowing that Paypal lost one hundred million dollars. Thank you for making my day!