Comments on: A Paypal Security Hole and Poor Customer Service Judgement that Made it Worse

By: David C

David C — Sat, 07 Feb 2009 12:00:50 +0000

I am also disappointed at Paypal’s customer service. Here is why:

Recently, our business paypal account has received a bunch of high dollar amount payments for product purchase on our web site. These payments were determined Unauthorized” later on and so we lost thousands of dollars since we already shipped the goods and all packages were delivered.

The horrible side of this story is that this kind of payments keep coming in and I called their customer support and want them to further investigate it. What the agent told me was that we need to confirm the order (payer information) using whatever available internet white pages to manually verify the that the account owner (paypal account/credit card owner) indeed made the purchases!

If I keep accepting paypal, I will lose more money. Now I am thinking very hard on other paypal alternatives such as goolge check out or checkout.com.

My suggestion to HL Hill: you made the right decision not to take paypal payment!

By: H.L. Hill

H.L. Hill — Mon, 19 Jan 2009 14:38:34 +0000

Thanks Coyote, and others.

I was just getting ready to add pay-pal to my business. I don’t think I can afford to do so at this time. I don’t need these kinds of problems with a start-up business. I am fairly new and inexperienced with this form of internet use, so this information is extreeemly important to me. Thanks again gentlemen, and ladies too!

H.L. Hill
President and Founder

By: linklover

linklover — Mon, 19 Jan 2009 04:43:40 +0000

What is being missed here is that in big companies there is big distance between software developers and customer support. Developers develop products, tell “what they think they need to tell” CS teams, and off the CS teams go, “supporting” the product.

When problems get reported by users, they are sent back to developers only when things are happening at sufficient volumes.

Today’s software and hardware products are unbelievably complex, compared to, say, VCRs or cameras from 20 years ago; and they change at fast pace. There is no way this is the fault of CS teams.

By: Weronika

Weronika — Sat, 17 Jan 2009 20:57:42 +0000

Colson – it’s good to know someone at PayPal is willing to “own the problem” and take his role as a representative of the company seriously. But I think there just aren’t enough employees like you to deal with what’s going on there right now.

More than a week ago someone gained access to my BF’s eBay/PayPal account and ordered a $1200 laptop sent to an unconfirmed address. My BF filed meticulously documented reports with eBay, PayPal, and all the police and gov’t agencies that deal with identity theft and mail fraud… Several phone calls to PayPal later, random customer service people keep telling him that the case is “under review.” Not very reassuring, and not what you’d expect from the company that stakes its reputation on security of transactions.

By: Allen

Allen — Fri, 16 Jan 2009 17:35:10 +0000

As a software engineer what annoys me the most about this is that the claim of “impossible” is absolutely false. They’re storing data in a database. That database has no concept of any of the business rules. In this case it’s probably something like an email address can not belong to more than one account. Now the front end code could account for that. The problem is companies do all sorts of things with the data beyond the front end application. They upgrade their database, they transfer data from one application to another, et al. Those processes too must enforce that rule. On top of it, it would appear that they don’t any a simple quality assurance check in place to double check existing data to ensure it conforms to these rules. Since humans are the ones telling the database what to do, it is actually impossible for it to be impossible for this sort of thing to happen. Humans make mistakes. The more data and more complex the systems and the more data moving between them, the more likely some human is going to make at least one mistake.

If you pursue this any further, I recommend letting them know that impossible is a false claim and ask them to describe to you what sort of QA things they do. Of course they won’t and shouldn’t give you low level details on those but the point is to get them to admit things could go wrong and try to show they do things to prevent that and even fix it in the event it does occur.

By: dreamin

dreamin — Fri, 16 Jan 2009 12:06:14 +0000

Sounds to me like it’s a known issue.

By: Ed (Buildaskill.com)

Ed (Buildaskill.com) — Thu, 15 Jan 2009 17:47:27 +0000

Hi Coyote

I’ll plug this post in this week’s edition of Sunday Papers in the ‘money’ section – I know we have several eBay and PayPal staff who are readers – the more this gets circulated, the more effort they will apply to get the loophole closed.

It’s certainly a worry – thanks for a great post

By: Thomas

Thomas — Thu, 15 Jan 2009 15:48:54 +0000

I know someone who is a programmer with Paypal, I sent him the link. No promises of course, but I tried.

By: txjim

txjim — Thu, 15 Jan 2009 02:52:57 +0000

The upside: I think you have provided the key pieces of info and I think your diagnosis is on target. The downside, as you discovered, is this is absolutely not the first time this has happened.

By: colson

colson — Wed, 14 Jan 2009 23:20:51 +0000

I read the blog regularly . I’m just not the right engineer! Doh!

I’m sorry to hear about the problems with our customer support team and our system. For your information and contrary to what you were told, we do have a bug filed with our engineers on the issue and it is being actively worked on. From the details that I have, available on the issue – it appears to be exactly the problem you mentioned in your Postscript. If you would like, you can shoot me an email Mr. Coyote.

@Dave – I don’t really disagree with your assertion that ‘They “know” from experience…’ at all. Your insight is almost the basic premise of troubleshooting anything related with software which, as you note, does not always work.