Paypal Phishing Scam Example

PayPal Holdings, Inc. is an American multinational financial technology company operating an online payments system in the majority of countries that support online money transfers; it serves as an electronic alternative to traditional paper methods such as checks and money orders. The company operates as a payment processor for online vendors, auction sites and many other commercial and company users, for which it charges an international addition bank charges fee.

Established in 1998 as Confinity, PayPal went public through an IPO in 2002. It became a wholly owned subsidiary of eBay later that year, valued at $1.5 billion. In 2015 eBay spun off PayPal to its shareholders, and PayPal became an independent company again.
The company was ranked 143rd on the 2022 ''Fortune'' 500 of the largest United States corporations by revenue. Since 2023, PayPal is a member of the MACH Alliance.

History

Early history

The company was originally established by Max Levchin, Peter Thiel, and Luke Nosek in December 1998 as Fieldlink. Later it was renamed Confinity, a company which developed security software for hand-held devices. When it had no success with that business model, it switched its focus to a digital wallet. The first version of the PayPal electronic payments system was launched in 1999.

In March 2000, Confinity merged with X.com, an online financial services company founded in March 1999 by Elon Musk, Harris Fricker, Christopher Payne, and Ed Ho. Musk was optimistic about the future success of the money transfer business Confinity was developing. Musk and Bill Harris, then-president and CEO of the combined X.com, disagreed about the potential future success of the money transfer business and Harris left the company in May 2000. In October of that year, Musk decided that X.com would terminate its other internet banking operations and focus on payments. In the same month, Elon Musk was replaced by Peter Thiel as CEO of X.com, which was renamed PayPal in June 2001 and went public in 2002. PayPal's IPO listed on NASDAQ under the ticker PYPL at $13 per share and generated over $61 million.

eBay subsidiary (2002–2014)

Shortly after PayPal's IPO, eBay acquired the company on October 3, 2002, for $1.5 billion in eBay stock. More than 70 percent of all eBay auctions accepted PayPal payments, and roughly 1 in 4 closed auction listings were transacted via PayPal. PayPal became the default payment method used by the majority of eBay users, and the service competed with eBay's subsidiary Billpoint, as well as Citibank's c2it, Yahoo!'s PayDirect, and Google Checkout.

In 2005, PayPal acquired the VeriSign payment solution to provide added security support. In 2007, PayPal announced a partnership with MasterCard, which led to the development and launch of the PayPal Secure Card service, a software that allows customers to make payments on websites that do not accept PayPal directly. By the end of 2007, the company generated $1.8 billion in revenue. In January 2008, PayPal acquired Fraud Sciences, a privately held Israeli start-up that developed online risk tools, for $169 million. In November 2008, the company acquired Bill Me Later, an online transactional credit company.

By 2010, PayPal had over 100 million active user accounts in 190 markets through 25 different currencies. In July 2011, fourteen alleged members of the Anonymous hacktivist group were charged with attempting to disrupt PayPal's operations. The denial of service attacks occurred in December 2010, after PayPal stopped processing donations to WikiLeaks. On 5 December 2013, 13 of the PayPal 14 pleaded guilty to misdemeanor and felony charges related to the attacks.

The company continued to build its Merchant Services division, providing e-payments for retailers on eBay. In 2011, PayPal announced that it would begin moving its business offline so that customers can make payments via PayPal in stores. In August 2012, the company announced its partnership with Discover Card to allow PayPal payments to be made at any of the seven million stores in the Discover network. By the end of 2012, PayPal's total payment volume processed was . and accounted for 40% of eBay's revenue, amounting to in the 3rd quarter of 2012.

In 2013, PayPal acquired IronPearl, a Palo Alto startup offering engagement software, and Braintree, a Chicago-based payment gateway, to further product development and mobile services. In June 2014 David Marcus announced he was leaving his role as PayPal President; Marcus joined PayPal in August 2011 after its acquisition of Zong, of which he was the founder and CEO. David Marcus succeeded Scott Thompson as president, who left the role to join Yahoo. PayPal announced that Marcus would be succeeded by Dan Schulman, who previously served as CEO of Virgin Mobile and Executive vice president of American Express.

Spin-off from eBay (2014–present)

It was announced on September 30, 2014, that eBay would spin off PayPal into a separate publicly traded company, a move demanded in 2013 by activist hedge fund magnate Carl Icahn. The spin-off was completed on July 18, 2015. On July 20, the company was relisted on Nasdaq under the same ticker symbol it used shortly before it was acquired by eBay, PYPL. On January 31, 2018, eBay announced "After the existing eBay-PayPal agreement ends in 2020, PayPal will remain a payment option for shoppers on eBay, but it won't be prominently featured ahead of debit and credit card options as it is today. PayPal will cease to process card payments for eBay at that time." The company will "instead begin working with Amsterdam-based Adyen".

On July 1, 2015, PayPal announced that it was acquiring digital money transfer company Xoom Corporation. PayPal spent $25 a share in cash to acquire the publicly traded Xoom, or about $1.09 billion. The deal was closed in the fourth quarter of 2015. The move strengthened PayPal’s international business, giving it access to Xoom’s 1.3 million active U.S. customers that sent about $7 billion in the 12 months ending on March 31, to people in 37 countries.

On September 1, 2015, PayPal launched its peer-to-peer payment platform "PayPal.Me", a service that allows users to send a custom link to request funds via text, email, or other messaging platforms. Custom links are set to be structured as PayPal.me/username/amount requested. PayPal.Me was launched in 18 countries including the United States, United Kingdom, Germany, Australia, Canada, Russia, Turkey, France, Italy, Spain, Poland, Sweden, Belgium, Norway, Denmark, Netherlands, Austria and Switzerland. PayPal had 170 million users, as of September 2015, and the focus of PayPal.Me was to create a mobile-first user experience that enables faster payment sharing than PayPal's traditional tools.

On May 17, 2018, PayPal agreed to purchase Swedish payment processor iZettle for $2.2 billion. This was PayPal's largest acquisition until late November 2019 and the company claims that it is the in-store expertise and digital marketing strength that will complement its own online and mobile payment services. In 2018, PayPal became a jersey patch sponsor of the Phoenix Suns. On March 19, 2019, PayPal announced its partnership with Instagram as part of the company's new checkout feature, "Checkout on Instagram". In June 2019, PayPal reported that Chief Operating Officer Bill Ready would be leaving the company at the end of the year, transitioning into the role of commerce chief for Google.

In October 2019, PayPal reported a loss of $228 million on investments, largely due to a failed return from a $500 million investment in Uber. On January 6, 2020, PayPal acquired Honey for over $4 billion. This is PayPal's largest acquisition to date. It more recently signed a deal with NBCUniversal. In June 2020, PayPal announced a $530 million commitment to support Black-owned businesses and minority communities in the United States.

In January 2021, PayPal became the first foreign operator with 100% control of a payment platform in China, gaining an advanced position in the local online payment market. In an international survey conducted in March 2021 by Morning Consult, PayPal was found to be the second most trusted brand globally. In June 2022, Shopify partnered with PayPal to offer Shopify Payments to merchants in France. In February 2023, PayPal announced layoffs for 2,000 of its workers, or 7% of its total workforce. It was reported in February 2023, that CEO Dan Schulman will step away from his role by the end of 2023. Schulman will continue to serve on the board of directors after vacating the position. In August 2023, the company named Intuit executive Alex Chriss CEO, effective September 27, 2023.

In August 2023, PayPal launched a U.S. dollar stablecoin, called PayPal USD (PYUSD) for payments and transfers. In November 2023, it was announced that the SEC launched a legal investigation into both PayPal and Paxos, the trust responsible for issuing the stablecoin. Paypal said it was cooperating with the subpoena from the SEC’s Enforcement Division. In October 2023, it was announced PayPal has sold its reverse logistics subsidiary, Happy Returns to UPS for an undisclosed amount.

In 2024, PayPal executives announced the company's aim to revive growth in their branded checkout products amidst increased competition from big tech, following an upward revision of the full-year profit forecast.

Acquisitions

Finances

The fiscal year for PayPal is from January 1 to December 31. For fiscal year 2019, Paypal reported earnings of US$2.459 billion, with an annual revenue of $17.772 billion, an increase of 15% over the previous fiscal cycle. PayPal's shares traded at over $108 per share, and its market capitalization was valued at over $127.58 billion in December 2019.

The COVID-19 pandemic has accelerated the growth of digital payment platforms, including PayPal, at the expense of the traditional banking sector. As a result, Paypal has seen an increase in its stock to up to 78% in 2020 as of October. In addition, total payment volume has increased 29% amounting to $220 billion increasing positive investor sentiment.

PayPal laid off hundreds of workers across US offices and moved jobs overseas during 2020-2022 pandemic.

Offices

PayPal's corporate headquarters are located in the North San Jose Innovation District of San Jose, California, at North First Street campus. The company's operations center, opened in 1999, is located in La Vista, Nebraska.Virgil Larson, "Local building, global growth: PayPal opens facility, plans to expand staff to keep up with business", ''Omaha World-Herald'', March 8, 2007, 1D. Since July 2007, PayPal has operated across the European Union as a Luxembourg-based bank. The PayPal European headquarters are located in Luxembourg and the international headquarters are in Singapore. PayPal opened a technology center in Scottsdale, Arizona in 2006, and a software development center in Chennai, India in 2007. In October 2007, PayPal opened a data service office on the north side of Austin, Texas, and also opened a second operations center in La Vista, Nebraska that same year. In 2011, joining similar customer support operations located in Berlin, Germany; Chandler, Arizona; Dublin and Dundalk, Ireland; Omaha, Nebraska; and Shanghai, China; PayPal opened a second customer support center in Kuala Lumpur, Malaysia, and began the hiring process. In 2014, PayPal opened a new global center of operations in Kuala Lumpur.

Services

PayPal's services allow people to make financial transactions online by granting the ability to transfer funds electronically between individuals and businesses. Through PayPal, users can send or receive payments for online auctions on websites like eBay, purchase or sell goods and services, or donate money or receive donations. It is not necessary or required to have a PayPal account to use the company's services. Certain packaging may come with tracking numbers. PayPal account users can set currency conversion option in account settings. The PayPal app is available online or at the iTunes App Store and Google Play. One year after acquiring Braintree, PayPal introduced its "One Touch" service, which allows users to pay with a one-touch option on participating merchants websites or apps.

In 2007, PayPal acquired the online credit product Bill Me Later, Inc., which has since been rebranded as PayPal Credit and provided services for Comenity Capital Bank, the lender of PayPal Credit accounts. Founded in 2000, Bill Me Later is headquartered in Timonium, Maryland. PayPal Credit offers shoppers access to an instant online revolving line of credit at thousands of vendors that accept PayPal, subject to credit approval. PayPal Credit allows consumers to shop online in much the same way as they would with a traditional credit card. The rebranding of Bill Me Later as PayPal Credit also means that consumers can use PayPal Credit to fund transactions virtually anywhere PayPal is accepted. In 2015 PayPal agreed that PayPal Credit would pay a $25 million fine to settle a complaint filed in Federal Court by the Consumer Financial Protection Bureau.

From 2009 to 2016, PayPal operated Student Accounts, allowing parents to set up a student account, transfer money into it, and obtain a debit card for student use. The program provided tools to teach how to spend money wisely and take responsibility for actions. PayPal discontinued Student Accounts in August 2016.

In November 2009, PayPal partially opened its platform, allowing other services to get access to more APIs and to use its infrastructure in order to enable peer-to-peer online transactions. On November 28, 2011, PayPal reported Black Friday brought record mobile engagement, including a 538% increase in global mobile payment volume when compared with Black Friday 2010. In 2012, the company launched "PayPal Here", a small business mobile payment system that includes a combination of a free mobile app and a small card-reader that plugs into a smart phone.

PayPal launched an updated app for iOS and Android in 2013 that expanded its mobile app capabilities by allowing users to search for local shops and restaurants that accept PayPal payments, order ahead at participating venues, and access their PayPal Credit accounts (formerly known as Bill Me Later).

On October 21, 2020, PayPal announced a new service allowing customers to use cryptocurrencies to shop at 26 million merchants on the network starting in 2021. Paypal has been using Paxos Trust to provide the back end infrastructure allowing users to manage and trade cryptocurrencies in accordance to data privacy rules and financial regulations. Paxos has been in charge of acquiring the necessary regulatory approvals for Paypal to facilitate cryptocurrency assets. As part of the announcement, PayPal secured the first conditional cryptocurrency license from the New York State Department of Financial Services, which will allow customers to purchase cryptocurrencies such as bitcoin, Litecoin, Ethereum, and Bitcoin Cash. In March 2022, PayPal introduced a flat-fee structure for cryptocurrency transactions under $200; transactions over $200 incur a 1.8% fee for purchases or sales up to $1,000, and 1.5% for any transaction amount greater than $1,000.

, PayPal operates in 202 markets and has 426 million active, registered accounts. PayPal allows customers to send, receive, and hold funds in 25 currencies worldwide.

Business model evolution

PayPal's success in users and volumes was the product of a three-phase strategy described by former eBay CEO Meg Whitman: "First, PayPal focused on expanding its service among eBay users in the US. Second, we began expanding PayPal to eBay's international sites. And third, we started to build PayPal's business off eBay."

Phase 1

In the first phase, payment volumes were coming mostly from the eBay auction website. The system was very attractive to auction sellers, most of which were individuals or small businesses that were unable to accept credit cards, and for consumers as well. In fact, many sellers could not qualify for a credit card Merchant account because they lacked a commercial credit history. The service also appealed to auction buyers because they could fund PayPal accounts using credit cards or bank account balances, without divulging credit card numbers to unknown sellers. PayPal employed an aggressive marketing campaign to accelerate its growth, depositing $10 in new users' PayPal accounts.

Phase 2

Until 2000, PayPal's strategy was to earn interest on funds in PayPal accounts. However, most recipients of PayPal credits withdrew funds immediately. Also, many senders funded their payments using credit cards, which cost PayPal roughly 2% of payment value per transaction.

To solve this problem, PayPal tailored its product to cater more to business accounts. Instead of relying on interests earned from deposited funds, PayPal started relying on earnings from service charges. They offered seller protection to PayPal account holders, provided that they comply with reimbursement policies. For example, PayPal merchants are either required to retain a traceable proof of shipping to a confirmed address or to provide a signed receipt for items valued over $750.

Phase 3

After fine-tuning PayPal's business model and increasing its domestic and international penetration on eBay, PayPal started its off-eBay strategy. This was based on developing stronger growth in active users by adding users across multiple platforms, despite the slowdown in on-eBay growth and low-single-digit user growth on the eBay site. A late 2003 reorganization created a new business unit within PayPal—Merchant Services—to provide payment solutions to small and large e-commerce merchants outside the eBay auction community. Starting in the second half of 2004, PayPal Merchant Services unveiled several initiatives to enroll online merchants outside the eBay auction community, including:

* Lowering its transaction fee for high-volume merchants from 2.2% to 1.9% (while increasing the monthly transaction volume required to qualify for the lowest fee to $100,000)
* Encouraging its users to recruit non-eBay merchants by increasing its referral bonus to a maximum of $1,000 (versus the previous $100 cap)
* Persuading credit card gateway providers, including CyberSource and Retail Decisions USA, to include PayPal among their offerings to online merchants.
* Hiring a new sales force to acquire large merchants such as Dell, Apple's iTunes, and Yahoo! Stores, which hosted thousands of online merchants
* Reducing fees for online music purchases and other "micropayments"
* Launching PayPal Mobile, which allowed users to make payments using text messaging on their cell phones

Global reach

PayPal can be used in more than 200 countries/regions.

Different countries have different conditions: ''Send only'' (Package Service allows sending only, valid in 97 countries), ''PayPal Zero'' (package suggests the possibility of enrollment, entry, and withdrawal of funds in foreign currency, but the user can not hold the balance PayPal account, operates in 18 countries), ''SRW Send – Receive – Withdrawal'' (the possibility of enrollment, input-output and the ability to keep your PayPal account balance in the currency and to transfer to the card when the user sees fit, operates in 41 countries) and ''Local Currency'' (SRW plus opportunity to conduct transactions in the local currency, 21 countries).

China

In July 2017, PayPal announced a partnership with Baidu, to allow the Chinese firm‘s 100 million mobile wallet users to make payments to PayPal’s 17 million merchants through the Baidu service.

Crimea

In January 2015, PayPal ceased operations in Crimea in compliance with international sanctions against Russia and Crimea.

India

As of March 2011, PayPal has made changes to the User Agreement for Indian users to comply with Reserve Bank of India regulations. The per transaction limit had been set to USD $3,000, since October 14, 2011. However, on July 29, 2013, PayPal increased the per transaction limit to USD $10,000. This brings the per transaction limit for India in line with the restrictions imposed by PayPal in most other countries.

PayPal has disabled sending and receiving personal payments in India, thus forcing all recipients to pay a transaction fee.

PayPal plans to make India an incubation center for the company's employee engagement policies. In 2012, PayPal hired 120 people for its offices in Chennai and Bengaluru.

On 8 November 2017, PayPal launched domestic operations under PayPal Payments Private Limited and now provides digital payment solutions for merchants and customers in India. As of 2020, Paypal supports the domestic card system RuPay and is planning to further integrate Unified Payment Interface (UPI) in collaboration with National Payments Corporation of India (NPCI). PayPal now has the largest global engineering team in India outside of the US, which is spread over Bengaluru, Chennai and Hyderabad.

Israel and Palestinian Territories

PayPal is available in Israel but is not available in the Palestinian territories. Nor can Palestinians working in the West Bank or Gaza access it but Israelis living in settlements in the West Bank can use PayPal. This decision has prompted Palestinian tech companies to seek a policy change from PayPal.

Japan

In late March 2010, new Japanese banking regulations forced PayPal Japan to suspend the ability of personal account holders registered in Japan to send or receive money between individuals, and as a result these account holders are now subject to PayPal's business fees on all transactions.

Pakistan

In Pakistan, users can use Xoom, a money transfer service owned by PayPal. In October 2018, Pakistan's government used Xoom to help crowdsource funds for the purpose of building two dams.

Turkey

Eight years after the company first started operating in the country, Paypal ceased operations in Turkey on 6 June 2016 when Turkish financial regulator BDDK denied it a payment license. The regulators had demanded that PayPal's data centers be located inside Turkey to facilitate compliance with government and court orders to block content and to generate tax revenue. PayPal said that the closure will affect tens of thousands of businesses and hundreds of thousands of consumers in Turkey.

Sri Lanka

In January 2017, the PayPal team was scheduled to visit Sri Lanka in mid-January to re-establish links. In Sri Lanka as of 2021, PayPal can be used only to send money.

Russia

In March 2022, PayPal suspended all activities in Russia due to 2022 Russian invasion of Ukraine.

Ukraine

In March 2022, PayPal expanded its services for Ukrainian accounts, allowing them to send and receive money from friends and family. Previously, PayPal users in Ukraine could only send money internationally from their accounts, not receive it.

Kenya

In 2018, PayPal and Safaricom collaborated to enable Kenyans to perform MPESA transactions by leveraging on the latter's mobile money service

Indonesia

In 30 July 2022, Kominfo blocked PayPal for missing a deadline to register as an electronic services operator under Bank Indonesia or the Financial Services Authority as required by new licensing rules. This resulted in PayPal users in Indonesia being unable to access their funds stored in PayPal, until Kominfo temporarily unblocked the service for 5 days to allow users to withdraw their money. PayPal was fully unblocked on 3 August 2022 after registering as an electronic systems operator under the new rules.

PayPal Giving Fund

PayPal Giving Fund is a registered charity supported by PayPal that streamlines donations to non-profit organizations.

Advertising

In 2024, PayPal debit cards were allowed to be added to Apple Wallets. This feature was introduced in what was described as the "biggest ad campaign to date" for PayPal. A commercial with Will Ferrell singing a slightly revised version of Fleetwood Mac's "Everywhere" debuted before the first ESPN broadcast of ''Monday Night Football'' of the 2024 season. In 2025, another ad campaign starring Ferrell used an altered version of Fleetwood Mac's "Go Your Own Way".

Regulation

In the United States, PayPal is licensed as a money transmitter, on a state-by-state basis.FDIC decides PayPal's no bank
. ZDNet (March 13, 2002). Retrieved on 2013-08-12. But state laws vary, as do their definitions of banks, narrow banks, money services businesses, and money transmitters. Although PayPal is not classified as a bank, the company is subject to some of the rules and regulations governing the financial industry, including Regulation E consumer protections and the USA PATRIOT Act.

The most analogous regulatory source of law for PayPal transactions comes from peer-to-peer (P2P) payments using credit and debit cards. Ordinarily, a credit card transaction, specifically the relationship between the issuing bank and the cardholder, is governed by the Truth in Lending Act (TILA) 15 U.S.C. §§ 1601-1667f as implemented by Regulation Z, 12 C.F.R. 226, (TILA/Z). TILA/Z requires specific procedures for billing errors, dispute resolution, and limits cardholder liability for unauthorized charges.Margaret Jane Radin et al., Internet Commerce The Emerging Legal Framework 1174–1175 Foundation Press (2d ed. 2006) Similarly, the legal relationship between a debit cardholder and the issuing bank is regulated by the Electronic Funds Transfer Act (EFTA) 15 U.S.C. §§ 1693-1693r, as implemented by Regulation E, 12 C.F.R. 205, (EFTA/E). EFTA/E is directed at consumer protection and provides strict error resolution procedures. However, because PayPal is a ''payment intermediary'' and not otherwise regulated directly, TILA/Z and EFTA/E do not operate exactly as written once the credit/debit card transaction occurs via PayPal. Basically, unless a PayPal transaction is funded with a credit card, the consumer has no recourse in the event of fraud by the seller.

In 2008, PayPal Europe was granted a Luxembourg banking license, which, under European Union (EU) law, allows it to conduct banking business throughout the EU. It is therefore regulated as a bank by Luxembourg's banking supervisory authority, the Commission de Surveillance du Secteur Financier (CSSF). All of the company's European accounts were transferred to PayPal's bank in Luxembourg in July 2007. Prior to the move, PayPal had been registered in the United Kingdom (UK) as PayPal (Europe) Ltd, an entity which was licensed as an Electronic Money Issuer with the UK's Financial Services Authority (FSA) from 2004. This ceased in 2007, when the company moved to Luxembourg.

In India, as of January 2010, PayPal has no cross-border money transfer authorization. In an emailed response to questions from The New York Times, Reserve Bank of India spokeswoman Alpana Killawalla said, "Providers of cross-border money transfer service need prior authorization from the Reserve Bank under the Payment and Settlement Systems Act. PayPal does not have our authorization." As of 2010, PayPal did not have the required Certificate of Authorization.

PaisaPay is an Indian sister service to PayPal. It is owned by eBay. PaisaPay makes possible payments from abroad by PayPal account holders to Indian sellers on eBay.in.

In Australia, PayPal is licensed as an authorised deposit-taking institution (ADI) and is thus subject to Australian banking laws and regulations.

In Singapore, PayPal holds a stored value facility that does not require the approval of the Monetary Authority of Singapore.

Safety and protection policies

The PayPal Buyer Protection Policy states that customers may file a buyer complaint for not receiving an item or if the purchased item was significantly not as described. The customer can open a dispute within 180 days from the date of payment and escalate it to a claim within 20 days from opening the dispute.

Buyers using a credit card might get a refund via chargeback from their credit-card company. However, in the UK, where such a purchaser is entitled to specific statutory protections (that the credit card company is a second party to the purchase and is therefore equally liable in law if the other party defaults or goes into liquidation) under Section 75 Consumer Credit Act 1974, the purchaser loses this legal protection if the card payment is processed via PayPal.

Also, the Financial Ombudsman Service (for the U.K.) position is that section 75 protection does not apply where PayPal or any eMoney service becomes involved in the credit card transaction. This leaves consumers with no recourse to pursue their complaint with the Financial Ombudsman Service. They only would have recourse in the courts, but in any event they cannot because PayPal is incorporated in Luxembourg and, since the UK has left the EU, is now no longer within the jurisdiction of any UK Courts. The key issues that determine the applicability of section 75 are identified very clearly in Office of Fair Trading v Lloyds TSB Bank Plc and others 006EWCA Civ 268 7 and the Bank of Scotland v Alfred Truman (a firm) 005 WHC583 (QB). This is a legal authority that section 75 protection does exist where one has paid on a credit card for a product, via an eMoney service.

According to PayPal, it protects sellers in a limited fashion via the Seller Protection Policy. In general, the Seller Protection Policy is intended to protect the seller from certain kinds of chargebacks or complaints if the seller meets certain conditions, including proof of delivery to the buyer. PayPal states the Seller Protection Policy is "designed to protect sellers against claims by buyers of unauthorized payments and against claims of non-receipt of any merchandise". The policy includes a list of "Exclusions" which itself includes "Intangible goods", "Claims for receipt of goods 'not as described, and "Total reversals over the annual limit". There are also other restrictions in terms of the sale itself, the payment method and the destination country the item is shipped to (simply having a tracking mechanism is not sufficient to guarantee the Seller Protection Policy is in effect). The PayPal Seller Protection Policy does not provide the additional consumer protection afforded by UK consumer legislation ''(most notably the Consumer Rights Act 2015)'' and in addition, it cannot be enforced in the Courts because PayPal operates from Luxembourg, outside all three of the UK legal jurisdictions.

Security

Security token

In early 2006, PayPal introduced an optional security key as an additional precaution against fraud. A user account tied to a security key has a modified login process. Account-holders enter their login ID and password as normal, but are then prompted to enter a six-digit code provided by a credit card sized hardware security key or a text message sent to the account holder's mobile phone. For convenience, users may append the code generated by the hardware key to their password in the login screen. This way they are not prompted for it on another page. This method is required for some services, such as when using PayPal through the eBay application on iPhone.

This two-factor authentication is intended to make it difficult for an account to be compromised by a malicious third party without access to the physical security key, although it does not prevent the so-called Man in the Browser (MITB) attacks. However, the user (or malicious third party) can alternatively authenticate by providing the credit card or bank account number listed on their account. Thus, the PayPal implementation does not offer the security of true two-factor authentication.

MTAN

It is also possible to use a mobile phone to receive an mTAN (Mobile Transaction Authentication Number) via SMS. Use of a security code that is sent to the account holder's mobile phone is currently free.

Fraud

As early as 2001, PayPal had substantial problems with online fraud, especially international hackers who were hacking into PayPal accounts and transferring small amounts of money out of multiple accounts. Standard solutions for merchant and banking fraud might use government criminal sanctions to pursue the fraudsters. But with PayPal losing millions of dollars each month to fraud while experiencing difficulties with using the FBI to pursue cases of international fraud, PayPal developed a fraud monitoring system to detect potentially fraudulent transactions. This development of fraud monitoring software at PayPal led Peter Thiel to create Palantir, a big-data security company whose original mission was to "reduce terrorism while preserving civil liberties."

150,000 PayPal cards frozen

In 2015, 150,000 Spanish cardholders had their funds frozen in an apparent fraud case involving a PayPal service provider, Younique Money, which was the de facto administrator of the cards. Previously, PayPal had charged €15 to all its card users without authorization (150,000 users). As of March 2015, most funds had not been returned.

Predatory business practices

On December 21, 2024, YouTuber MegaLag uploaded a video revealing how the popular online shopping web browser extension Honey was indiscriminately stealing money from online creators who use affiliate links, including from YouTubers who Honey was paying to sponsor the extension in their videos.

Usually, when a person clicks on an affiliate link to a productsuch as one provided in the description of a YouTube video sponsoring the product, or one embedded in a product review articlea revenue cookie is generated for the affiliate link, so that if someone buys a product because they saw a promotion of that product, the promotor will be credited for the sale and be paid a percentage. If the buyer clicks on multiple affiliate links for a product before buying it, usually the last clicked link is the one credited for the sale.

However, if a buyer had the Honey extension installed in their browser, then upon reaching a merchant's checkout page, the extension would ask if the buyer wanted Honey to check for coupons. If the buyer clicked yes, Honey would delete the cookie for the last clicked afffiliate link and replace it with Honey's own affiliate cookie, regardless of whether or not the buyer used any of the coupons Honey found, and even if Honey didn't offer any coupons at all. By doing this, Honey would take all the affiliate credit and money for the sale, leaving the creator who actually promoted the product (who owned the supplanted affiliate link) with nothing.

Honey has also been exposed for intentionally hiding better deals that users would recommend online and instead pulling out worse discounts from the cashback program, which the company has full control over.

Criticism and controversies

In 2003, PayPal voluntarily ceased serving as a payment intermediary between gambling websites and their online customers. At the time of this cessation, it was the largest payment processor for online gambling transactions. In 2010, PayPal resumed accepting such transactions, but only in those countries where online gambling is legal, and only for sites which are properly licensed to operate in said jurisdictions.

Since at least 2005, PayPal has maintained an Acceptable Use policy which disallows "transactions involving... items that are considered obscene... rcertain sexually oriented materials or services." Their enforcement of the policy has been a constant source of controversy between PayPal and people within or related to the sex industry. In 2014, PayPal notified subscription service provider Patreon that it was moving to cease integration with Patreon as a platform as the result of Patreon permitting "adult content" on their platform. Patreon then removed access to PayPal services for creators who produced sexual content.

If PayPal determines an account has been used for fraud, for another purpose that violates PayPal's Acceptable Use Policy, or without the account holder's authorization, PayPal puts limitations on, or freezes, the account. PayPal has been involved in several public controversies or disputes after freezing the account of high profile users such as Richard Kyankathen-owner of the website Something Awfulin September 2005, Cryptome in March 2010, and April Winchellthe owner of Regretsyin December 2011. The account was reinstated, and PayPal apologized and donated to her cause. In September 2010, PayPal froze the account of Markus Persson, a Minecraft developer. Persson publicly said that he had not received a clear explanation from PayPal as to why the account was frozen, and that PayPal was threatening to keep the money in the account if they found any suspicious activity. His account contained around €600,000 ($655,842 USD).

PayPal's partner MasterCard ceased taking donations to WikiLeaks in 2010, and after the U.S. State Department said WikiLeaks was engaged in illegal activities, PayPal followed suit by suspendingand later permanently restrictingpayments to the website. Hacktivist supporters of WikiLeaks retaliated by coordinating cyber attacks on PayPal, MasterCard, and other companies that took action against WikiLeaks.

In February 2011, PayPal unbanned the account of a website that supports Iraq War resisters after it had enough information to fulfill its know your customer guidelines. The Chelsea Manning Support Network claimed the backdown was a reaction to a petition to the company to reinstate the account.

In May 2013, PayPal declined to pay a reward offered in its Bug Bounty Program to a 17-year-old German student who had reported a cross-site scripting flaw on its site. The company wrote that the vulnerability had been previously reported, and chastised the youth for disclosing the issue to the public, but, uniquely, sent him a "Letter of recognition" for the discovery.

In August 2013, entrepreneurs who had used PayPal to collect the funds they raised on crowdfunding platforms like Kickstarter and Indiegogo reported difficulty in being able to withdraw the money. Startups included Proton Mail, Ouya, GlassUp (a rival to Google Glass), and Mailpile. This also extended to crowdfunded games like Yatagarasu: Attack on Cataclysm, Skullgirls and Dreamfall Chapters.

In May 2014, PayPal blocked the account of a Russian human rights organisation "RosUznik", which supported political prisoners arrested at Bolotnaya Square.

As of January 2015, a class-action lawsuit against PayPal was filed in Israel, claiming that they arbitrarily froze accounts and held funds for up to 180 days without paying interest and thereby directly profited from it. In the examples given in the lawsuit, PayPal had received complaints against small vendors which were later resolved, but the PayPal account was closed. The lawsuit requests that PayPal be declared a monopoly and thus regulated accordingly.

In April 2015, The Guardian reported that PayPal had blocked the account of London-based human rights group Justice for Iran.

In May 2015, PayPal blocked an account intended to raise money for the production of print copies of Boris Nemtsov's investigative report " Putin. War" on Russian military involvement in Ukraine. The explanation by PayPal was that "PayPal does not offer the opportunity to use its system for collecting funds to finance the activities of political parties or for political aims in Russia", though PayPal's ''Acceptable Use Policy'' does not mention financing for political goals. Non-governmental organization Freedom House issued a statement by Susan Corke, director or Eurasia Programs, saying, "One of the Russian government’s most effective tactics for stifling criticism of President Putin and the government’s human rights abuses is to accuse critics of conducting ‘political activities’ and claiming them to be improper or illegal. It is disturbing, to say the least, that PayPal has supported those tactics by denying individuals the right to help pay for publishing ‘Putin. War,’ the work of murdered opposition figure Boris Nemtsov. PayPal should immediately lift this ban, to help, rather than hinder, press freedom in Russia."

In September 2015, PayPal reappeared as a payment processor at some newly legalized US online gambling sites operating in the state of New Jersey. Since the May 14, 2018, Supreme Court of the United States overturn of the Professional and Amateur Sports Protection Act of 1992, PayPal has been widely available to customers in states where sports betting has been legalized for both depositing and withdrawing money.

By 2016, ConsumerAffairs had received over 1,200 consumer reviews of PayPal, resulting in an overall satisfaction rating of one star out of five for the company. Consumers have also launched numerous anti-PayPal Facebook pages and Twitter accounts to air their complaints.

In February 2017, PayPal froze the account of News Media Canada, a Canadian trade association, in response to a payment from The Reminder, a Flin Flon, Manitoba community newspaper, that was intended to cover the fee for the Reminder's submission of articles for consideration in a nationwide journalism contest run by News Media Canada, including one discussing Syrian refugees. PayPal cited United States regulations as a reason for flagging the transaction between Canadian entities.

In September 2018, PayPal banned radio host Alex Jones and his website InfoWars, claiming that his site has content that is hateful and discriminatory against certain religious groups.

PayPal discontinued payments to Pornhub models on November 14, 2019, alleging that "Pornhub has made certain business payments through PayPal without seeking our permission". Pornhub criticized the decision as one that affected "over a hundred thousand performers who rely on them for their livelihoods" and steered its payees toward other payment options.

In September 2020, PayPal issued new terms of service which introduced a fee for inactive accounts in 19 countries. PayPal sent its clients an email about the updated terms, but did not mention introducing such a fee.

PayPal faces criticism over its policy requiring that the name on a user account must match the account holder's legal name, and that any user seeking to change the name on their account must provide government-issued photo identification. Trans and nonbinary users and rights advocates object because this means that any trans user whose preferred name differs from their legal name is forced to use their deadname instead. They say this is not only disrespectful, but also endangers trans users, because the name on the PayPal account is revealed to the payee whenever a user makes a payment, thereby outing the user and potentially exposing them to people who may harass or injure them. By contrast, other financial companies, such as MasterCard, have made it easier for trans and nonbinary users to change the names on their accounts.

In July 2021, PayPal announced a plan to collaborate with the Anti-Defamation League (ADL) Center on Extremism, the League of United Latin American Citizens, and several other nonprofits to analyze its users' transactions in order to investigate the finances of extremist and hate groups in the United States, and to share the results with law enforcement, policymakers, and other financial corporations. The ADL's CEO, Jonathan Greenblatt, stated that this initiative is meant to help "mitigat extremist threats."

In September 2022, PayPal closed the accounts of the British social commentator Toby Young and two connected organisations: the Free Speech Union and The Daily Sceptic website. PayPal said that it closed the accounts because of breaches of its acceptable use policy, alleging misinformation about COVID-19 vaccines. PayPal reversed the decision a few days later.

In October 2022, PayPal published an update to its Acceptable Use Policy that included a $2,500 fine for the accounts of users PayPal deemed to have been promoting misinformation. Former PayPal president David A. Marcus criticized the change, tweeting that "PayPal's new AUP goes against everything I believe in". Elon Musk, co-founder of X.comwhich merged with Confinity to form PayPalalso criticized the change. Following media scrutiny and criticism on social media, PayPal removed the updated policy from its website, stating, "An AUP notice recently went out in error that included incorrect information. PayPal is not fining people for misinformation and this language was never intended to be inserted in our policy. Our teams are working to correct our policy pages."

Litigation

In March 2002, two PayPal account holders separately sued the company for alleged violations of the Electronic Funds Transfer Act (EFTA) and California law. Most of the allegations concerned PayPal's dispute resolution procedures. The two lawsuits were merged into one class-action lawsuit (In re: PayPal litigation). An informal settlement was reached in November 2003, and a formal settlement was signed on June 11, 2004. The settlement requires that PayPal change its business practices (including changing its dispute resolution procedures to make them EFTA-compliant) and make a US$9.25 million payment to members of the class. PayPal denied any wrongdoing.

In June 2003, Stamps.com filed a lawsuit against PayPal and eBay claiming breach of contract, breach of the implied covenants of good faith and fair dealing, and interference with contract, among other claims. In a 2002 license agreement, Stamps.com and PayPal agreed that Stamps.com technology would be made available to allow PayPal users to buy and print postage online from their PayPal accounts. Stamps.com claimed that PayPal did not live up to its contractual obligations and accused eBay of interfering with PayPal and Stamps.com's agreement, hence Stamps.com's reasoning for including eBay in the suit.

Craig Comb and two others filed a class action against PayPal in ''Craig Comb, et al. v. PayPal Inc.'', alleging illegal misappropriation of customer accounts, and detailing their customer service experiences, including the freezure of deposited funds for up to 180 days until dispute resolution by PayPal. PayPal argued that the plaintiffs were required to arbitrate their disputes under the American Arbitration Association's Commercial Arbitration Rules. The court ruled against PayPal, stating that "the User Agreement and arbitration clause are substantively unconscionable under California law."

In September 2002, Bank One Corporation sued PayPal for allegedly infringing its cardless payment system patents. The following year, PayPal countersued, claiming that Bank One's online bill-payment system was an infringement against PayPal's online bill-payment patent, issued in 1998. The two companies agreed on a settlement in October 2003.

In November 2003, AT&T Corporation filed suit against eBay and PayPal claiming that their payment systems infringed an AT&T patent, filed in 1991 and granted in 1994. The case was settled out of court the following month, with the terms of the settlement undisclosed.

In June 2011, PayPal and Israel Credit Cards, Ltd. (CAL)a credit card issuer subsidiary of Israel Discount Bankwere sued for NIS ₪16 million. The claimants accused PayPal of deliberately failing to notify its customers that CAL was illegally charging them for currency conversion fees.

A class-action lawsuit filed in 2010, in which the plaintiffs contested PayPal's "holds" on funds, was settled in 2016.

PayPal has proposed a settlement in the amount of US$3.2 million in ''Zepeda v. PayPal'' which has yet to be ratified. As part of the settlement proposal, the company agreed to change some of its policies.

In 2017, following a class action lawsuit between PayPal and its users over unexplained account closures, a settlement agreement was reachedand granted final approval by a federal judgein which PayPal agreed to pay the class US$4 million, modify the disclosure of its reserve and hold practices, and clarify its dispute resolution process.

In January 2022, a class-action lawsuit was filed against PayPal that claims the company froze accounts without providing adequate explanation, or for arbitrary reasons, and that PayPal told account holders they would "have to get a subpoena" to learn why their accounts were frozen. The lawsuit alleges that PayPal also confiscated funds for itself after 180 days, violating both the RICO Act and PayPal's own policies.

CFPB consent

On 21 May 2015, PayPal agreed that PayPal Credit would pay a US$25 million fine to settle a complaint filed in federal court by the U.S. Consumer Financial Protection Bureau. The complaint alleged that consumers using PayPal were signed up for PayPal credit accounts without their knowledge or consent, that PayPal had promised discounts and payment options the consumers never received, and that users trying to sign up for the regular, non-credit, PayPal accounts were signed up for credit accounts instead. The complaint was filed in the United States District Court for the District of Maryland, which ordered PayPal Credit to refund $15 million to consumers and to pay a $10 million fine.

See also

* BattleHack
* Billpoint
* E-commerce payment system
* Electronic money
* Google Pay
* Interchange fee
* List of online payment service providers
* Micropayment
* Payment service provider
* PayPal Mafia
* Paytm
* Stripe (company)
* Wero (payment)

References

External links

*

{{Authority control

1998 establishments in California
American companies established in 1998
Financial services companies established in 1998
Internet properties established in 1998
2002 mergers and acquisitions
2002 initial public offerings
Companies based in San Jose, California
Corporate spin-offs
EBay acquisitions
Electronic funds transfer
Financial technology companies
Foreign exchange companies
Mobile payments
Online payments
Payment systems
Payment service providers