PayPal and zero-dollar invoice spam

http://www.troyhunt.com/2016/01/paypal-and-zero-dollar-invoice-spam.html

by temp • 11 years ago

160 68 11 years ago

orf• 11 years ago

Why would you put a clickable link to the spam website on your blog though?

miander2• 11 years ago

If you're so interested in typing in spam links you might as well search up something like "cheap electronics online" in Google and start clicking around page 10.

miander2• 11 years ago

Sorry about being a bit rude in this comment. I didn't mean to sound so sarcastic and I didn't mean to refer to you specifically.

bluedino• 11 years ago

I wonder what the reasoning is that PayPal allows you to 'send' someone $0.00?

I'm not really surprised at how terrible the support via Twitter is. I almost never use chat/email support these days with any large company-because of how useless it has become.

overcast• 11 years ago

I've received invoices for $0.00 when receiving promotional items for projects I was a part of. Comes right in the shipping box, and I'm assuming it's an accounting requirement.

bliti• 11 years ago

Yes, it is. Their inventory changed but they did not gain any revenue from it.

jonknee• 11 years ago

Which makes total sense when you need to consolidate inventory at the end of the month/quarter/year.

Ensorceled• 11 years ago

Lots of accounting reasons to invoice people 0.00 dollars. Sales materials, demo models, returns, replacements, etc.

ams6110• 11 years ago

Invoices can contain credits as well as charges. In some cases these might net out to zero but there would still be a legitimate reason to send the invoice showing that detail.

tehwebguy• 11 years ago

Has PayPal just not tried to fix anything or add features other than a CSS refresh in, like, ever?

giancarlostoro• 11 years ago

They did make paypal.me not long ago... That's about all I can think of?

roymurdock• 11 years ago

They acquired Venmo, which was pretty big for adding users to their ecosystem. They've kept it pretty quiet and have not tried to link the brands together, which probably says something about the current state of Paypal's brand.

ericcholis• 11 years ago

Braintree as well, which has a site and api that work very well. PayPal's on the other hand...

rory096• 11 years ago

Venmo was actually acquired by Braintree, which in turn was later acquired by PayPal.

chromaton• 11 years ago

There was an update to invoicing features last year, as well as a complete re-design of the website when you're logged in.

jedberg• 11 years ago

Their mobile app has advanced in leaps and bounds in the last year.

Also, payment is way easier than it was before. Less bouncing back and forth.

wheaties• 11 years ago

On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.

magicmu• 11 years ago

It can, however, be useful to get invoices for purchases that were discounted down to $0.00. At the startup I'm with we often give new customers a $0.00 trial rate, but they still want invoices so their billing department can keep track. Of course, this billing system isn't using PayPal, but just a thought.

ikeboy• 11 years ago

Not invoices per se, but if you buy something on eBay using only eBay gift cards, it processes as a PayPal "transaction" of $0.00. I've got a bunch of those in my email, always interesting to see "You sent a payment of $0.00 USD to X".

minikites• 11 years ago

What about sending out a replacement product to a customer? A given business process may be simpler if you generate a $0 invoice for replacements.

hluska• 11 years ago

Especially if your inventory system requires an invoice number in order to -x from inventory.

bhartzer2• 11 years ago

I agree, but what if the invoice was $1.00 or even $25.00. It would have the same effect, which would be to get the receiver to visit their website?

notahacker• 11 years ago

Sure, but Paypal et al might take a more active interest in shutting down service access for fraudulent payment demands than message spam

ChuckMcM• 11 years ago

Actually a simpler fix is to hold $10 in the user's paypal account for each $0 invoice they send, and if the invoice is reported back as spam they keep the $10, otherwise after 90 days they release it back to the (potential) spammer. Doing this with funds in the account, rather than with a (likely) stolen credit card, works very well.

For accounts which keep an average balance > $minimum you could wave the $10 hold and just confiscate $10 every time someone reported their $0 invoice as spam.

shostack• 11 years ago

Yeah, as much as I hate it, I always find myself appreciating the ingenuity that goes into these things.

Another similar spam hack (that unless I'm mistaken is also legal) is the recent plague of Google Analytics referrer spam targeting people who pay attention to their GA referral reports.[1] It has actually caused some issues given that the volume can be quite significant and can easily skew your overall numbers by quite a bit if left unfiltered.

[1] https://moz.com/blog/how-to-stop-spam-bots-from-ruining-your...

tyingq2• 11 years ago

Not mentioned in the article, but paypal allows you to send a single invoice to up to 100 different email addresses with a single click.

It also allows a 1-click way to email anyone that "hasn't paid" with an update.

bhartzer2• 11 years ago

I haven't checked, but are you able to send invoices via API?

tyingq2• 11 years ago

https://developer.paypal.com/docs/classic/invoicing/IntroInv...

p0la• 11 years ago

This is brilliant :)

xentronium• 11 years ago

@AskPayPal: I recommend deleting that tweet, it has your personal info
@troyhunt: It has my email address – I get email by sharing it with people who might want to send me email!

This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

mikeash2• 11 years ago

It's probably earnest. An amazingly large number of people think that making your personal e-mail address public is somehow unwise.

brianwawok• 11 years ago

I mean, it does slightly increase your rate of spam. I have a private email that I only give out to RL people that has never received a spam message.

sliverstorm2• 11 years ago

If you can keep your email address off the front page of the internet, I figure that will help reduce spam.

mfoy_• 11 years ago

Hanlon's Razor dictates to "Never attribute to malice that which is adequately explained by stupidity".

bcrescimanno2• 11 years ago

From the perspective of PayPal, it's not that his personal email address is made public. It's that the fact that he has a PayPal account associated with that email address is made public.

It's similar to advice for "forgot password" forms not to acknowledge whether or not an email address or username actually exists--simply tell the user an email was sent for that account regardless.

tempestn• 11 years ago

Fair enough, but it's a reasonable guess that any given primary email address has a paypal account associated with it. It's also not really secret, because you share that information with people to allow them to send you money.

patates• 11 years ago

If we were ever to reach singularity, it would be partly thanks to the motivation created by the spammers.

yeukhon• 11 years ago

I read the title and thought of spamming zero dollar gift on Minecraft!

bcrescimanno2• 11 years ago

PayPal employee here (and I'm hiring Node.js developers :P ).

I actually got two of these messages while I was out for the holiday break. I don't work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix.

The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don't want to artificially make our product worse for our many legitimate customers by going too far in trying to stop this spam.

samstave2• 11 years ago

Don't know if you can answer this: Why can I venmo people money instantly and paypal holds my money for days or weeks at a time?

tomlongson2• 11 years ago

Holding onto funds is how you mitigate risk as a bank or money transmitter.

asfakeaccount• 11 years ago

You can not venmo money instantly. The UI makes it seem that way, but it takes a few days for payment to process and as such, Venmo has become a target for scams: http://time.com/money/4036511/venmo-more-check-than-cash/

So do not use Venmo for commercial transactions (buying things of Craiglist for example) and do not assume the money transfers immediately.

Also shame on Venmo for misleading their users; they should do a better job of explaining how the transfer actually works.

HillRat• 11 years ago

It seems like only allowing a zero-dollar invoice after two parties have conducted another non-zero legitimate transaction might be a solution.

jtchang2• 11 years ago

I can see a lot of cases where you have a $0 legitimate transaction.

everfree• 11 years ago

Genuine question: What are the legitimate uses of $0 invoices? The only thing I can think of is a product that usually costs money (and thus has an invoice workflow), but has been marked as free for some promotion.

jtchang2• 11 years ago

It is very common to send $0 invoices. Some instances I can think of are receiving replacement goods / tracking if a service was rendered but not billable / making sure an account is zero'ed and you are fully paid up / etc

outericky• 11 years ago

In the case of periodic invoicing but you haven't crossed into the billable threshold.

Let's say you get 2 hrs of support per month free, after that it costs $100. If you don't use the full 2 hrs, you'd get a $0 invoice - but there may still be detail and record of work performed (which you would want)

big_maybe• 11 years ago

I sold a product and it was paid for by gift certificate or a special promo. I want to send a $0.00 invoice for the customer to see it and enjoy the feeling (Sweet! Free jerky/flowers/socks). It's great marketing and the customer will remember you the next time they want some jerky/flowers/socks.

dudus• 11 years ago

I've been getting the same emails for a while now. I sent to paypal through email and got no response. I also added on a topic I thought was relevant on their forum, and a guy there said he reported it and got a less automatic response than I did.

https://www.paypal-community.com/t5/Access-and-security/Gett...

I haven't got more messages lately, so I'm guessing they managed it already.

kenzokai• 11 years ago

Horrible PayPal customer service. This person should not be allowed on their Twitter account.

equine• 11 years ago

You can send invoices to people to get paypal to show their name to you and connect names to emails

dogma1138• 11 years ago

I can also do that with DirectDebit (ACH for you yanks) transactions in the UK for example; brute force branch sort code and account numbers and when you "transfer money" (you can do 1p, or even cancel the transaction once the TUN code has been generated iirc) you get the name associated with the account.

There isn't much you can do about it, detecting an abuse of an invoicing system and locally blocking it is much preferable to the other potential outcome of not knowing or being able to confirm where the hell did that invoice actually went.

richdougherty• 11 years ago

I saw the same sort of thing a few years ago with Google Calendar invite spam. If I remember correctly, I'd even get a meeting reminder with the spam message.

downandout• 11 years ago

All of these approaches are used to take advantage of the email deliverability rates of large reputable companies that send lots of email. Paypal is a new one, but Hotmail and Facebook have in the past been used for similar things. With Hotmail, you could define a custom "I've changed my email address" message, which would contain your spam message, and then it would send it to up to 5,000 "contacts" for you with near-100% deliverability. Some people automated this, and with that they were able send millions of messages per day. I haven't looked recently, but Facebook's "invite friends" feature has been used similarly in the past.

shabbaa• 11 years ago

For a PayPal employee to post here and say he made a team aware and they are working on this it's utterly laughable.

There was a post here on hn over two years ago for the same issue which was top post and generated a lot of news.

https://news.ycombinator.com/item?id=6526481

It is obviously very well known to them for years but they continue to do it

rtpg2• 11 years ago

Obviously well known?

Guy at PayPal sees post, tells a technical person about it, said person forgets about it. Suddenly PayPal doesn't know about it anymore.

Or a person wants to work on fixing this but a manager says no, because there are other priorities.

Or a person starts working on this, quits, and it gets lost among the things they were working on.

It's so easy for things to get lost in a company, even with all the bug trackers in the world.

r00fus• 11 years ago

Isn't this what support case systems and bug tracking software was meant to do - to track non-closed issues?

PayPal and zero-dollar invoice spam

Related Stories