PayPal terminated my account because I use a VPN

https://uwnthesis.wordpress.com/2013/04/08/paypal-terminated-my-account-because-use-of-a-vpn-is-against-their-terms-and-conditions/

by pcvarmint • 13 years ago

50 76 13 years ago

uwnthesis.wordpress.com

DigitalSea2• 13 years ago

This is somewhat a flawed argument on Paypal's part. If a user chooses to obscure their connection via a VPN for security purposes but has supplied the appropriate identification needs to Paypal, what is the problem here?

Paypal like any other big corporation has lost touch with its customer base. Its been that way for a long time now, someone needs to come in and beat Paypal in its own territory. Payment providers like Square are still the small time, they're not in countries like Australia or New Zealand or any other first world country that needs some Paypal competition.

MichaelGG• 13 years ago

I'd imagine it's yet another level of fraud prevention. IP information can be quite useful. If a customer does something that limit's PayPal's ability to limit fraud, then PayPal cuts them.

I agree this is hostile and not friendly. But nor is dealing with fraud. I dislike PayPal and avoid them as much as possible, but it's hardly an easy task and I'm not sure other people would do vastly better if they had to operate with the same parameters.

DigitalSea2• 13 years ago

It's kind of a steep move terminating his account. My Facebook account was almost hacked once because someone from an overseas IP tried logging in to my account. Facebook waited for me to login via my Australian IP address and alerted me to he fact and asked if it was me, I said no and I assume they blocked that IP. If security is such an issue, why couldn't Paypal ask the account owner if it was himself behind a VPN and to provide some identification documents?

I remember a little while ago having to supply some identifications documents to Paypal (scan of my passport, scan of my assigned credit card with most of the numbers blacked out, etc). If an account owner is willing to provide that information and is say from a country like the United States, Australia or the UK, then Paypal should lower their suspicions.

I can see where Paypal is coming from here. IP scanning is one of many criteria that determines if a user is potentially fraudulent (I've used Maxmind fraud protection before and it operates with similar criteria).

coldtea• 13 years ago

>This is somewhat a flawed argument on Paypal's part. If a user chooses to obscure their connection via a VPN for security purposes but has supplied the appropriate identification needs to Paypal, what is the problem here?

Well, they don't want people to use VPNs/tunneling and such because they are being used time and again to mask the country of origin, IP etc. They can even block your account for logging in from another country that you're visiting (they've done that to me and ask for photo ids and such).

It's not about "security" or lack thereof, it's about stopping certain kinds of fraud and keeping certain tabs.

(Sure, a VPN may protect from other kinds of fraud, e.g MITM attacks and identity theft. But then again, most actual PayPal customers don't use VPNs, whereas lots of identity theft and fraud guys do).

arunabha• 13 years ago

>they're not in countries like Australia or New Zealand or any other first world country that needs some Paypal competition

I guess that's reason why Paypal seems to endure beyond reason in spite of repeatedly showing the middle finger to customers. We in the US are relatively well off in terms of Paypal alternatives, but this is simply not true for a lot of other places. Plus Paypal has entered the status of being the 'default' for a vast majority of the non tech populace.

The good thing is, hackers are often the canary in the coal mine in terms of signaling future preferences of the masses, so we can hope Paypal will either reform itself, or die.

Hello71• 13 years ago

sigh

PayPal is (still) not evil. It charges too much, and does some shitty things, like all companies.

It's ridiculous to jump to conclusions based off a blog post that doesn't even post a copy (redacted if necessary) of the allegedly offending communication.

kintamanimatt2• 13 years ago

PayPal is evil. They're not evil because of what they charge, they're evil because they treat their customers with utter disregard and contempt.

It appears there's an internal lottery that all their customers play without their knowledge. If your numbers come up, the fuckup fairy will come visit your account and you will have little to no recourse.

jayfuerstenberg2• 13 years ago

Agreed.

If you have a website dedicated to chronicling just how badly you suck ( http://www.paypalsucks.com ) it probably means you're doing something very wrong.

fnordfnordfnord• 13 years ago

You're right that we shouldn't condemn [company, person] because somebody made a blog post after [company, person] did something that upset them. But, you've taken on a big job sticking up for PayPal. It doesn't take a Google-fu master to find copious examples of PP behaving inexcusably.

dmk23• 13 years ago

What did you expect? VPN is a favorite tool for all sorts of frauds.

If your true IP is obscured by a VPN this is just a red flag for PayPal or any other payment processor. Especially if you happen to share the same IP as someone committing actual fraud - which is very much likely if you are using public proxies. Very few legitimate customers pay over VPN.

Do not use VPNs if you do not want to be flagged or blocked.

EDIT1: In response the comments, no I am not sarcastic at all. The number of legitimate VPN users (among general Internet population, not HN) is miniscule and does not justify the financial risks involved. If you are using VPN you are seen as hiding something and flagging/blocking you from sensitive transactions is an obvious response.

EDIT2: I am talking about public VPNs that can be anonymously abused by anyone - where you'd be likely sharing IPs with criminals. By all indications that's what OP was using if he wanted to hide himself. If you use VPN from work or coffeeshop you'll be identified by some innocuous-looking residential / corporate IPs.

nkassis• 13 years ago

"Do not use VPNs if you do not want to be flagged or blocked." I hope that was sarcastic.

I do understand that legitimate VPN users are probably a small percentage of Paypal total user base and that a large portion of frauders use VPN (I don't know what percentage of VPN users who paypal are trying to commit fraud, could be the majority, I don't know) But using VPN should cause you to get flagged. It has a very legitimate use. A lot of people use them when on the go to protect themselves while on wifi. I use a VPN all the time when I'm not at home (well aside from working at home which I do over vpn).

I don't see why I should expose myself to avoid being flagged.

rhizome• 13 years ago

I don't see why I should expose myself to avoid being flagged.

Don't you explain this yourself? If few PP users use VPN and a large portion of fraudsters use VPN, I think we can chalk this one up to cold math despite the is/ought problem.

untog• 13 years ago

I don't see why I should expose myself to avoid being flagged.

Because it isn't worth PayPal's time to cater to you. Seriously, go and use a different provider.

I know that sounds incredibly flippant, but it's the reality- PayPal will stop blocking VPNs when it is financially prudent for them to do so. Of all companies, would you expect anything different from PayPal?

binarycrusader• 13 years ago

  The number of legitimate VPN users (among general Internet population, not HN) is miniscule...

VPN usage is increasing, not decreasing, even if as you claim, a "miniscule" group of users are using VPNs it's a dumb move by PayPal.

Many corporate environments require the use of VPNs for mobile equipment (laptops, phones, etc.). Now imagine a business that uses PayPal and requires the use of VPNs for all of their PayPal account managers.

The argument that most fraudsters use a particular technology so we should ban use of that technology is myopic at best.

uxp• 13 years ago

> Many corporate environments require the use of VPNs

And if they do, you can be sure they aren't going to be using a VPN provider outside of the country to get around geolocation restrictions, or to mask the originating IP. They'll be sending their outside data _into_ a secure intranet, not back out into the general net.

Basically, the OPs only mistake isn't using a VPN, it's masking his original location, intentional or not. It's a stupid rule by PayPal, but it's not very surprising that they'd follow a "common patterns of fraud" checklist word for word. Thats what they do.

dangrossman3• 13 years ago

VPN'ing to your office isn't going to get your account flagged. PayPal isn't inspecting network data for signs of tunneling or something. They're banning people that connect from public anonymizing VPN services because they're used for attempted fraud on their service every single day.

notlisted• 13 years ago

You're severely mistaken. Using a VPN is a pretty smart move when you access your paypal account in a coffee shop on WiFi. I always use my VPN when I'm logging on to sensitive accounts (FB, Google, bank or corporate network) in public locations (hotels, airports, coffee shops). In fact, my company demands it.

I do wonder which VPN the OP used. If he use one of those anonimizing VPNs that is popular with bittorrent downloaders, spammers and the like, then he shouldn't be surprised if Paypal's fraud detection unit was suspicious.

Feel we're not getting the whole story here.

ewillbefull• 13 years ago

Why use a VPN if you're accessing PayPal over HTTPS?

agwa4• 13 years ago

What you're saying may be PayPal's reasoning but there needs to be some pushback on that. There are very legitimate uses of VPNs, not for providing anonymity, but for tunneling your way out of hostile networks. Everyone should use a VPN when they travel so they don't have to worry about things like insecure WIFI [1] or hotels injecting ads into web pages [2]. It would be reasonable for PayPal to forbid use of anonymous VPN services, but not VPN services like Cryptoseal (a YC company) or Securetunnel (by the OpenVPN folks) which are meant for legitimate activity.

[1] Remember, not all websites uses HTTPS, and even the ones that do might still be insecure (for example, by using non-secure cookies). Plus you have to constantly check to make sure you're accessing the correct HTTPS URLs or you can be sslstrip'd. It's much easier and safer to just use a trustworthy VPN.

[2] http://justinsomnia.org/2012/04/hotel-wifi-javascript-inject...

polemic• 13 years ago

Sure, but if you're security concious then you're going to notice the lack of SSL. Meanwhile, you've added a VPN provider into the chain. And you still have to keep an eye on the SSL status considering that, hey, maybe they get MITM'ed?

If the site is delivered via SSL, I just can't see what a VPN provides other than anonymity, which is not security.

latj• 13 years ago

Do you actually have usage data for some public proxies or just making it up as you go?

briandear7• 13 years ago

Sorry, but you obviously have never run a multinational internet company, nor do you seem to know anything about corporate VPNs. Nearly every large corporation in the world uses VPNs for employee computers. The "majority" of VPN users are not people trying to "hide" illicit activity, the majority are highly security conscious or they're road-warriors on questionable hotel connections among a variety of other non-criminal use cases.

When we started icouch.me while in Shanghai, China, PayPal flagged my account and constantly locked it even though I jumped through their hoops "proving" our legitimacy and that no transactions (at that time) were actually China-originated. Just the simple fact that I logged on from China caused us to get locked out of our payments for up to weeks at a time (even though they still had no problem collecting the fees from our still-incoming transactions.) Then once I got that nonsense sorted, I started traveling more frequently for the company. So when I arrived in New York City, once again I was locked out of my account for 5 business days for "security" reasons, even though we've never had a single chargeback or any sort of security complaint or issue. Then I worked out of Texas for several weeks and once again, my account was locked. Despite the fact that we had the same US corporate bank account since 2010 (when the company was first founded.) By using a VPN, I was able to ensure my US "presence" to manage our business without PayPal's ridiculously retarded IP-detection security lockouts. I've since told paypal to go suck an egg and we use Stripe for everything.

When a company like PayPal can hold my operational funds hostage for weeks at a time with no way to clear it up expeditiously, then they just became thieves. They're making interest off of MY money while I can't access it. If they were "really" worried about security, then they'd block all transactions as well. But no, they have no problem taking money.

Interestingly, the credit bureau websites are locked to US only IPs as well. So if you have a subscription to some credit-monitoring service, they'll gladly take your money even if you can't access their services with a non-US IP address.

Those folks can all go to hell. It isn't my problem that some russian and nigeria scam artists have a tendency to cause problems. The IP address isn't the issue -- it's the security of their overall application. They're using geo-location as a shorthand for actually doing their job in securing their site.

Interestingly, I can access my US Chase bank account, my Simple account, Fidelity Investment account, Stripe from around the world without any sort of of VPN, yet somehow PayPal can't seem to figure out how to get security or customer service right.

jamescun• 13 years ago

Is it possible that they are using a VPN service (as opposed to self hosted) and other users of said VPN service have committed fraud and they just drew a bad card in the IP pool pot luck?

lwat• 13 years ago

The real WTF here is that people still use PayPal.

cynix• 13 years ago

For some users, there are no viable alternatives.

jayfuerstenberg2• 13 years ago

Stripe FTW

hoi• 13 years ago

Useless outside of N.America

endgame• 13 years ago

HN is running like clockwork, I see. Soon, we'll have another post about how the Apple App Store policies screwed someone else over, complete with the usual hand-wringing and justifications from believers.

Why do people still use PayPal? This stuff is not news.

jarcoal3• 13 years ago

HN is running like clockwork, but it's because everyone has become an entitled developer and not an actual entrepreneur that analyzes a business decision rationally.

Use PayPal or don't. Just don't expect them to let you use it anyway you want.

StavrosK3• 13 years ago

> everyone has become an entitled developer and not an actual entrepreneur that analyzes a business decision rationally

Wow, this sentence must win some "highest offense:words ratio" award. It insults so many people in so few words!

briandear7• 13 years ago

Hey jackass. I am an actual entrepreneur that told PayPal to f'off AFTER they held several weeks of income hostage because I logged in from Shanghai. It's not the "entrepreneurs" that are the problem, it's the fact that a company like PayPal gets away with harming our businesses while catering to grandma's trading beanie babies. Developers and entrepreneurs alike STILL use PayPal -- at least until they themselves get burned. Stories like these are important because it should remind us to tell companies like PayPal where to go.

As far as "entitled" -- hell yes we're entitled. The developers here on HN make the apps that use the services like PayPal -- they/we have a right to demand that PayPal not suck. PayPal has a right to not listen, but we certainly have the right to complain and take our business elsewhere and as a community of spoiled, entitled, not-actual entrepreneurs we should ALL tell PayPal to pound sand.

marssaxman• 13 years ago

What else are people supposed to use?

qwertzlcoatl• 13 years ago

Obviously Bitcoins. :)

bluedino• 13 years ago

Would your bank let you walk in and withdraw $10,000 from your own account with a ski mask or panty hose over your head? Even if you knew your account number and password?

Probably not.

fennecfoxen• 13 years ago

No, but they'd let you go through the drive-through ATM in a rental car.

fpgeek• 13 years ago

Perhaps, but there are per-transaction and daily limits on ATM withdrawals.

drakeandrews4• 13 years ago

It's been a while since I was in the states, but last I saw most of the drive through ATMs had cameras pointed at where the user should be.

auctiontheory2• 13 years ago

Why conjecture when you can easily run the experiment?

drakeandrews4• 13 years ago

Because the experiment ends with explaining to a few fine officers of the law that no, you weren't trying to rob the bank, you were just doing an experiment.

Or plain not being let into the bank. Most banks (in the UK at least) will not let people covering their faces into the bank.

qu4z-22• 13 years ago

Would your bank close your account if you tried to withdraw $10,000 from it in a ski mask though?

inovator• 13 years ago

Paypal is crap! It's a wakeup call for you to move on to another payment service. They froze my account 4 months ago with over $1k in it. Reason? Because I had a donation button on my site, and my site wasn't a registered non-profit organization. Well no shit, it's a hobby/fan site and I need a way to pay for my servers and such. Not to mention, I did pay taxes on those so call "donation". Sorry for the rant but just move on; you can't win against their stellar dispute department.

dangrossman3• 13 years ago

Connecting to a payment service through an anonymizing VPN service (or your own VPN running on some server in a data center) is like walking into a bank in a ski mask. You look like the criminals, and you're likely sharing IP space with them. If you were just VPN'ing to your home or office network, I doubt that would ever arouse any suspicion.

Telling: Type "PayPal VPN" into Google and what you get are VPN services advertising how they help you sign up for PayPal when you're normally forbidden, with FAQ pages like "why is my PayPal account now terminated".

starnixgod• 13 years ago

From the comments:

...I have uber security… and blocks against eavesdropping and MITM, and SSL and AES 256 encryption via an EFF sponsor, who runs a VPN… https://uwnthesis.wordpress.com/2013/04/08/paypal-terminated...

Looks like they were using a very public VPN that Paypal probably already had pre-flagged for fraud.

jlgaddis• 13 years ago

... and an incomplete understanding of how a VPN works.

oldgregg• 13 years ago

Check out Bitcoin, currency for grownups.

johndevor• 13 years ago

Yup, can't wait to not see these articles on PayPal any more. Granted, we'll probably see another type of article start to appear with frequency (e.g. I lost my wallet).

drakeandrews4• 13 years ago

Until I can walk into my local bank branch (or any of the hundreds of currency conversion stalls that dot London) and ask for a couple hundred satoshis, or deposit bitcoins direct into my bank account, bitcoin isn't ready to be a legitimate alternative currency, let alone an alternative to payment processors such as Paypal.

shousper• 13 years ago

Cash will be dead before you know it. So will ATMs and bank tellers.

DegreePower• 13 years ago

I'm extremely skeptical. Nowhere in PayPal's terms of use does it mention restricting use of a VPN. The only similar restriction I can find is against using an anonymizing proxy which seems like a reasonable restriction.

However I'll take the author at his word for a moment. Judging from the content on the author's blog, I think it's fair to assume he lives in Europe (where PayPal is regulated as a bank). Where does his VPN reside? It's certainly possible that it resides in a region that is regulated differently. One could look at this situation similarly to how YouTube, Hulu, Netflix, BBC, etc, block by region; not because they want to but because they have to. In the case of the mentioned sites, because of licensing terms, and in PayPal's case, because of financial regulations.

bdcravens2• 13 years ago

Pretty sure they interpret a VPN as an anonymizing proxy. Just because you paid for it or it's through your business, it still shows PayPal a different IP address than your true location. Intent isn't the issue, as they both look alike.

sigzero• 13 years ago

https://www.paypal-community.com/t5/Account-limits-and-verif...

TLDR: It's against the legal agreement to access PayPal that way.

kefs• 13 years ago

FWIW, PayPal's CEO was on HN 6 months ago, promised substantial change, and then promptly disappeared.

https://news.ycombinator.com/threads?id=davidmarcus

johnward• 13 years ago

I am never shocked when people posts these paypal accounts being banned. Stuff like this happens all the time. What did you really expect?

logn• 13 years ago

I think the dwolla.com interface is nice and have good (but limited) experiences with them.

bdcravens2• 13 years ago

It's like the gun control argument. A microscopic percentage of everyone who has ever purchased an assault weapon has ever committed a violent act. Regardless, the argument is that the potential harm makes banning necessary.

briandear7• 13 years ago

Exactly. PayPal would rather just ban the "thing" rather than try to actually do their jobs and solve the security issues. The IP address shouldn't matter -- it's the data that comes from the IP. They want to ban "guns" as a shorthand for actually trying to catch criminals.

PayPal terminated my account because I use a VPN

Related Stories