PayPal Class-Action Settlement

It seems that a settlement has been reached against Paypal for some really horrible business practices.

I have been telling people for years that dealing with PayPal could have dire consequences especially for small business owners. Many PayPal users may have received an email with the following message:

NOTICE OF CLASS-ACTION SETTLEMENT. THIS NOTICE MAY AFFECT YOUR RIGHTS. PLEASE READ IT CAREFULLY.

A settlement has been reached in a class action in which the plaintiffs allege, among other things, that PayPal improperly handled disputed transactions on PayPal accounts and improperly placed holds and reserves on accounts or closed or suspended accounts. Plaintiffs also allege that PayPal failed to provide annual error-resolution notices and monthly account statements under the Electronic Fund Transfer Act. You are a member of the Settlement Class if you had an active PayPal account between April 19, 2006 and Nov. 5, 2015. Certain Settlement Class Members who had a hold or reserve placed on their account and/or who had their account closed or suspended by PayPal are eligible to receive a monetary payment upon submission of a valid claim form. This notice summarizes the proposed settlement. For the precise terms and conditions of the settlement, please see the Settlement Agreement available at http://www.accountholdsettlement.com/, by accessing the Court docket in this case through the Court's Public Access to Court Electronic Records (PACER) system at https://ecf.cand.uscourts.gov, or by visiting the office of the Clerk of the Court for the United States District Court for the Northern District of California, 1301 Clay Street, Oakland, CA 94612, between 9:00 a.m. and 4:00 p.m., Monday through Friday, excluding Court holidays.

PLEASE DO NOT TELEPHONE THE COURT OR THE COURT CLERK'S OFFICE TO INQUIRE ABOUT THIS SETTLEMENT OR THE CLAIM PROCESS.

PayPal Deals with Security Issues

According to Forbes, A new XSS (cross site scripting) vulnerability was identified on Paypal.com. It was discovered by a researcher and was disclosed on both Security-Shell and XSSed. That bug would allow a malicious hacker to insert code on the site that could potentially be used to access a user’s account.

The problem, technically, is found in the parameter sender_country in a transaction called nvpsm. NVP is Paypal’s API for Merchants to use when interacting with the Paypal web site, it stands for Name-Value Pair. SM is short for ’send money’. A problem such as this can be used to capture a user’s session (essentially log in as that user) and perform privileged actions (money transfers) as that user, as well as send a user a valid Paypal URL but then redirect them to a malicious third party site (phishing, malware, etc.).

As if PayPal doesn't have enough problems.

The problem with PayPal : Reasons for a Merchant Account.

Although PayPal has certainly made it easy for online merchants to accept credit cards, it is not without it's share of problems. If you are going to accept credit using PayPal it would be a good idea to sign up through a separate bank account. Pay Pal has a history of siding with the customer much more than a bank would with a traditional merchant account. Reading through PayPal's agreement may surprise you ( and not in a good way) and few ever do. This way if they Pay Pal decides to debit your account they won't get much until the issue is resolved. I have heard many horror stories about PayPal freezing funds for a merchant for several months. Although this could certainly happen with a traditional merchant account (i.e. if you did something that would raise a red flag for fraud) it seems to happen a lot more often with PayPal. Another problem many client's tell me is that it's very difficult to get anything resolved with PayPal when things go wrong. Many credit card processors have 24/7 customer service so should an issue arise you can always get a live person on the phone.