What did you expect? VPN is a favorite tool for all sorts of frauds.
If your true IP is obscured by a VPN this is just a red flag for PayPal or any other payment processor. Especially if you happen to share the same IP as someone committing actual fraud - which is very much likely if you are using public proxies. Very few legitimate customers pay over VPN.
Do not use VPNs if you do not want to be flagged or blocked.
EDIT1: In response the comments, no I am not sarcastic at all. The number of legitimate VPN users (among general Internet population, not HN) is miniscule and does not justify the financial risks involved. If you are using VPN you are seen as hiding something and flagging/blocking you from sensitive transactions is an obvious response.
EDIT2: I am talking about public VPNs that can be anonymously abused by anyone - where you'd be likely sharing IPs with criminals. By all indications that's what OP was using if he wanted to hide himself. If you use VPN from work or coffeeshop you'll be identified by some innocuous-looking residential / corporate IPs.
You're severely mistaken. Using a VPN is a pretty smart move when you access your paypal account in a coffee shop on WiFi. I always use my VPN when I'm logging on to sensitive accounts (FB, Google, bank or corporate network) in public locations (hotels, airports, coffee shops). In fact, my company demands it.
I do wonder which VPN the OP used. If he use one of those anonimizing VPNs that is popular with bittorrent downloaders, spammers and the like, then he shouldn't be surprised if Paypal's fraud detection unit was suspicious.
> Why use a VPN if you're accessing PayPal over HTTPS?
There are too many ways things can go wrong even with HTTPS. First, how do you get to PayPal? Do you enter www.paypal.com or https://www.paypal.com? If you do the former you can be sslstrip'd [1]. You can check for the padlock icon (plus the correct domain name in the URL) but what if you forget? All it takes to be pwn'd is forgetting once, and if you're hurrying to get a bid in on eBay you'll probably forget. What if you do go to the HTTPS URL but get a certificate warning? I'm sure most HN users would do the right thing and reject it, but for ordinary users it's probably easier to just have a corporate policy that says "always use the VPN when on the road." And even if you always go to the HTTPS URL and reject invalid certificates, what if the site operator does something stupid like include non-HTTPS content or use session cookies without the secure flag?
HSTS is making things much better, but it's not a panacea - you have to have visited the site recently from a trustworthy connection for it to work. I still say VPN is better.
https://www.eff.org/https-everywhere can fix most of the issues you mentioned, by forcing the browser to use HTTPS on domains like paypal.com. You don't even have to have visited the site recently, because the whitelist is supplied by EFF.
In this specific case you don't even need SSL Anywhere if you're using Chrome, because "www.paypal.com" is in Chrome's built-in HSTS SSL-only list, along with Google, Twitter, Simple, Mega, Braintree and a bunch of other places.
Just to expand slightly: If you type www.paypal.com, click login and then check for the padlock, it may very well show up. https://www.paypa1.com is a perfectly valid site, and you're accessing it over ssl, after all.
"Do not use VPNs if you do not want to be flagged or blocked." I hope that was sarcastic.
I do understand that legitimate VPN users are probably a small percentage of Paypal total user base and that a large portion of frauders use VPN (I don't know what percentage of VPN users who paypal are trying to commit fraud, could be the majority, I don't know) But using VPN should cause you to get flagged. It has a very legitimate use. A lot of people use them when on the go to protect themselves while on wifi. I use a VPN all the time when I'm not at home (well aside from working at home which I do over vpn).
I don't see why I should expose myself to avoid being flagged.
I don't see why I should expose myself to avoid being flagged.
Don't you explain this yourself? If few PP users use VPN and a large portion of fraudsters use VPN, I think we can chalk this one up to cold math despite the is/ought problem.
I don't see why I should expose myself to avoid being flagged.
Because it isn't worth PayPal's time to cater to you. Seriously, go and use a different provider.
I know that sounds incredibly flippant, but it's the reality- PayPal will stop blocking VPNs when it is financially prudent for them to do so. Of all companies, would you expect anything different from PayPal?
The number of legitimate VPN users (among general Internet population, not HN) is miniscule...
VPN usage is increasing, not decreasing, even if as you claim, a "miniscule" group of users are using VPNs it's a dumb move by PayPal.
Many corporate environments require the use of VPNs for mobile equipment (laptops, phones, etc.). Now imagine a business that uses PayPal and requires the use of VPNs for all of their PayPal account managers.
The argument that most fraudsters use a particular technology so we should ban use of that technology is myopic at best.
VPN'ing to your office isn't going to get your account flagged. PayPal isn't inspecting network data for signs of tunneling or something. They're banning people that connect from public anonymizing VPN services because they're used for attempted fraud on their service every single day.
First, by reading the TOS. All VPNs are not prohibited, only anonymizing proxies. Second, by having logged into PayPal through a work VPN without having the account flagged.
> Many corporate environments require the use of VPNs
And if they do, you can be sure they aren't going to be using a VPN provider outside of the country to get around geolocation restrictions, or to mask the originating IP. They'll be sending their outside data _into_ a secure intranet, not back out into the general net.
Basically, the OPs only mistake isn't using a VPN, it's masking his original location, intentional or not. It's a stupid rule by PayPal, but it's not very surprising that they'd follow a "common patterns of fraud" checklist word for word. Thats what they do.
What you're saying may be PayPal's reasoning but there needs to be some pushback on that. There are very legitimate uses of VPNs, not for providing anonymity, but for tunneling your way out of hostile networks. Everyone should use a VPN when they travel so they don't have to worry about things like insecure WIFI [1] or hotels injecting ads into web pages [2]. It would be reasonable for PayPal to forbid use of anonymous VPN services, but not VPN services like Cryptoseal (a YC company) or Securetunnel (by the OpenVPN folks) which are meant for legitimate activity.
[1] Remember, not all websites uses HTTPS, and even the ones that do might still be insecure (for example, by using non-secure cookies). Plus you have to constantly check to make sure you're accessing the correct HTTPS URLs or you can be sslstrip'd. It's much easier and safer to just use a trustworthy VPN.
Sure, but if you're security concious then you're going to notice the lack of SSL. Meanwhile, you've added a VPN provider into the chain. And you still have to keep an eye on the SSL status considering that, hey, maybe they get MITM'ed?
If the site is delivered via SSL, I just can't see what a VPN provides other than anonymity, which is not security.
True, you have to trust your VPN provider, but at the end of the day you have to trust someone, including the many certificate authorities on which HTTPS relies. But a good VPN provider is way more trustworthy than the types of networks you encounter when traveling. You should still check for SSL when using a VPN but you don't need to be as vigilant about it.
This is beside the point, but VPNs really don't provide anonymity. Many VPN services log and comply with court orders. Some VPN providers claim to not keep logs but you have no way of knowing if that's true. If you need anonymity you use Tor.
Sorry, but you obviously have never run a multinational internet company, nor do you seem to know anything about corporate VPNs. Nearly every large corporation in the world uses VPNs for employee computers. The "majority" of VPN users are not people trying to "hide" illicit activity, the majority are highly security conscious or they're road-warriors on questionable hotel connections among a variety of other non-criminal use cases.
When we started icouch.me while in Shanghai, China, PayPal flagged my account and constantly locked it even though I jumped through their hoops "proving" our legitimacy and that no transactions (at that time) were actually China-originated. Just the simple fact that I logged on from China caused us to get locked out of our payments for up to weeks at a time (even though they still had no problem collecting the fees from our still-incoming transactions.) Then once I got that nonsense sorted, I started traveling more frequently for the company. So when I arrived in New York City, once again I was locked out of my account for 5 business days for "security" reasons, even though we've never had a single chargeback or any sort of security complaint or issue. Then I worked out of Texas for several weeks and once again, my account was locked. Despite the fact that we had the same US corporate bank account since 2010 (when the company was first founded.) By using a VPN, I was able to ensure my US "presence" to manage our business without PayPal's ridiculously retarded IP-detection security lockouts. I've since told paypal to go suck an egg and we use Stripe for everything.
When a company like PayPal can hold my operational funds hostage for weeks at a time with no way to clear it up expeditiously, then they just became thieves. They're making interest off of MY money while I can't access it. If they were "really" worried about security, then they'd block all transactions as well. But no, they have no problem taking money.
Interestingly, the credit bureau websites are locked to US only IPs as well. So if you have a subscription to some credit-monitoring service, they'll gladly take your money even if you can't access their services with a non-US IP address.
Those folks can all go to hell. It isn't my problem that some russian and nigeria scam artists have a tendency to cause problems. The IP address isn't the issue -- it's the security of their overall application. They're using geo-location as a shorthand for actually doing their job in securing their site.
Interestingly, I can access my US Chase bank account, my Simple account, Fidelity Investment account, Stripe from around the world without any sort of of VPN, yet somehow PayPal can't seem to figure out how to get security or customer service right.
HN is running like clockwork, I see. Soon, we'll have another post about how the Apple App Store policies screwed someone else over, complete with the usual hand-wringing and justifications from believers.
Why do people still use PayPal? This stuff is not news.
HN is running like clockwork, but it's because everyone has become an entitled developer and not an actual entrepreneur that analyzes a business decision rationally.
Use PayPal or don't. Just don't expect them to let you use it anyway you want.
Hey jackass. I am an actual entrepreneur that told PayPal to f'off AFTER they held several weeks of income hostage because I logged in from Shanghai. It's not the "entrepreneurs" that are the problem, it's the fact that a company like PayPal gets away with harming our businesses while catering to grandma's trading beanie babies. Developers and entrepreneurs alike STILL use PayPal -- at least until they themselves get burned. Stories like these are important because it should remind us to tell companies like PayPal where to go.
As far as "entitled" -- hell yes we're entitled. The developers here on HN make the apps that use the services like PayPal -- they/we have a right to demand that PayPal not suck. PayPal has a right to not listen, but we certainly have the right to complain and take our business elsewhere and as a community of spoiled, entitled, not-actual entrepreneurs we should ALL tell PayPal to pound sand.
I don't think we need mindless bitching anywhere. I think the site would benefit if more people showed up wearing their business hat and left their developer hat somewhere else.
I could be mistaken, but I thought that was the point of this forum in the first place.
I don't understand the "developer" vs "entrepreneur" distinction. It sounds condescending and patronizing. The OP isn't complaining because he's a developer, he's complaining because he had a bad experience with the service.
No matter which hat you wear, feedback is valuable. It updates my probability that I'll get screwed by PayPal a tiny bit higher.
Connecting to a payment service through an anonymizing VPN service (or your own VPN running on some server in a data center) is like walking into a bank in a ski mask. You look like the criminals, and you're likely sharing IP space with them. If you were just VPN'ing to your home or office network, I doubt that would ever arouse any suspicion.
Telling: Type "PayPal VPN" into Google and what you get are VPN services advertising how they help you sign up for PayPal when you're normally forbidden, with FAQ pages like "why is my PayPal account now terminated".
I'm extremely skeptical. Nowhere in PayPal's terms of use does it mention restricting use of a VPN. The only similar restriction I can find is against using an anonymizing proxy which seems like a reasonable restriction.
However I'll take the author at his word for a moment. Judging from the content on the author's blog, I think it's fair to assume he lives in Europe (where PayPal is regulated as a bank). Where does his VPN reside? It's certainly possible that it resides in a region that is regulated differently. One could look at this situation similarly to how YouTube, Hulu, Netflix, BBC, etc, block by region; not because they want to but because they have to. In the case of the mentioned sites, because of licensing terms, and in PayPal's case, because of financial regulations.
Pretty sure they interpret a VPN as an anonymizing proxy. Just because you paid for it or it's through your business, it still shows PayPal a different IP address than your true location. Intent isn't the issue, as they both look alike.
This is somewhat a flawed argument on Paypal's part. If a user chooses to obscure their connection via a VPN for security purposes but has supplied the appropriate identification needs to Paypal, what is the problem here?
Paypal like any other big corporation has lost touch with its customer base. Its been that way for a long time now, someone needs to come in and beat Paypal in its own territory. Payment providers like Square are still the small time, they're not in countries like Australia or New Zealand or any other first world country that needs some Paypal competition.
I'd imagine it's yet another level of fraud prevention. IP information can be quite useful. If a customer does something that limit's PayPal's ability to limit fraud, then PayPal cuts them.
I agree this is hostile and not friendly. But nor is dealing with fraud. I dislike PayPal and avoid them as much as possible, but it's hardly an easy task and I'm not sure other people would do vastly better if they had to operate with the same parameters.
It's kind of a steep move terminating his account. My Facebook account was almost hacked once because someone from an overseas IP tried logging in to my account. Facebook waited for me to login via my Australian IP address and alerted me to he fact and asked if it was me, I said no and I assume they blocked that IP. If security is such an issue, why couldn't Paypal ask the account owner if it was himself behind a VPN and to provide some identification documents?
I remember a little while ago having to supply some identifications documents to Paypal (scan of my passport, scan of my assigned credit card with most of the numbers blacked out, etc). If an account owner is willing to provide that information and is say from a country like the United States, Australia or the UK, then Paypal should lower their suspicions.
I can see where Paypal is coming from here. IP scanning is one of many criteria that determines if a user is potentially fraudulent (I've used Maxmind fraud protection before and it operates with similar criteria).
>This is somewhat a flawed argument on Paypal's part. If a user chooses to obscure their connection via a VPN for security purposes but has supplied the appropriate identification needs to Paypal, what is the problem here?
Well, they don't want people to use VPNs/tunneling and such because they are being used time and again to mask the country of origin, IP etc. They can even block your account for logging in from another country that you're visiting (they've done that to me and ask for photo ids and such).
It's not about "security" or lack thereof, it's about stopping certain kinds of fraud and keeping certain tabs.
(Sure, a VPN may protect from other kinds of fraud, e.g MITM attacks and identity theft. But then again, most actual PayPal customers don't use VPNs, whereas lots of identity theft and fraud guys do).
>they're not in countries like Australia or New Zealand or any other first world country that needs some Paypal competition
I guess that's reason why Paypal seems to endure beyond reason in spite of repeatedly showing the middle finger to customers. We in the US are relatively well off in terms of Paypal alternatives, but this is simply not true for a lot of other places. Plus Paypal has entered the status of being the 'default' for a vast majority of the non tech populace.
The good thing is, hackers are often the canary in the coal mine in terms of signaling future preferences of the masses, so we can hope Paypal will either reform itself, or die.
Paypal is crap! It's a wakeup call for you to move on to another payment service. They froze my account 4 months ago with over $1k in it. Reason? Because I had a donation button on my site, and my site wasn't a registered non-profit organization. Well no shit, it's a hobby/fan site and I need a way to pay for my servers and such. Not to mention, I did pay taxes on those so call "donation". Sorry for the rant but just move on; you can't win against their stellar dispute department.
Would your bank let you walk in and withdraw $10,000 from your own account with a ski mask or panty hose over your head? Even if you knew your account number and password?
Because the experiment ends with explaining to a few fine officers of the law that no, you weren't trying to rob the bank, you were just doing an experiment.
Or plain not being let into the bank. Most banks (in the UK at least) will not let people covering their faces into the bank.
It's like the gun control argument. A microscopic percentage of everyone who has ever purchased an assault weapon has ever committed a violent act. Regardless, the argument is that the potential harm makes banning necessary.
Exactly. PayPal would rather just ban the "thing" rather than try to actually do their jobs and solve the security issues. The IP address shouldn't matter -- it's the data that comes from the IP. They want to ban "guns" as a shorthand for actually trying to catch criminals.
Is it possible that they are using a VPN service (as opposed to self hosted) and other users of said VPN service have committed fraud and they just drew a bad card in the IP pool pot luck?
PayPal is (still) not evil. It charges too much, and does some shitty things, like all companies.
It's ridiculous to jump to conclusions based off a blog post that doesn't even post a copy (redacted if necessary) of the allegedly offending communication.
PayPal is evil. They're not evil because of what they charge, they're evil because they treat their customers with utter disregard and contempt.
It appears there's an internal lottery that all their customers play without their knowledge. If your numbers come up, the fuckup fairy will come visit your account and you will have little to no recourse.
If you have a website dedicated to chronicling just how badly you suck ( http://www.paypalsucks.com ) it probably means you're doing something very wrong.
Or it means you are a large company, or are in some way interesting. Google returns many hits for "Apple sucks," and "Amazon sucks," and "Linux sucks."
Seriously, if you don't have pages devoted to how you suck, it means you haven't done anything noteworthy
There's a difference between doing something noteworthy and having some irate customers, and doing something noteworthy and almost routinely actively fucking over your customers. One's inevitable, the other's just unnecessary.
You're right that we shouldn't condemn [company, person] because somebody made a blog post after [company, person] did something that upset them. But, you've taken on a big job sticking up for PayPal. It doesn't take a Google-fu master to find copious examples of PP behaving inexcusably.
Until I can walk into my local bank branch (or any of the hundreds of currency conversion stalls that dot London) and ask for a couple hundred satoshis, or deposit bitcoins direct into my bank account, bitcoin isn't ready to be a legitimate alternative currency, let alone an alternative to payment processors such as Paypal.
Would you care to explain why? Cash is really useful, lots of little places don't take cards and couldn't if they wanted to. As much as I despise it, the vagueries of "I owe you four fifty for lunch but all I have is a ten, so take the ten and that'll cover pizza next week." are a nice part of my social interaction with my friends. Electronic transfers (either bank account to bank account or paypal etc.) are useful for stuff >£20 but I can't see myself splitting lunch and going through the (understandably) rigorous security checks my bank enforces to pay a couple of pounds (says the guy who once wrote a cheque for a copy of the i[1] (I'd been given a cheque book by my bank and cheques are novel to me, not having been old enough for them to be anything other than that thing grandparents send you that you can swap for money)).
Bank tellers are useful in that they are a human being with whom I can discuss things about my account with face-to-face, which is useful when something's gone belly-up with their systems and you need a real person who can see you're also a real person and hit the damn thing a few times until it works.
Finally, I'm still going to need a proper bank account for things like credit, overdrafts, standing orders of rent and such to people who haven't moved over to bitcoin yet, not to mention paying my taxes and taking my earnings from companies that pay in pounds sterling, US dollars, euros or other traditional currencies. It only makes sense that instead of holding a mass of bitcoins, that my bank (nominally HSBC for myself) holds a much larger mass and allows me to make payments in BTC much like I would in any of the hundreds I already can. If I wanted to hold BTC myself, then I could open an account in BTC much like I could open a EUR or USD account now.
[1] The i is a 20 pence newspaper by the makers of the Independent. Prior to moving to London where if you're not paying attention you can amass fifteen copies of the Evening Standard whilst walking across the river, I tended to buy a copy of the i every day going into college because it was something I could read entirely whilst eating breakfast and tended to avoid the fluff I noticed in larger papers on slow news days.
Yup, can't wait to not see these articles on PayPal any more. Granted, we'll probably see another type of article start to appear with frequency (e.g. I lost my wallet).
1. None of the ~ two dozen websites I've bought from in the past year supports it (and those are already technical shops). And most importantly, Amazon doesn't support it.
2. None of the people I've wanted to send money to have it
3. Never heard of it; why would I trust it? (well, ok, they have some well-known clients, so that gives them some level of trustworthiness)
I am aware it's a chicken/egg problem, but as a user, I don't care.
If your true IP is obscured by a VPN this is just a red flag for PayPal or any other payment processor. Especially if you happen to share the same IP as someone committing actual fraud - which is very much likely if you are using public proxies. Very few legitimate customers pay over VPN.
Do not use VPNs if you do not want to be flagged or blocked.
EDIT1: In response the comments, no I am not sarcastic at all. The number of legitimate VPN users (among general Internet population, not HN) is miniscule and does not justify the financial risks involved. If you are using VPN you are seen as hiding something and flagging/blocking you from sensitive transactions is an obvious response.
EDIT2: I am talking about public VPNs that can be anonymously abused by anyone - where you'd be likely sharing IPs with criminals. By all indications that's what OP was using if he wanted to hide himself. If you use VPN from work or coffeeshop you'll be identified by some innocuous-looking residential / corporate IPs.