 | |
| Type of business | Public |
|---|---|
Type of site
| Financial |
| Available in | Multilingual |
| Traded as |
|
| Founded | December 1998 (as Confinity) November 1999 (as X.com) |
| Predecessor(s) | Confinity, X.com |
| Headquarters | 2211 North First Street San Jose, California, U.S. (corporate headquarters) Omaha, Nebraska, U.S. (operative center) |
| Coordinates | 37.3770°N 121.9226°WCoordinates: 37.3770°N 121.9226°W |
| Area served | Almost worldwide |
| Founder(s) | |
| Key people |
|
| Industry | Financial services |
| Products | Credit cards, payment systems |
| Revenue |  US$17.772 billion (2019) |
| Operating income | US$2.719 billion (2019) |
| Net income | US$2.459 billion (2019) |
| Total assets | US$51.333 billion (2019) |
| Total equity | US$16.929 billion (2019) |
| Employees | c. 21,800 (Dec. 2018) |
| Parent | eBay (2002–2015) |
| Divisions |
|
| Subsidiaries |
|
| Website | www |
| Alexa rank | 84 (Jan. 2020) |
| Advertising | No |
| Registration | Yes |
| Users | 305 million (2019) |
| Launched | December 1998 |
| Current status | Active |
| Native client(s) on | Android iOS Windows |
| Written in | C++, JavaScript (as Node.js), Python |
PayPal Holdings, Inc. is an American company operating a worldwide online payments system that supports online money transfers and serves as an electronic alternative to traditional paper methods like checks and money orders. The company operates as a payment processor for online vendors, auction
sites, and many other commercial users, for which it charges a fee in
exchange for benefits such as one-click transactions and password
memory.
Established in 1998 as Confinity, PayPal had its initial public offering in 2002, and became a wholly owned subsidiary of eBay later that year. eBay spun off PayPal in 2015.
The company ranked 222nd on the 2018 Fortune 500 of the largest United States corporations by revenue.
History
At a 2019 World Economic Forum panel in Davos,
founder Luke Nosek stated that PayPal’s initial mission was to "create a
global currency that was independent of interference by these, you
know, corrupt cartels of banks and governments that were debasing their
currencies". Nosek said this mission ultimately failed because of
investor pressure to release a product as soon as possible.
Early history
PayPal was established in December 1998 as Confinity, a company that developed security software for handheld devices. PayPal was founded by six people: Max Levchin, Peter Thiel, Luke Nosek, Ken Howery, Yu Pan and Russel Simmons.
PayPal was developed and launched as a money transfer service at
Confinity in 1999, funded by John Malloy from BlueRun Ventures.
In March 2000, Confinity merged with X.com, an online banking company founded by Elon Musk. Musk was optimistic about the future success of the money transfer business Confinity was developing. Musk and then-president and CEO of X.com, Bill Harris, disagreed on this point and Harris left the company in May 2000.
In October of that year, Musk made the decision that X.com would
terminate its other Internet banking operations and focus on the PayPal
money service. In the same month, Elon Musk was replaced by Peter Thiel as CEO of X.com. The X.com company was then renamed PayPal in 2001, and expanded rapidly throughout the year until company executives decided to take PayPal public in 2002. Paypal's IPO listed under the ticker PYPL at $13 per share and ended up generating over $61 million.
eBay subsidiary (2002–2014)
Shortly after PayPal's IPO, the company was acquired by eBay on October 3, 2002 for $1.5 billion, with a valuation of over $23 a share, or 77% above the IPO price.
More than 70 percent of all eBay auctions accepted PayPal payments, and
roughly 1 in 4 closed auction listings were transacted via PayPal.
PayPal became the payment method used by a majority of eBay users (it
was also the default choice), and the service competed with eBay's
subsidiary Billpoint, as well as Citibank's c2it, Yahoo!'s PayDirect, Google Checkout, and Western Union's BidPay service, all of which closed in subsequent years.
PayPal acquired the VeriSign payment solution in 2005 to expand its e-commerce business and provide added security support. In 2007, PayPal announced a partnership with MasterCard
that led to the development and launch of the PayPal Secure Card
service, a software that allows customers to make payments on websites
that do not accept PayPal directly by generating a unique, single-use
MasterCard number for each checkout. By the end of 2007, the company generated $1.8 billion in revenue.
In January 2008, PayPal acquired Fraud Sciences, a privately held
Israeli start-up company with expertise in online risk tools, for $169
million, in order to enhance PayPal's fraud management systems. In November 2008, the company acquired Bill Me Later, an online payments company offering transactional credit at over 9000 online merchants in the US.
PayPal revenues for Q1 2009 were $643 million, up 11 percent year over
year. 42 percent of revenues in Q1 2009 were from international markets.
PayPal's Total Payment Volume (TPV), the total value of transactions in
Q1 2009 was nearly $16 billion, up 10 percent year over year.
By 2010, PayPal had over 100 million active user accounts in 190 markets through 25 different currencies. In July 2011, fourteen alleged members of the Anonymous hacktivist group were charged with attempting to disrupt PayPal's operations. The denial of service attacks occurred in December 2010, after PayPal stopped processing donations to WikiLeaks. On December 5, 2013, 13 of the PayPal 14 pleaded guilty to misdemeanor and felony charges related to the attacks.
The company continued to build its Merchant Services division, providing e-payments
for retailers on eBay. In 2011, PayPal announced that it would begin
moving its business offline so that customers can make payments via
PayPal in stores. In August 2012, the company announced its partnership with Discover Card to allow PayPal payments to be made at any of the 7 million stores in Discover Card's network. By the end of 2012, PayPal's total payment volume processed was US$145,000,000,000. and accounted for 40% of eBay's revenue, amounting to US$1,370,000,000 in the 3rd quarter of 2012.
In 2013, PayPal acquired IronPearl, a Palo Alto startup offering engagement software, and Braintree, a Chicago-based payment gateway, to further product development and mobile services.[51] In June 2014 David Marcus announced he was leaving his role as PayPal President; Marcus joined PayPal in August 2011 after its acquisition of Zong, of which he was the founder and CEO. David Marcus succeeded Scott Thompson as president, who left the role to join Yahoo. PayPal announced that Marcus would be succeeded by Dan Schulman, who previously served as CEO of Virgin Mobile and Executive vice president of American Express.
Spin-off from eBay (2014–present)
It
was announced on September 30, 2014, that eBay would spin off PayPal
into a separate publicly traded company, a move demanded in 2013 by
activist hedge fund magnate Carl Icahn. The spin-off was completed on July 18, 2015. Dan Schulman is the current President and CEO, with former eBay CEO John Donahoe serving as chairman.
On Jan 31, 2018 eBay announced that, "After the existing eBay-PayPal
agreement ends in 2020, PayPal will remain a payment option for shoppers
on eBay, but it won’t be prominently featured ahead of debit and credit
card options as it is today. PayPal will cease to process card payments
for eBay at that time."
On July 1, 2015, PayPal announced that it was acquiring digital money transfer company Xoom Corporation.
PayPal spent $25 a share in cash to acquire the publicly traded Xoom,
or about $1.09 billion. The deal was closed in the fourth quarter of
2015. The move strengthened PayPal’s international business, giving it
access to Xoom’s 1.3 million active U.S. customers that sent about $7
billion in the 12 months ending on March 31, to people in 37 countries.
On September 1, 2015, PayPal launched their peer-to-peer
payment platform "PayPal.Me", a service that allows users to send a
custom link to request funds via text, email, or other messaging
platforms. Custom links are set to be structured as PayPal.me/username/amountrequested. PayPal.Me was launched in 18 countries including United States, United Kingdom, Germany, Australia, Canada, Russia, Turkey, France, Italy, Spain, Poland, Sweden, Belgium, Norway, Denmark, Netherlands, Austria and Switzerland.
PayPal had 170 million users, as of September 2015, and the focus of
PayPal.Me was to create a mobile-first user experience that enables
faster payment sharing than PayPal's traditional tools.
On May 17, 2018, PayPal agreed to purchase Swedish payment processor iZettle
for $2.2 billion. This is PayPal's largest acquisition to date and the
company claims that it is the in-store expertise and digital marketing
strength that will complement its own online and mobile payment
services.
On March 19, 2019, PayPal announced their partnership with Instagram as part of the company's new checkout feature, "Checkout on Instagram".
In June 2019, PayPal reported that Chief Operating Officer Bill
Ready would be leaving the company at the end of the year. In December
2019, it was announced that Ready would become the new commerce chief at
Google.
Finances
For
the fiscal year 2017, PayPal reported earnings of US$1.795 billion, with
an annual revenue of US$13.094 billion, an increase of 20.8% over the
previous fiscal cycle. PayPal's shares traded at over $55 per share, and
its market capitalization was valued at over US$98.2 billion in October
2018.
| Year | Revenue in mil. USD$ |
Net income in mil. USD$ |
Total Assets in mil. USD$ |
Price per Share in USD$ |
Employees |
|---|---|---|---|---|---|
| 2012 | 5,662 | 778 |
|
|
|
| 2013 | 6,727 | 955 | 19,160 |
|
|
| 2014 | 8,025 | 419 | 21,917 |
|
|
| 2015 | 9,248 | 1,228 | 28,881 |
|
16,800 |
| 2016 | 10,842 | 1,401 | 33,103 | 38.26 | 18,100 |
| 2017 | 13,094 | 1,795 | 40,774 | 55.86 | 18,700 |
Offices
PayPal Operations Center and main office in Omaha, Nebraska.
PayPal's corporate headquarters are located in the North San Jose Innovation District of San Jose, California, at North First Street campus. The company's operations center is located in Omaha, Nebraska, which was opened in 1999. Since July 2007, PayPal has operated across the European Union as a Luxembourg-based bank. The PayPal European headquarters are located in Luxembourg and the international headquarters are in Singapore. PayPal opened a technology center in Scottsdale, Arizona in 2006, and a software development center in Chennai, India in 2007. In October 2007, PayPal opened a data service office on the north side of Austin, Texas, and also opened a second operations center in La Vista, Nebraska that same year. In 2011, joining similar customer support operations located in Berlin, Germany; Chandler, Arizona; Dublin and Dundalk, Ireland; Omaha, Nebraska; and Shanghai, China; PayPal opened a second customer support center in Kuala Lumpur, Malaysia, and began the hiring process. In 2014, PayPal opened a new global center of operations in Kuala Lumpur.
Services
As of 2020,
PayPal operates in 202 markets and has 305 million active, registered
accounts. PayPal allows customers to send, receive, and hold funds in 25
currencies worldwide.
PayPal's services allow people to make financial transactions online by granting the ability to transfer funds electronically between individuals and businesses.
Through PayPal, users can send or receive payments for online auctions
on websites like eBay, purchase or sell goods and services, or donate
money or receive donations. It is not necessary to have a PayPal account
to use the company's services. PayPal account users can set currency conversion option in account settings.
From 2009 to 2016, PayPal operated Student Accounts, allowing
parents to set up a student account, transfer money into it, and obtain a
debit card for student use. The program provided tools to teach how to
spend money wisely and take responsibility for actions. PayPal discontinued Student Accounts in August 2016.
In November 2009, PayPal opened its platform, allowing other
services to get access to its code and to use its infrastructure in
order to enable peer-to-peer online transactions.
In 2007, PayPal acquired the online credit product Bill Me Later,
Inc., which has since been rebranded as PayPal Credit, and provided
services for Comenity Capital Bank, the lender of PayPal Credit
accounts. Founded in 2000, Bill Me Later is headquartered in Timonium,
Maryland, with additional offices in Hunt Valley, Maryland; Chandler,
Arizona; and San Francisco, California. PayPal Credit offers shoppers
access to an instant online revolving line of credit at thousands of
vendors that accept PayPal, subject to credit approval. PayPal Credit
allows consumers to shop online in much the same way as they would with a
traditional credit card. The rebranding of Bill Me Later as PayPal
Credit also means that consumers can use PayPal Credit to fund
transactions virtually anywhere PayPal is accepted. In 2015 PayPal agreed that PayPal Credit would pay a $25 million fine to settle a complaint filed in Federal Court by the Consumer Financial Protection Bureau.
The PayPal app is available online or at the iTunes App Store and Google Play. One year after acquiring Braintree,
PayPal introduced its "One Touch" service, which allows users to pay
with a one-touch option on participating merchants websites or apps.
On November 28, 2011, PayPal reported Black Friday
brought record mobile engagement including a 538% increase in global
mobile payment volume when compared with Black Friday 2010.
In 2012, the company launched "PayPal Here", a small business mobile payment system that includes a combination of a free mobile app and a small card-reader that plugs into a smart phone.
PayPal launched an updated app for iOS and Android
in 2013 that expanded its mobile app capabilities by allowing users to
search for local shops and restaurants that accept PayPal payments,
order ahead at participating venues, and access their PayPal Credit
accounts (formerly known as Bill Me Later).
Business model evolution
PayPal's success in users and volumes was the product of a three-phase strategy described by former eBay CEO Meg Whitman:
"First, PayPal focused on expanding its service among eBay users in the
US. Second, we began expanding PayPal to eBay's international sites.
And third, we started to build PayPal's business off eBay."
Phase 1
In the
first phase, payment volumes were coming mostly from the eBay auction
website. The system was very attractive to auction sellers, most of
which were individuals or small businesses that were unable to accept
credit cards, and for consumers as well.
In fact, many sellers could not qualify for a credit card Merchant
account because they lacked a commercial credit history. The service
also appealed to auction buyers because they could fund PayPal accounts
using credit cards or bank account balances, without divulging credit
card numbers to unknown sellers. PayPal employed an aggressive marketing
campaign to accelerate its growth, depositing $10 in new users' PayPal
accounts.
Phase 2
Until
2000, PayPal's strategy was to earn interest on funds in PayPal
accounts. However, most recipients of PayPal credits withdrew funds
immediately. Also, a large majority of senders funded their payments
using credit cards, which cost PayPal roughly 2% of payment value per
transaction.
To solve this problem, PayPal tailored its product to cater more
to business accounts. Instead of relying on interests earned from
deposited funds, PayPal started relying on earnings from service
charges. They offered seller protection to PayPal account holders,
provided that they comply with reimbursement policies. For example,
PayPal merchants are either required to retain a traceable proof of
shipping to a confirmed address or to provide a signed receipt for items
valued over $750.
Phase 3
After
fine-tuning PayPal's business model and increasing its domestic and
international penetration on eBay, PayPal started its off-eBay strategy.
This was based on developing stronger growth in active users by adding
users across multiple platforms, despite the slowdown in on-eBay growth
and low-single-digit user growth on the eBay site. A late 2003
reorganization created a new business unit within PayPal—Merchant
Services—to provide payment solutions to small and large e-commerce
merchants outside the eBay auction community. Starting in the second
half of 2004, PayPal Merchant Services unveiled several initiatives to
enroll online merchants outside the eBay auction community, including:
- Lowering its transaction fee for high-volume merchants from 2.2% to 1.9% (while increasing the monthly transaction volume required to qualify for the lowest fee to $100,000)
- Encouraging its users to recruit non-eBay merchants by increasing its referral bonus to a maximum of $1,000 (versus the previous $100 cap)
- Persuading credit card gateway providers, including CyberSource and Retail Decisions USA, to include PayPal among their offerings to online merchants.
- Hiring a new sales force to acquire large merchants such as Dell, Apple's iTunes, and Yahoo! Stores, which hosted thousands of online merchants
- Reducing fees for online music purchases and other "micropayments"
- Launching PayPal Mobile, which allowed users to make payments using text messaging on their cell phones
Global reach
PayPal can be used in more than 200 countries/regions.
Different countries have different conditions: Send only (Package Service allows sending only, valid in 97 countries), PayPal Zero
(package suggests the possibility of enrollment, entry, and withdrawal
of funds in foreign currency, but the user can not hold the balance
PayPal account, operates in 18 countries), SRW Send - Receive - Withdrawal
(the possibility of enrollment, input-output and the ability to keep
your PayPal account balance in the currency and to transfer to the card
when the user sees fit, operates in 41 countries) and Local Currency (SRW plus opportunity to conduct transactions in local currency, 21 countries).
China
In July 2017, PayPal announced a partnership with Baidu,
to allow the Chinese firm’s 100 million mobile wallet users to make
payments to PayPal’s 17 million merchants through the Baidu service.
Crimea
In January 2015, PayPal ceased operations in Crimea in compliance with international sanctions against Russia and Crimea.
India
As of March 2011, PayPal has made changes to the User Agreement for Indian users to comply with Reserve Bank of India regulations.
The per transaction limit had been set to USD $3,000, since October 14,
2011. However, on July 29, 2013, PayPal increased the per transaction
limit to USD $10,000. This brings the per transaction limit for India in line with the restrictions imposed by PayPal on most other countries.
PayPal has disabled sending and receiving personal payments in India, thus forcing all recipients to pay a transaction fee.
PayPal plans to make India an incubation center for the company's
employee engagement policies. In 2012, PayPal hired 120 people for its
offices in Chennai and Bangalore.
On 8 November 2017, PayPal launched domestic operations under
PayPal Payments Private Limited and now provides digital payment
solutions for merchants and customers in India.
Israel and Palestinian Territories
PayPal is available in Israel but is not available in the Palestinian territories. Nor can Palestinians working in the West Bank or Gaza access it but Israelis living in settlements in the West Bank can use PayPal. This discrepancy has prompted Palestinian tech companies to seek a policy change from PayPal.
Japan
In late
March 2010, new Japanese banking regulations forced PayPal Japan to
suspend the ability of personal account holders registered in Japan from
sending or receiving money between individuals and as a result are now
subject to PayPal's business fees on all transactions.
Pakistan
In Pakistan, users can use Xoom, a money transfer service owned by PayPal. In October 2018, Pakistan's government used Xoom to help crowdsource funds for the purpose of building two dams.
Turkey
Eight
years after the company first started operating in the country, Paypal
ceased operations in Turkey on 6 June 2016 when Turkish financial
regulator BDDK denied it a payments license. The regulators had demanded
that PayPal's data centers be located inside Turkey to facilitate
compliance with government and court orders to block content and to
generate tax revenue. PayPal said that the closure will affect tens of
thousands of businesses and hundreds of thousands of consumers in
Turkey.
Sri Lanka
In January 2017, PayPal team scheduled to visit Sri Lanka mid January to re-establish links.
PayPal Giving Fund
PayPal Giving Fund is a registered charity supported by Paypal that streamlines donations to nonprofit organizations.
Digital marketing with PayPal
PayPal launches different marketing activities in various channels and emphasizes that consumers can use it in different ways. Paypal's marketing includes the TV commercials, outdoor advertising, Facebook, and display advertisement.
PayPal provides free analytics to traders about the ways that consumers utilise online payments.
By the free tracking service, PayPal assists traders to target the
consumers. PayPal's code gathers the consumer information which can be
installed on the trader's website. Both PayPal and traders get benefit from the free service.
PayPal cooperates with "Synchrony Financial" and provides a financial service to PayPal Cashback Mastercard, which offers 2% return cash to customers who are shopping online or on the physical stores by using PayPal. PayPal’s cash back financial service promotes the number of potential customers.
Apple allows PayPal as a mode of payment for App Store, Apple Music, iTunes, and Apple Books.
PayPal can increase usage by the platform of Apple. In addition, PayPal
gets revenue from Apple services especially from App Store. Customers can use PayPal to purchase by connecting their PayPal payment system to Apple ID accounts.
Regulation
Thiel, a founder of PayPal, has stated that PayPal is not a bank because it does not engage in fractional-reserve banking. Rather, PayPal's funds that have not been disbursed are kept in commercial interest-bearing checking accounts.
In the United States, PayPal is licensed as a money transmitter, on a state-by-state basis.
But state laws vary, as do their definitions of banks, narrow banks,
money services businesses, and money transmitters. Although PayPal is
not classified as a bank, the company is subject to some of the rules
and regulations governing the financial industry including Regulation E consumer protections and the USA PATRIOT Act. The most analogous regulatory source of law for PayPal transactions comes from peer-to-peer (P2P) payments using credit and debit cards.
Ordinarily, a credit card transaction, specifically the relationship
between the issuing bank and the cardholder, is governed by the Truth in Lending Act
(TILA) 15 U.S.C. §§ 1601-1667f as implemented by Regulation Z, 12
C.F.R. 226, (TILA/Z). TILA/Z requires specific procedures for billing
errors, dispute resolution, and limits cardholder liability for
unauthorized charges. Similarly, the legal relationship between a debit cardholder and the issuing bank is regulated by the Electronic Funds Transfer Act
(EFTA) 15 U.S.C. §§ 1693-1693r, as implemented by Regulation E, 12
C.F.R. 205, (EFTA/E). EFTA/E is directed at consumer protection and
provides strict error resolution procedures. However, because PayPal is a
payment intermediary and not otherwise regulated directly,
TILA/Z and EFTA/E do not operate exactly as written once the
credit/debit card transaction occurs via PayPal. Basically, unless a
PayPal transaction is funded with a credit card, the consumer has no
recourse in the event of fraud by the seller.
In 2008, PayPal Europe was granted a Luxembourg banking license,
which, under European Union law, allows it to conduct banking business
throughout the EU.
It is therefore regulated as a bank by Luxembourg's banking supervisory
authority, the Commission de Surveillance du Secteur Financier (CSSF). All of the company's European accounts were transferred to PayPal's bank in Luxembourg in July 2007. Prior to this move, PayPal had been registered in the United Kingdom as PayPal (Europe) Ltd, an entity which was licensed as an Electronic Money Issuer with the UK's Financial Services Authority (FSA) from 2004. This ceased in 2007, when the company moved to Luxembourg.
In India,
as of January 2010, PayPal has no cross-border money transfer
authorization. In The New York Times article "India's Central Bank Stops
Some PayPal Services", Reserve Bank of India spokesman Alpana
Killawalla stated: "Providers of cross-border money transfer service
need prior authorization from the Reserve Bank under the Payment and
Settlement Systems Act, PayPal does not have our authorization."
PayPal is not listed in the "Certificates of Authorisation issued by
the Reserve Bank of India under the Payment and Settlement Systems Act,
2007 for Setting up and Operating Payment System in India".
PaisaPay is an Indian sister service to PayPal, and is also owned by eBay. PaisaPay makes possible payments from abroad by PayPal account holders to Indian sellers on eBay.in.
In Australia, PayPal is licensed as an authorised deposit-taking institution (ADI) and is thus subject to Australian banking laws and regulations.
In Singapore, PayPal is the holder of a stored value facility that does not require the approval of the Monetary Authority of Singapore.
Safety and protection policies
The
PayPal Buyer Protection Policy states that the customer may file a
buyer complaint if he or she did not receive an item or if the item he
or she purchased was significantly not as described. The customer can
open a dispute within 180 days (for registered UK residents 180 days,
changed 14 June 2014) from the date of payment and escalate it to a
claim within 20 days from opening the dispute. If the buyer used a
credit card, he or she might get a refund via chargeback
from his or her credit-card company. However, in the UK, where such a
purchaser is entitled to specific statutory protections (that the credit
card company is a second party to the purchase and is therefore equally
liable in law if the other party defaults or goes into liquidation)
under Section 75 Consumer Credit Act 1979, the purchaser loses this
legal protection if the card payment is processed via PayPal.
Also, the Financial Ombudsman Service position is that section 75
protection does not apply where PayPal or any eMoney service becomes
involved in the credit card transaction. This leaves consumers with no
recourse to pursue their complaint with the Financial Ombudsman Service.
They only have recourse with the courts. However, the key issues which
determine the applicability of section 75 are identified very clearly in
Office of Fair Trading v Lloyds TSB Bank Plc and others [2006] EWCA Civ
268 7 and the Bank of Scotland v Alfred Truman (a firm) [2005] [EWHC]
583 (QB). This is a legal authority that section 75 protection does
exist where one has paid on credit card for a product, via an eMoney
service.
According to PayPal, it protects sellers in a limited fashion via
the Seller Protection Policy. In general, the Seller Protection Policy
is intended to protect the seller from certain kinds of chargebacks or
complaints if the seller meets certain conditions including proof of
delivery to the buyer. PayPal states the Seller Protection Policy is
"designed to protect sellers against claims by buyers of unauthorized
payments and against claims of non-receipt of any merchandise". The
policy includes a list of "Exclusions" which itself includes "Intangible
goods", "Claims for receipt of goods 'not as described'", and "Total reversals over the annual limit".
There are also other restrictions in terms of the sale itself, the
payment method and the destination country the item is shipped to
(simply having a tracking mechanism is not sufficient to guarantee the
Seller Protection Policy is in effect). The PayPal Seller Protection
Policy does not provide the additional consumer protection afforded by
UK consumer legislation (e.g., Sale of Goods Act) and in addition, it
cannot be enforced in the Courts because PayPal operates from
Luxembourg, outside all three of the UK legal jurisdictions.
Security
Security token
In early 2006, PayPal introduced an optional security key as an additional precaution against fraud.
A user account tied to a security key has a modified login process.
Account holders enters their login ID and password as normal but are
then prompted to enter a six-digit code provided by a credit card sized
hardware security key or a text message sent to the account holder's
mobile phone. For convenience, users may append the code generated by
the hardware key to their password in the login screen. This way they
are not prompted for it on another page. This method is required for
some services, such as when using PayPal through the eBay application on
iPhone.
This two-factor authentication
is intended to make it difficult for an account to be compromised by a
malicious third party without access to the physical security key,
although it does not prevent so-called Man in the Browser
(MITB) attacks. However, the user (or malicious third party) can
alternatively authenticate by providing the credit card or bank account
number listed on their account. Thus the PayPal implementation does not
offer the security of true two-factor authentication.
MTAN
It is also possible to use a mobile phone to receive an mTAN (Mobile Transaction Authentication Number) via SMS. Use of a security code that is sent to the account holder's mobile phone is currently free.
Fraud
As early as 2001, PayPal had substantial problems with online fraud,
especially international hackers who were hacking into PayPal accounts
and transferring small amounts of money out of multiple accounts.
Standard solutions for merchant and banking fraud might use government
criminal sanctions to pursue the fraudsters. But with PayPal losing
millions of dollars each month to fraud while experiencing difficulties
with using the FBI
to pursue cases of international fraud, PayPal developed a private
solution: a "fraud monitoring system that used artificial intelligence
to detect potentially fraudulent transactions. ... Rather than treating
the problem of fraud as a legal problem, the company treated it as a risk management one."
150,000 PayPal cards frozen
In
2015, 150,000 Spanish card holders had their funds frozen in an
apparent fraud case involving a PayPal service provider, Younique Money,
which was the de facto administrator of the cards. Previously, PayPal
had charged €15 to all its card users without authorization (150,000
users). As of March 2015 most funds had not been returned.
Criticism
In 2003, PayPal voluntarily ceased serving as a payment intermediary
between gambling websites and their online customers. At the time of
this cessation, it was the largest payment processor for online gambling
transactions. In 2010, PayPal resumed accepting such transactions, but
only in those countries where online gambling is legal, and only for
sites which are properly licensed to operate in said jurisdictions.
If an account is subject to fraud or unauthorized use, PayPal
puts the "Limited Access" designation on the account. PayPal has had
several notable cases in which the company has frozen the account of
users such as Richard Kyanka, owner of the website Something Awful, in September 2005, Cryptome in March 2010, or April Winchell, the owner of Regretsy, in December 2011. The account was reinstated, and PayPal apologized and donated to her cause.
In September 2010, PayPal froze the account of a Minecraft developer, Markus Persson.
Persson stated publicly that he had not received a clear explanation of
why the account was frozen, and that PayPal was threatening to keep the
money if they found anything wrong. His account contained around
€600,000.
PayPal's partner MasterCard ceased taking donations to WikiLeaks
in 2010, and PayPal also suspended, and later permanently restricted,
payments to the website after the U.S. State Department deemed WikiLeaks
activities as illegal. Online supporters and activists retaliated by
subjecting PayPal and MasterCard, along with other companies, to
coordinated cyber attacks.
In February 2011 PayPal unbanned the account of a website that supports Iraq War resisters after it had enough information to fulfill its know your customer guidelines. The Chelsea Manning Support Network claimed the backdown was a reaction to a petition to the company to reinstate the account.
In May 2013, PayPal declined to pay a reward offered in its Bug Bounty Program to a 17-year-old German student who had reported a cross-site scripting flaw on its site.
The company wrote that the vulnerability had been previously reported,
and chastised the youth for disclosing the issue to the public, but,
uniquely, sent him a "Letter of recognition" for the discovery.
In August 2013, entrepreneurs who had used PayPal to collect the funds they raised on crowdfunding platforms like Kickstarter and Indiegogo reported difficulty in being able to withdraw the money. Most notable victims are Ouya, GlassUp (a rival to Google Glass), and Mailpile.
In May 2014 PayPal blocked the account of a Russian human rights
organisation "RosUznik", which supported political prisoners arrested at
Bolotnaya Square case.
As of January 2015, a class-action lawsuit against PayPal has been filed in Israel,
claiming that they arbitrarily freeze accounts and hold funds for up to
180 days without paying interest and thereby directly profit from it.
The lawsuit requests that PayPal be declared a monopoly and thus
regulated accordingly.
In April 2015 The Guardian reported PayPal blocking the account of London-based human rights group Justice for Iran.
In May 2015 PayPal blocked an account intended to raise money for the distribution of Boris Nemtsov's report "Putin. War".
The explanation by PayPal was that "PayPal does not offer the
opportunity to use its system for collecting funds to finance the
activities of political parties or for political aims in Russia", though
PayPal's Acceptable Use Policy does not mention financing for political
goals. Non-governmental organization Freedom House issued a statement that "PayPal should immediately lift this ban, to help, rather than hinder, press freedom in Russia."
By 2016, ConsumerAffairs had received over 1,200 consumer complaints relating to PayPal policies. Consumers have also launched numerous anti-PayPal Facebook sites and Twitter accounts to air their complaints.
In February 2017, PayPal froze the account of News Media Canada, a Canadian trade association, in response to a payment from The Reminder, a Flin Flon, Manitoba community newspaper,
intended to cover the fee for the Reminder's submission of articles for
consideration in a nationwide journalism contest run by News Media
Canada, including one discussing Syrian refugees. PayPal cited United States regulations as a reason for flagging the transaction between Canadian entities.
In September 2018, PayPal banned radio host Alex Jones and his website InfoWars, claiming that his site has content that was hateful and discriminatory against certain religious groups.
PayPal discontinued payments to Pornhub models on November 14, 2019, alleging that "Pornhub has made certain business payments through PayPal without seeking our permission".
Pornhub criticized the decision as one that affected "over a hundred
thousand performers who rely on them for their livelihoods", and steered
its payees toward other payment options.
Litigation
In
March 2002, two PayPal account holders separately sued the company for
alleged violations of the Electronic Funds Transfer Act (EFTA) and
California law. Most of the allegations concerned PayPal's dispute
resolution procedures. The two lawsuits were merged into one class
action lawsuit (In re: PayPal litigation). An informal settlement was
reached in November 2003, and a formal settlement was signed on June 11,
2004. The settlement requires that PayPal change its business practices
(including changing its dispute resolution procedures to make them
EFTA-compliant), as well as making a US$9.25 million payment to members
of the class. PayPal denied any wrongdoing.
In June 2003, Stamps.com
filed a lawsuit against PayPal and eBay claiming breach of contract,
breach of the implied covenants of good faith and fair dealing, and
interference with contract, among other claims. In a 2002 license
agreement, Stamps.com and PayPal agreed that Stamps.com technology would
be made available to allow PayPal users to buy and print postage online
from their PayPal accounts. Stamps.com claimed that PayPal did not live
up to its contractual obligations and accused eBay of interfering with
PayPal and Stamps.com's agreement, hence Stamp.com's reasoning for
including eBay in the suit.
Craig Comb and two others filed a class action against PayPal in Craig Comb, et al. v. PayPal Inc..
They sued, alleging illegal misappropriation of customer accounts and
detailed their customer service experiences, including freezing
deposited funds for up to 180 days until disputes were resolved by
PayPal. PayPal argued that the plaintiffs were required to arbitrate
their disputes under the American Arbitration Association's
Commercial Arbitration Rules. The court ruled against PayPal, stating
that "the User Agreement and arbitration clause are substantively
unconscionable under California law."
In September 2002, Bank One Corporation sued PayPal for allegedly infringing its cardless payment system patents.
The following year, PayPal countersued, claiming that Bank One's online
bill-payment system was an infringement against PayPal's online
bill-payment patent, issued in 1998. The two companies agreed on a settlement in October 2003.
In November 2003, AT&T Corporation
filed suit against eBay and PayPal claiming that their payment systems
infringed an AT&T patent, filed in 1991 and granted in 1994. The case was settled out of court the following month, with the terms of the settlement undisclosed.
In June 2011, PayPal and Israel Credit Cards-Cal Ltd. were sued for NIS
16 million. The claimants accused PayPal of deliberately failing to
notify its customers that ICC-Cal was illegally charging them for
currency conversion fees.
A class-action lawsuit filed in 2010 was settled in 2016, in
which the plaintiffs contested PayPal's "holds" on funds. PayPal has
proposed a settlement in the amount of $3.2 million in Zepeda v. PayPal
which has yet to be ratified. As part of the settlement, the company
agreed to change some of its policies.
CFPB consent
On
21 May 2015 PayPal agreed that PayPal Credit would pay a $25 million
fine to settle a complaint filed in Federal Court by the Consumer Financial Protection Bureau.
The complaint alleged that consumers using PayPal were signed up for
PayPal credit accounts without their knowledge nor consent. It alleged
that PayPal had promised discounts and payment options the consumers
never received, and that users trying to sign up for the regular,
non-credit, PayPal accounts were signed up for credit accounts instead. The complaint was filed in the United States District Court for the District of Maryland, which ordered PayPal Credit to refund $15 million to consumers and to pay a $10 million fine.
