We recently sold a number of items on our website.
The customers used the Papal API to have the credit cards approved.
As it turned out.
The transactions were fraudulent.
The same credit card number was used by two separate individuals within days of each other.
We believe the act was all perpetrated by one individual operating out of Israel using VPNs showing locations in the US.
Several transaction were processed with the same credit card using two different names and two different ship too addresses.
Some transactions were processed by my credit card payment processor and some by Paypal as a "Guest"
The transactions were processed and the items shipped and received.
A month later - my credit card processor company notified me of a charge back for the total amount (Both the Paypal authorized transactions and processor authorized transactions)
Paypal was never notified of a charge back - but the transactions they approved where included in the charge back my processor pulled from my bank account.
The dispute only came through my processor -Because of Paypal policies I had no data or information from the Paypal transaction to dispute the transaction with my processor - it would not have done any good because the name, bill and ship to addresses of the card did not match those of the transaction. This is the key to all credit card disputes where a card is "Not Present".
So, why were these processed?
I later learned that the card was issued by a bank in Spain and therefore US transactions do not receive the name, address and ship to information from a European card holder. Just the card numbers, expiry and CCV. This maybe true for other foreign issued cards as well.
So anyone in Europe using a stolen credit card with these numbers available to them can make purchases in the US and have the item shipped anywhere.
Many of these items where shipped to destinations inside the United States.
The PayPal "Guest" system did not prevent the fraud. You cannot accept PayPal without accepting the "Guest" system. this is how they sign up new PayPal users. It is their marketing tool and they will not allow it to be turned off.
I am told by Paypal that i can chose to block payments from outside the US. That defeats the idea of having a payment platform that is suppose to accept, process and vet international payments.
I am also told by PayPal that I could refer the processor to Paypal to dispute the transaction. The result is the same. The money would be pulled from my account, the dispute process would determine the ship to did not match the billing address of the card holder and I would loose the money, the shipping and the merchandise. My processor will Pull it out of my bank or out of Paypal - the result is the same.
If Paypal cannot prevent fraud, refuses to allow vendors to exclude the Paypal "Guest System" which is so clearly open to abuse, refuses to provide vendors with the information on transactions so they can defend charge backs from their processors - then the only alternative is to remove PayPal as a payment option on our website.
If Paypal were willing to allow me to Opt out of allowing credit card charges or "Guest" credit card charges - I would consider re-instituting the gateway.
As it is - I view the Paypal system as a front door for people to commit fraud against me .
I am filing complaints and contacted the Federal Trade Commission on this issue and have been requested to provided details on the incident. I hope they take appropriate action to protect consumers and merchants.
I hope you hear from them soon.
Please alert me if you have had a similar experience.
