Major security flaw - the system keeps re-enabling auto login even after I keep turning it off

[j_a_s]

I've been dealing with customer support all day over this issue and they say they can do nothing but I want to raise it here as well since it's a major security flaw. Paypal is a financial site and therefore security controls should be very strong. I always log out whenever I complete a transaction and I never click the "stay logged in" button that's always presented. Now, every time I log in, I get an email saying "We've made it easier for you to check out with PayPal. Since we recognize this device, we'll automatically log you in so you can skip typing your password at checkout! ... If this is a shared device, or you don't want us to automatically log you in, we recommend that you turn this feature off." I go in and manually turn the feature off. Then the next time I log in to make a transaction, I get the same email again, the feature is re-enabled again, and I have to go in to manually turn it off again. This is totally unacceptable. I'm the only one who should be able to determine if my device is trusted and and if I want to enable auto login. I was told that there's nothing they can do and that I'll simply have to manually disable the feature every time. This is a major security flaw and it's a big deal. I was told that my concern has been escalated but I'm posting this here in the hopes of raising the visibility of this issue. Thanks. 

[goodapple15]

This is now my #1 reason to NOT use PayPal.

If someone steals my phone, all my bank apps are locked by password authentication or biometric authentication IN ADDITION TO the phone lock.

That's how I want it.

But if someone steals my phone and opens PayPal, they can immediately use as much $ as is available in all my linked accounts, unless I continually remember to constantly turn this feature off.

If this ever actually occurs for me, I will likely permanently abandon the PayPal platform in favor of alternatives.

[PayPal_JonK]

Hello @goodapple15 

Welcome to the PayPal Community! I certainly understand your concern. If that ever happens, you can manage your active logins with the following steps: 

1. Login to your PayPal account through a browser (not a mobile app)
2. Click Settings (gear icon)
3. Click Security
4. Click Manage next to Manage your logins
5. Choose to remove the active login you wish

I also posted some steps above regarding removing any Auto Logins as well.

I hope that helps!

 - Jon K

[goodapple15]

Thank you Jon, that makes sense.

My plan has been to remote-wipe my device should it ever be lost or stolen, but I hadn't thought of removing my active login(s) as well.  I will put that in my mental notes as part of my contingency plan.  That will also be a more certain step, as it will occur server-side.

Thank you!

[texanNUmbria]

To the moderator who suggest turning off the ability - This does not work.   I have ALWAYS had autologin disabled, yet every 3rd or so login, Paypal re-enables autologin.  Your algorithm is obviously not taking the choice I have made to disable autologin into account, and repeatedly turns it back on.  

What stupidity.  Fix this already.

[COTestDummy]

No, this does not help!  Whenever I make a purchase, PayPal re-enables it EVERY TIME.  How does one stop this from happening PERMANENTLY?

[wfredk]

The problem with this procedure is IT IS NOT A PERMANENT SETTING - PayPal turns the **bleep** security hole back on EVERY time.

[denniz1]

they have gone one step further "disable auto login to my account" setting has been removed from my account setting now i have to save the email from last year to find the turnoff autologin  every time. I think i will have to find an alternative

[PayPal__Jyoti]

Hello @denniz1  

Thanks for visiting PayPal's Community Forum.

I do understand that you are facing issue while trying to disable auto login. Please reach out to the Support Team during business hours by clicking the contact us option at the bottom of PayPal page to get help with your issue. If your unable to login or are not in access of your PayPal account, you can connect with us via phone call as "as a Guest" (this does not require you to sign in to your PayPal account).

Hope this helps you!

Warm Regards,
Jyoti


If this post or any other was helpful, please enrich the Community by giving kudos to its author, accepting it as a solution, and/or coming back to assist others. Members make this Community great!

[clee6]

I have the same problem -- you are right -- this is unacceptable. I turn off the auto enable login on my phone, then do a test -- go to a site, place an order and enter paypal to pay and it processes immediately without asking for my password. HUGE SECURITY FLAW THAT REQUIRES IMMEDIATE ATTENTION AND RESPONSE

[hopefullycos]

Agreed, this needs to be fixed!