Paypal on Airbnb, huge security issue?

[haraldjordan78]

I just booked my holiday on airbnb, the problem is that i actually paid the whole thing with a single click, there was no popup from paypal or similar, i just hit "payment method paypal" on the airbnb website and voila, i got some email from paypal that i sent  500 euros to the hotel, without the paypal authorisation even popping up anywhere.

Honestly, as an IT professional and developer, i am massively surprised about that. All that Airbnb has was my google account login tokens (i logged in to airbnb using my google account) but this one is not anyhow linked to my paypal account. 
In my understanding this means that in this case, paypal did not even do any type of authorisation with airbnb, or better said, they did not do any type of authorisation that i actually authorized. 

Am i thinking anyhow wrong here?

So i ask myself where is the problem here:

-) my understanding of the complex authorisation and auth exchange methods

-) paypal 

-) airbnb 

[kernowlass]

@haraldjordan78 

Have you used that company before and is a subscription / preauthorised payment set up?

Click on the profile tab (icon next to log out) > Click on payments third option along on the thick blue band top of page > "manage pre-approved payments.''

[haraldjordan78]

I am not sure if i already paid something on airbnb using paypal. If i did, it was about 3 years ago, that was before i did set up 2-factor auth on paypal even but i was not able to find anything about that in my paypal account history.

I was not able to find the option "manage pre-approved payments. The third option below the thick blue band is "Data and privacy", the fourth is "Payments" for me. In Payments i have 3 subcategories, Online, in-store and automatic payments. In Automatic Payments, lots of companies are listed including AirBnb, when i click on AirBnB, i find the 500 euros payment i recently did but nothing else from history.

What else i found:

Security - Skip extra approvals for faster payments (nothing listed)

Data&Privacy - Permissions i have given (google and paypal community are listed),

Google has:

• Help you check out in fewer steps and help protect your financial information when using PayPal with Google, Inc.

• Share person-to-person payment instructions with PayPal.

• Show the names and last 4 digits of your available payment methods so you can choose how to pay.

  Does the "Automated payment" mean that any of the listed companies can pull money from my account without me being asked for the paypal 2-factor auth? 

[kernowlass]

@haraldjordan78 

Automated payments are the same as preapproved payments ie subscriptions.

As they are preapproved then they go through automatically for those companies.

If you don't want that to happen then cancel the authorisation?

[haraldjordan78]

Ok, thanks for making that clear. Well of course i immediately cancelled AirBnB and all other stuff that was listed there. I was shocked that about 15 companies (nearly half of companies i ever used paypal for) are allowed to grab huge amounts of money at any given time from my account.

Back to the thing itself, never "subscribed" to anything at AirBnB, they don't even offer anything you can subscribe to.

Also i did never willingly give them permission to actively book anything from my Paypal account. Sure there are chances that some years ago, i clicked somewhere that allows them to do this.

Meanwhile i even understand that Airbnb claims to have done a 2-factor auth because i logged in using "one click" google login - and they might refer back to goole that did a 2-factor auth some days ago on the PC/Browser i was working with. 

That all brings be mack to and seconds my assumption that there was one or multiple security issues with this payment process.