How to determine if the PRENOTE is legit.
Since I could not find this information on line - I figured I would help anyone else with the answer.
PayPal has been under fire for not doing prenotes and they are basically checking every account - even old and closed ones. However, this does not help you when PayPal does not log this information on your activity log because technically, it is not a "transaction", it's a "prenote", other wise known as a validity check. In banking terms, this is not a transaction.
So how do you tell?
1. Call PayPal and ask them to do a search by bank account number to verify that no one else has set up an account using your bank account information. You will need your full MICR number. They do not need the ABA (Routing) number. Their system is not supposed to let duplicate accounts exist, but it still happens from time to time. If you're the only PayPal account with your bank account number you are good on the PayPal side.
2. Call your bank, ask them to look at the prenote and the last ACH withdraw or deposit you received from PayPal, even if it's years old. Have them compare the "ACH Originating DFI ID." This is like the ABA or routing number. It is unique to every financial institution and guarantees that the ACH prenote originated from PayPal's bank. If the numbers match, then you are good on the banking side.
Some banks put this information on your statement. For instance, my bank lists the full "TRACE NUMBER" on my statement. This is the unique transaction serial number which is used by the banks to trace or track ACHs. The first 8 numbers is the ACH Originating DFI ID. For instance, my statement included the following:
ACH Comment / PAYPAL PAYPALPRNT PRENOTE 220725 PRENOTE 091000013xxxxxx: Prenotification Credit Entry (the last six numbers were removed for security purposes).
The ACH Originating DFI ID is 09100001 and this matches every PayPal transaction I have ever done.
Because they all match, the risk is very low. It would be highly unlikely, if not impossible, that a threat actor could set up an account with the PayPal name at the same bank PayPal uses.
YMMV
Now what if the ID is different? You have two options. Close the account or have your bank "block" all ACH to that ID. Discuss this with your bank and follow their advice.
Brett
