PayPal Community

Frigidman · ‎Sep-02-2021

Interestingly we have run into this sort of problem now with the "Log In with PayPal" button (lippButton) and javascript. Upon placing that button inside a frameset on our service, a user clicks the button, gets a popup window to login to their paypal, and then it sits spinning endlessly because the parent page that created that popup window is now 'refusing the url to be changed by the paypal js'. A cross domain security issue. The thing is..... we'd had this code running and in place for about two years straight without fault for all our users. Then suddenly, sometime in the last month this has now become an issue when we changed no code on our end. Frustrating fighting some of these cross origin security issues because browsers are dogpiling even more restrictions in place to protect everyone from the malicious people in the world. Sadly it means we have to re-engineer and format, change whole flows, and design styles ... just to get around the problem again. Sorry, I have no solution to your issue....... we still have not found one ourselves.

Frigidman · ‎Jun-26-2020

How is this an idea for PayPal? Please look where you are before posting.

Frigidman · ‎Jun-23-2020

Was trying to work in the "reauthorize a prior authorization" system so we could extend an authorization for orders that take longer than 27 days to process. As per the docs, it is allowed to reauthorize an authorization multiple times to extend the expire so long as you wait 4 days before attempting a re-authorize. However that is not the case. The REST API actually makes a mess of things. For an original authorization, it returns the `expiration_time`, other info, and the url of: https://api.paypal.com/v2/payments/authorizations/{authorization_id}/reauthorize After 3 days (which you must wait to use the reauthorize url), hitting the reauthorize url causes it to create a whole new authorization, but results in the exact same `expiration_time`. Making it completely useless, only to cause a mess with now having multiple authorization IDs... AND the buyer seeing multiple authorizations for the exact same order: Is there really no way to extend an authorization for orders that will take longer? For example, a pre-order of something to release three months later? Or back-orders which had an unforeseen pandemic delay or the like?

Frigidman · ‎May-15-2020

Yes this has been a growing concern as well. So many hacked-into paypal accounts placing orders. Very little movement from paypal to stop it. Its their user accounts they need to protect. Touted as "the safe way to pay!"... but for merchants its definitely not the a safe way to accept payment. Also in your comment, you mentioned you spot the fraud before sending product, and issue a refund. Well as of 2020, PayPal keeps the transaction fees on refunds and disputed transactions. So even if us merchants do the right thing, we still get charged for it.

Frigidman · ‎May-15-2020

Whole-heartedly agree there. We see "unauthorized transaction" disputes daily, because of lax PayPal security and too many hacker accounts placing orders (which appear legit on our end because PayPal provides NO insights if the user is breeched). And guess what, every single one of those get sided in Buyers Favor, and the transaction fees KEPT by PayPal. Even when we 'do the right thing' and preemptively refund in full to the user account, PayPal keeps the transaction fees. So, when PayPal makes money either way, it means they have no reason to bother securing their user's accounts from all this mass fraud and unauthorized accesses. However from a merchant standpoint, its a despicable business practice. As such, our company has begun a "Phase out PayPal" plan. Initially urging new shoppers to not use PayPal without added delays to orders, then outright rejecting the use of PayPal for new shoppers. And finally removing all PayPal code from the storefront. When it boils down to it, if you have other means of payment (direct Credit Card via PCI Compliance, ApplePay, AmazonPay), then people who want ot buy something WILL STILL BUY SOMETHING if PayPal does not exist.

Frigidman · ‎May-12-2020

Here is the basic scenario with "Intent = Capture": - Customer comes to store, places an order for something. - Payment is taken immediately on order (no wait period, due to intent=capture). - Product is either delivered instantly (digital goods), or put on hold for suspicions. - In 1-3 days, PayPal alerts us of an "unauthorized transaction" dispute due to a hacked paypal account. Here is a different scenario using "Intent = Authorize": - Customer comes to store, places an order for something. - Payment is "Authorized" (not yet captured). - Order is put on hold because it LOOKS suspicious, so no Capture is done. - ??? Will PayPal ever notify us that the "authorization" was fraudulent in any way ??? We are trying to figure this out, as if to ever expect that paypal will tell us that an authorize is actually not legit for capture, and we should void it and flag our order as fraud. However I cannot find any information anywhere about the process (if any) that paypal may or may not do in this regard.

Frigidman · ‎May-07-2020

They just changed things again overnight. Now the slim header is twice as large, and has a roll over pop down that adds even more height to try and find and click things that were once easier to click directly in the single header bar. It is now a nightmare to get to the friggen resolution center (something we are always going into multiple times a day because of how many hacked paypal accounts are being used to make fraudulent orders). Not only does it take half a minute to click to each section, and having to login every few minutes because it never remembers a session, but now its navigation mayhem. Seriously guys... stop making your UX worse.

Frigidman · ‎Feb-29-2020

If you are using the JS SDK end, you would add it to the javascript resource. (https://developer.paypal.com/docs/checkout/reference/customize-sdk/?mark=locale#locale) If you are doing a back-end (server to server via REST v2), you can add locale to the application_context object. (https://developer.paypal.com/docs/api/orders/v2/#definition-order_application_context) That is also where you set landing_page to LOGIN, and brand_name etc.

Frigidman · ‎Feb-29-2020

Also be sure to click on the transaction and dispute it as an unauthorized access transaction. Someone has gotten into your paypal account. Working from a merchant end, we see at least a dozen a day of hacked-into paypal accounts trying to place fraudulent orders. As a rule of thumb for ALL services and websites: Never, ever, use the exact same username and password between sites.

Frigidman · ‎Feb-28-2020

We noticed this too when we were thinking about switching to use the js-sdk. Instead, we use server-to-server API calls with their REST, to ensure the values we send them, and receive, have gone through proper channels and don't have any tampering. Its a LOT of extra work to setup and develop, but in the long run, you feel more confident in the data you are sending paypal and getting back.

PayPal Community

Re: Connect with PayPal Button doesn't work

Re: Incorrect address

Reauthorize authorization id does not work correct...

Re: Fraudulent or otherwise unsavory transactions

Re: Fees for cancelled orders

Does PayPal alert a merchant about hacked accounts...

Re: The "Remodel" of your entire Website since ear...

Re: RestAPI locale property in v2

Re: Changes to my PayPal account, which I don't kn...

Re: How to prevent users from changing the payment...