Category Archives: Consumer Concerns

Paypal Prefers To Brand You A Criminal Forever, Rather Than Improve Their Fraud Prevention Practices

I wish I could hire Will Smith to sing all about how my brain got flip-turned upside-down by Paypal‘s baffling approach to fraudulent accounts, but alas, I am just one woman.

Paypal, however, is a company with nearly 20 years of experience, development and presumably, a team dedicated to the prevention of fraudulent activity, including money laundering.  After all, the company’s revenues of $6.6 Billion (2013 figure) should be worth protecting.

That said, it would seem that one of Paypal’s draws — that it’s easy for anyone with an email address to create an account — is one of its massive problems.

I currently run a music blog, Open ‘Til Midnight – a little operation I helm that is devoted to reviewing and promoting music, primarily indie artists and Canadian content.  I love what I do, but the sheer volume of emails involved is but one reason why I created a unique account for the website.  That address (otmblog at gmail dot com) is presented on our submissions page and ultimately, it’s not that hard to scrape up.

On October 21st, 2014, imagine my annoyance and surprise to find a welcome email for “Alexandra Macon” to Paypal, in my inbox.  Now, last I checked, I am not the Managing Editor of Vogue magazine.  I also have been a Paypal customer under my personal email address for nearly 15 years.
welcomeemail

Now, here’s where things get interesting:  I then received a phishing email “from Paypal” within hours of this sign-up that falsely employed my email account:

spoofemail

Clearly bullshit.  I also received another “getting started” email from Paypal legitimately.

Now, I work in fraud for a financial institution for my day job.  What better way, I mused, to push a phishing email through spam filters and make it seem legitimate than to sign up for a Paypal account first, thereby sandwiching the phishing between two valid layers?

In any case, I clearly did not apply for a Paypal account and wanted my email removed from their system.  I also wanted to prevent anyone from making fraudulent transfers associated with my email (which is, ostensibly, my business account).  I went to Paypal‘s website and looked to report the account as fraud.

Problem #1:  I could find no other way to report this theft of my intellectual property than to sign in with my Paypal account to get a unique “verifying code”.  There was no easily accessible phone number.  I logged in with my separate personal account, got the code and phone number, and phoned in to Paypal.

Problem #2:  Despite my clearly being verified as a customer (through the above process), the first representative confirmed that yes, someone had used my blog email account and set up Paypal, but she could not deactivate the account in any way.  She then went on to challenge me on whether or not I owned the email address, refused to email it so I could sit on the phone and confirm it, and then said this was a “Google issue”.  Her excuses for the behaviour of this fraudster were “a typo” (otmblog?  REALLY?) or “a recycled email address”.

In fact, this “recycled email address” business was a very popular party line throughout my hour talking with three different employees, including a security manager.  As in, someone who should really know security, right?  Hmm.  See, no one could answer my counter to that (“Why would you sign up with an email address you cancelled years ago, when Paypal requires email verification to receive funds?”).  Second, the word blog is a fairly recent addition to common vernacular.  Third, I’ve held the account for years.  And fourth:  Google does not recycle usernames — not even to the person who deleted it.  From their own TOS:

Note: Deleting your address won’t free up your username. Once you delete your Gmail address, you won’t be able to use that same username (username@gmail.com) in the future.

Clearly not having any clue once I dropped the words “fraud” and “phishing”, I was passed to someone in the Security department.

Problem #3:  I was then informed that the account created with my email address, without consent, had been “limited” so it could not do any transactions without email verification.  However, my email would remain on the account forever.  I immediately questioned the logic of this, and was fed a series of nonsense reasons at first:  that maybe someone made an honest typo; maybe the address had been recycled; that it would somehow be wrong to delete the account of someone sharing the name of a famous person just because I said so.

Repeatedly, I indicated that they could email me right on the spot and confirm that the person on the phone was the rightful owner of the account.  I was denied, over and over.  As someone who works in fraud, I was scoffed at for pointing out that the phishing email proved that no good intentions could be held by the account creator (“Why would someone create an account to then send a phishing email?” the rep asked condescendingly).  Any account can send without email verification — which makes no sense — but somehow, that makes money laundering impossible, so hey, why require verification before an account can do anything?  I explained money laundering to Paypal‘s security rep.  It was embarrassing.

I became increasingly irate that my email would not be removed from the account.  It is mine, it is associated with my brand, and it belongs to me.  Finally, the rep relented with all other nonsensical explanations and revealed the truth.

Problem #4:  Apparently, the only way Paypal has figured out to track fraudulent information is to preserve these accounts forever, in a limited state.  My email would forever be associated with a fake name, likely fake address etc. for the sake of ensuring that specific constellation of information would never be used again.

Problem #5:  I can never use my valid email, associated with my brand, to open a brand-related Paypal account.  My brand is now tainted with a fraud label in a server somewhere.

I argued against the foolishness of this being the company’s only strategy.  I pointed out that fraudulent credit applications occur in banks all the time, but were the real Jane Smith to apply for a Visa, we wouldn’t ban her from our bank, because that would be turning away customers — in effect, what Paypal is doing with this policy.  “We don’t do credit,” was the reply.  “Ditto bank accounts for us,” I countered, “Which is equivalent to what you do.”

I’m escalated to a self-described Security Manager named Dan, who confirms all the nonsense above.  I’m increasingly incredulous.

“What if someone signed up with the customer service account of Boston Pizza, or its owner Jim Treliving?” I continued.  “Would their email be stuck forever in your fraud database?”  I was told yes, yes it was.  Huge loophole:  fraudsters could create Paypal accounts for every member of a major company with minimal effort.  Ludicrous.

“Okay, so you need to keep the profile to run it against future profiles,” I concede.  “Fine then:  why not have a generic email like ‘fraudaccounts@paypal.com’ that you could sub in so innocent people like me could have their damn accounts back?”  The response:  “That’s not a bad idea and I can send it along, but you cannot remove your email from this account.”

“Fine then.  Can I reset the password on it, since that will go to my email address, and then change it all up and delete it?”  Nope, I’m told, because I did the right thing and reported it.  It’s Limited so I can’t do anything to it.

After wasting an hour of my life, I hang up at midnight my local time and am utterly shocked by the lack of common sense, security protocols, anti-money laundering practices and general customer service Paypal exemplifies.

So, to recap:

  • Some fraudster or jerk signs you up for Paypal.  Maybe you would have wanted to use the service someday, maybe not.  Either way, too bad:  it’s theirs, despite the fraudster never having to verify the legitimacy of their email account.  Jesus, I needed to jump more hoops to join a radio station mailing list than Paypal requires.
  • Despite this lack of legitimacy, a fraudster can send illegally obtained funds from their Visa (or a stolen Visa, perhaps, as I see all day long at work) to another Paypal account, which can lead to a laundering chain.
  • The only way Paypal, a major company with billions and offices in Silicone Valley, can figure out to track fraud, is to brand emails with a broad brush and maintain thousands of fake accounts forever.
  • They have apparently never considered the notion of smart phishing (there’s a reason the Microsoft phone scam works – they use tricks to make themselves seem legit before the scam kicks in), nor have they considered how easy it is to steal email addresses from websites.

Way to fail, Paypal.  Seriously.  Apparently the only way people can protect themselves is to violate their own TOS and create accounts for every single personal email address, “just in case”.  It’s like a warped version of domain parking.

There have been plenty of critics of Paypal’s shoddy practices, particularly those involving seller protections, but this really takes the cake.  And I’m not the only one:  Google results will take you to community threads with others sharing the experience of an email account being stolen.  Identity theft is just par for the course, it seems.  No big deal.

This is a business that asks you to connect your credit card and personal banking information to your account.  I’m not so sure I feel comfortable using their services anymore.

Have a similar experience with Paypal?  I’d love to hear it.  Please leave a comment below.

Tagged , , , , , , , , , , ,

Nonjudgmental Judging Has No Place on The TTC

Friday night, en route to a concert I was reviewing for my music blog, I noticed an ad on the TTC subway system that inspired disgust and anger.  The ad promoted JFJ Hope Centre, which also displayed support from the omnipresent Bus Stop Bible Studies.  What is the JFJ Hope Centre?  Let’s ask them:

Formerly known as Jewels For Jesus Mission and Jewels For Jesus Adoption Agency, our organization has been compassionately caring for families and children in the province of Ontario since 1948.

JFJ Hope Centre offers support and education related to unplanned pregnancies and parenting struggles in a caring Christian environment.

This in and of itself is not the problem with the ad.  I fully support the freedom for organizations such as this to advertise on the TTC, with one caveat:  the ad must not make a non-Christian feel judged or “lesser than” in any way.  The ad currently on the system features a sad, young couple and the above information.  Had they stopped there, I would be content.  But then, they had to go that further step:

“Adoption is the loving choice.”

Now I’m pissed.  I look at an ad that touts a “nonjudgmental environment” and point out how sooty-black the pot is from the perspective of this kettle.

Adoption is a choice, and a valid one.  Many unplanned pregnancies end in this choice, and I support it.  A good friend of mine has adopted three children and gives them an incredible amount of love and joy.  She is truly a Supermom and in the case of those families, adoption ended in a very positive way.

However, giving a child up at birth does not always end happily.  Children may enter foster homes that are unfortunately abusive, or group homes with similar misery.  Birth parents may spend their lives regretting their choice.  Young teen girls may be forced by parents via bullying into a choice that is anything but loving.

Abortion is also a valid choice.  For some, it is psychologically impossible to carry a child to term and give it away.  Tokophobia, the fear of pregnancy or childbirth, makes the mere confirmation of a pregnancy a traumatic experience.  Survivors of sexual violence may be further traumatized by carrying an assailant’s child to term.  What is loving for the parents here?

There are parents who choose to abort because of severe birth defects that will make life painful, difficult and/or extremely short for the child if carried to term, or perhaps the child may be stillborn.  It is agonizing, but they may choose out of love to abort.  That may not be the Christian viewpoint of what to do in these cases, but that doesn’t negate the love behind a gesture.

Herein lays my point:  just because a choice is not the preferred resolution that a Christian organization would espouse does not preclude other options from being selected out of love.  To state that adoption unequivocally is the loving choice is judgmental, insulting and potentially painful for a TTC rider that has aborted in the past.  As someone with friends who have aborted with very loving reasons – who live with the pain of that sacrifice – I am extremely upset that the TTC cleared this ad.

The most frustrating part is that the ad would be acceptable with a single word change.  Had the ad stated, “Adoption is a loving choice”, I wouldn’t object.  It is one of the choices, and it can be made out of love.  In a country where abortion is legal and has been for many years, the TTC should know better.

I am more open than some out there.  I am okay with religious and atheist ads alike.  People are allowed to celebrate their diversity of opinions, life choices, histories, religion, race, culture, etc.  That’s what makes Canada great.  But do not make me feel like I am not loving, kind, or a decent person because I would make a different choice than you would.  As a childfree woman by choice, I would abort if all of my many safeguards against pregnancy failed.  I would do so out of love, for I know I am not a suitable mother and carry many heritable ailments I would never wish on an innocent child.  If that’s not loving, I don’t know what is.

Note: comments turned off due to hateful pro-life spam (now that’s ironic).

Tagged , , , , , , , , , , , , , , , , ,

Censorship: An Open Letter To YouTube

Dear YouTube,

There are many things about you lately that I am unhappy about – the forced Google account login, for example, that boots me from my main Gmail account, since my secondary one is connected to my YouTube profile; the new layout continues to make basic activities harder (why can’t I X out videos I’m not interested in or see my subscription updates by channel!?); and the general manipulation of your content by greedy corporations is also annoying.  But today, I have a bigger problem,

You are blatantly targeting and discriminating against a single YouTube channel, FLuffeeTalks.

In a video uploaded this week, FLuffeeTalks (hereafter shortened to Fluffee) advised his fans that the reason he’d stopped uploading videos to the channel is that he is under personal attack by YouTube.  All of his honours have been inexplicably stripped (including his #5 Most Subscribed – Canada, which means a lot to him), with the explanation being that the channel is “too inappropriate” to have honours.

Anyone who regularly watches the big content producers on YouTube and knows Fluffee’s channel is rolling their eyes out of their head right now with me.  Too inappropriate?  Are you serious?  What precisely is too inappropriate about Fluffee’s channel that makes him unique from other honoured YouTubers? I feel as a user of YouTube, whose clicks earn the site revenue and in effect, makes me a paying customer, you owe us all an explanation.

For those who haven’t watched FLuffeeTalks, the premise is simple:  Fluffee takes a current news story, and then chats about it for a few minutes.  Being a comedian, his approach is one of dark humour.  The overall message is always a positive one (ie, killing is bad; pedophiles are evil; parents should watch their children).  I personally think FLuffee is one of the best comics out there, and that he and Joe Rogan should go on tour, but I digress.

Here’s an example of a FLuffeeTalks video:

So he swears – big deal!  He’s hardly the only YouTuber to do that.  Plenty of music artists put up uncensored versions of songs.  ItsKingsleyBitch, another of my favourite YouTubers (can he also be on this Rogan/Fluffee tour?) curses all the damn time and has honours – hell, he lists his Occupation as Professional Cunt.  Case in point:

So YouTube, it can’t be FLuffee’s language that’s the problem; a ton of the big YouTubers cuss all the time, and no one cares.

Then, I thought, “They have a problem with Fluffee talking about smoking marijuana.”  Now, plenty of YouTubers make comments about drug use, etc. for comedic effect, so if this is the case, it’s total BS. RayWilliamJohnson – who, for reasons I don’t understand, is HUGE on YouTube – talks about drugs and hey, even fake-smokes a bong in this video, but he still has honours.

So, it’s not the swearing, and it’s not the drug talk…  Is it the content?  How can it be?  Again, only FLuffee is being singled out.  No inappropriate images are shown.  His joke video titles are no worse than sxephil’s titles (now HE deserves to be on top, not RWJ, but again, I digress).  Also, like good ol’ PhillyD, FLuffeeTalks is a news-based show – wherein the YouTuber chats about the news that stuck out in a way that can be humorous.  If anything, between the lines, Fluffee is promoting decent behaviour – sure, he makes harsh jokes along the way, but in discussing pedophiles, his take-away message is, “Watch your children and protect them!”  How is that bad?

Contrast that with the endless date rape jokes Ray William Johnson makes in almost every goddamn show – the reason why I got fed up and unsubbed from him.  Hear that, YouTube?  As a date rape survivor, THAT is offensive and shouldn’t be on the honours page.  THAT bothers me.

TheYoungTurks also talk news, sometimes in a dark humour way.  So, with sxephil, that’s at least two larger channels putting out similar content to FLuffeeTalks, and their honours are intact.

YouTube, you’re busted.  You obviously have an agenda here, and are targeting people for unknown reasons you’re masking as “inappropriate content”.  YouTube, you have some serious explaining to do.  Rules must be uniformly applied, or they are not rules – just personal biases. Censorship sucks, YouTube, and will not be regarded lightly.

Waiting for an explanation,

Amber

(I have also complained over at YT itself; join the thread here.)

Tagged , , , , , , , , , , , , , , , , , , , , , , ,

The JP Morgan Chase Saga – Part Two

I previously blogged about my horrid experience with Chase shutting down my Best Buy credit card on a seeming whim, leaving me with the awesome experience of going to a check-out and having my card declined. If you have not read that, READ IT FIRST.

After dealing with the normal level one tier customer service reps, I contacted Chase’s Executive Office, as they suggested.  I was told this office was where the decision to close my account, as opposed to placing it on hold, originated from.  I spoke with a representative of that office and explained the situation, and asked what the hell had happened.

I was then told that Chase legally could not tell me why my account was closed.  As in, illegal to say it.  No choice.  Nada.  I was absolutely baffled by this.  I was also told that level one had advised me incorrectly, and that my account was not closed due to missing information about my ID.  In fact, it was a mystery something else that was not my credit score, but was ‘information that was incorrectly collected at the time’.  I asked her outright if it was my employment status (part-time) or anything of the like, and she refused to confirm or deny anything.  She said she would send a letter on it. She also said she had listened to the call and was sorry that the level one reps had told me incorrect information.

For the record, I have yet to receive: a) the letter that level one advised was mailed before the in-store incident; or b) a letter from the Executive Office, clarifying the discussion we’d had.  I did, however, receive my Best Buy statement, dated May 26th, that indicated I had available credit!  Hilarious.

At this point, per my mother-in-law, who worked in banking for twenty years and was appalled by all of this, I contacted the Financial Consumer Agency of Canada for further contacts and advice.  I learned that credit card providers and other lenders have the right to cancel your credit account at any time, with no rhyme or reason to it, which I find really disgusting, but that’s politics for you. However, there is no law that prevents them from giving you the reason; it’s just their choice to withhold it, if they so desire.  More lies from Chase!

The rep did agree that the changing reasons and the closure versus hold seemed odd, and provided me with a number for the JP Morgan Chase Ombudsman for Canada, Jennifer Hare.  I left a voicemail.  Due to phone tag and personal obligations, I was unable to answer her right away, so she sent me a letter via courier.  This letter, dated June 7th, only served to further irritate me.  It begins by summarizing the facts I had already relayed or were known.  My account was closed May 17th, apparently; funny how my May 26th statement days I have available credit, huh?  I’m also still waiting for the letter sent supposedly prior to the store debacle.

But this is the hilarious part, which I will take the time to type out for posterity and dissection:

As a Canadian financial institution, Chase is responsible for complying with The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), which sets out prescribed identification methods for credit card accounts.  For accounts opened at a retail location, Chase and Best Buy must review government-issued identification and record the unique identification number.  When you opened the account in November 2010, you presented your passport to the Best Buy sales agent, who collected the identification number.  Chase later performed a verification of the passport number as entered by the agent.  We found it did not match the format we use to validate passport unique identifier numbers, and accordingly had no alternative but to close the account.  We sincerely regret the inconvenience that the closure of your account occasioned. (emphasis mine)

So, now we’re back to my ID being the problem!  Back and forth, back and forth…. Chase, customer service isn’t ping pong.  I’m also baffled, being as the rep barcode scanned my passport, how the unique identifier wasn’t recorded.  I’m thoroughly impressed that an agent error, by Chase’s own words, led to my account being closed.  I’m still not given a reason why some accounts were only held and I was not contacted to get that identifier for them to verify me.  I’m also curious why it took six months for them to notice.

But let me draw your attention to the bolded part:  they had no alternative but to close my account.  That’s funny; your own employees told me some accounts were just frozen.  Further, I called the FCAC again today, who confirmed that there is nothing in the Act they cited that forces them to close an account, and further, that the government agency that enforces compliance cannot make Chase close an account at the snap of their fingers alone; Chase has the ultimate authority to choose to close it.

I have now left a further voicemail with Ms. Hare, detailing the laws as I have had them explained to me, and have also contacted FINTRAC, who ensure bank compliance with the Act.  I’ll continue to update on this nonsense, not only for those interested, but to make it publicly clear that Chase is hiding behind a dance of multiple laws to close accounts on a whim.  While that may be their legal right, it IS piss-poor customer service.  I’ve had a few others come forward and tell me of recent closures that are just as illogical, so I cannot stress this enough:  avoid Chase.  Boycott stores that use their financing services.  If your account was closed without warning, complain and ESCALATE.  I do not know the process in the States, but in Canada, the process can be found via the FCAC website, including all contact numbers (search Chase).

Keep failing, Chase.  You ticked off the wrong person.  I’m not passive, nor am I unintelligent, uninformed or too scared to question authority.  I’m legally well-versed and articulate, and will continue to spread word of your poor treatment of consumers.

Tagged , , , , , , , , , , , , , , , , , , ,

Canadians: If You Have A Best Buy Credit Card, Beware! Chase Is Screwing You Over.

So…  If you signed up for a Best Buy credit card in Canada (or Future Shop, its sister store) prior to January 2011, beware: your account may be locked or shut down without warning for no logical or legal reason.  How do I know this?  They told me that they’ve done it. 

This past Friday (May 20th) I went into Best Buy to grab a few movies for the weekend.  Although I had cash available, I always charge Best Buy purchases to my credit card from there, as I use it to keep tabs on how much money I spend on non-necessities.  My $34 transaction was declined.  Confused, namely because I had well over $400 of available credit, we tried again.  And again.  After the third ‘declined’, a passing manager offered to take me to customer service to call Chase; I gladly agreed, as I was now concerned that my card had somehow been compromised.  What I discovered, however, was far more shady and disingenuous.

After reaching a representative, he informed me that my account had been closed, due to “missing personal information on file”.  I then demanded to know what, precisely, was missing, given that they had just confirmed my name, address, date of birth and account number before telling me anything.  He placed me on hold, and transferred me to another representative (who later informed me she was very new to the call centre).  The second representative told me that banking regulations had changed in Canada as of January 2011, requiring that photo ID be presented to obtain credit in store – “things are more strict now,” she added emphatically – and a mass review of accounts had been undertaken since.  I then informed her that I have always had to show photo ID to obtain credit for store cards and otherwise; in my twelve years of being a credit holder, I have always had to prove my identity.  I then told her that I was standing in front of, ironically, the same store employee who had opened my application, and she had seen my passport on that very day last November, so it was obviously not a new policy.  The representative tried to insist this was not universal; I had an employee confirm otherwise beside me while she was on the line.

I then asked why I wasn’t contacted about this supposedly outstanding identification, as I have been getting my statements promptly each month.  Surely, I told her, if this was a problem since January, they would have contacted me before outright closing my account?  She advised me that she could see a letter was sent “recently” and that some accounts were on hold while some were closed.  I asked why my account wasn’t on hold then, pending notification of me; the representative said she was new and had no idea how it worked.  I asked how to re-open my account, after emphasizing how utterly humiliating the whole process of having my card declined was, which was when she told me the kicker:  because they shut down my account, I would have to re-apply for credit to have a new one, thus incurring a credit score hit.  I again pointed out that this was ludicrous, stressing again that my passport had been scanned into the computer for the application to Chase(!) in November, and that there was absolutely no way I would tolerate another score hit for their error.  I then demanded that someone with authority regarding the closings phone me back; the representative informed me there was no way to schedule a callback and that she didn’t know who would have closed my account, “but I could ask my supervisor.”  She asked, and returned with a PO Box address in Ottawa.  I again stressed wanting a callback; she said she would take down my phone number and give it to her supervisor and see if she could.

I then asked if my current no payment plans would hold with the account closed (I purchased a laptop on a year plan with no payments or interest, hence applying for the card in the first place); she had to check as she wasn’t sure.  I was assured all was in order, but the card was now useless for new purchases.

I have been making payments monthly; there was no reason to flag my account for closure over a hold, as my score is exceptional.  The fact that there seemed to be no rhyme or reason, nor any notification or actual knowledge of credit policies in Canada, is extremely disturbing.  This was a review undertaken on ALL Canadian card holders at Best Buy and, conversely, sister store Future Shop; there are others out there who have been unknowingly terminated.

As I informed Chase and the store, I will not give another cent to the chain until Chase is no longer their credit provider, which is a shame for them, given my spending habits and my fiance’s love of electronic gadgets.  I also refuse to incur a hit on my score for foolishness. I urge you to do the same, and please, check on your account as soon as possible. 

Way to fail, Chase.  Way to fail.


EDIT:  THE SAGA CONTINUES!  MORE CHASE LIES ON THESE CLOSURES HERE!

Tagged , , , , , , , , , , , ,