Warning Issued by Consumer Agency Regarding Misuse of IBANs via PayPal
The Consumer Advice Centre in North Rhine-Westphalia alerts people about a new scam involving fraudsters using other people's IBANs for PayPal purchases. This activity appears to be facilitated by PayPal's lenient handling of guest accounts, providing minimal protection.
Individuals whose data has been compromised at any point in time are at risk of falling victim to this new swindle, asserts the Consumer Advice Centre. The primary concern here is the IBAN, a checking account number used for transfers and debits. Fraudsters utilize it to execute purchases via PayPal.
A resident from North Rhine-Westphalia experienced this firsthand when PayPal requested him to settle a 56.75 euro bill. Upon verification, PayPal acknowledged that they were unable to debit the amount from his account, as it had been closed since 2018. The man, who possessed a PayPal account, had eliminated the old IBAN from it long ago, explaining why he declined to pay. In response, PayPal dispatched a letter from a debt collection agency demanding an additional 31.50 euros.
PayPal turns a blind eye
It was discovered that crooks had likely used the old IBAN for online shopping through PayPal's "Pay without PayPal account" option. This method allows direct debit payments without requiring a PayPal account.
PayPal's spokesperson confirmed that they acted as an intermediary for crediting the buyer's payment to the seller's PayPal account via direct debit or credit card. However, when asked if PayPal checks if the provided IBAN belongs to the person placing the order, the spokesperson provided vague answers, failing to provide clarification.
Lack of regulations for guest accounts
PayPal's terms and conditions do not specify whether or how IBANs or identities are checked for guest account payments, according to the Consumer Advice Centre. Identity checks are only conducted when a PayPal account is created.
The Consumer Advice Centre in North Rhine-Westphalia posed questions to the company spokesperson, which had previously been raised on the "PayPal Community" forum, including: Why isn't it possible to block one's own IBAN from guest payments to prevent misuse? And why doesn't PayPal transfer any money to the given IBAN for guest payments, requiring identity verification instead? Unfortunately, the Consumer Advice Centre did not receive any answers.
Only reactive measures are available
For the time being, it is impossible to prevent a compromised IBAN, obtained through hacker attacks, data leaks, or phishing, from being used for PayPal purchases. However, if this happens to you, there are steps you can take:
The Consumer Advice Centre in North Rhine-Westphalia advises those faced with unauthorized debits to dispute the charge and request their bank to reverse the transaction. Typically, this can be done within eight weeks for direct debits and within 13 months for unauthorized debits. Additionally, affected individuals should file a police report to address any subsequent collection agency issues. It is essential to ensure that no entry relating to the dispute appears in credit agencies like Schufa, according to the Consumer Advice Centre in North Rhine-Westphalia.
The Consumer Advice Centre in North Rhine-Westphalia urged The Commission to take action against PayPal, as the company's lenient handling of guest accounts and lack of regulations could lead to further IBAN misuse. PayPal's spokesperson's evasive answers during their interaction with the Consumer Advice Centre did not provide enough clarity regarding the IBAN verification process for guest payments.
