Slashdot Mirror
Abiword's PayPal Donation Fund Robbed
SabberFlapper writes "According to this Announcement to the developer list of Abiword the Abiword fund was robbed. Dom Lachowicz writes: 'I'm duty bound to let you all know that the AbiWord Fund/Tip Jar has
been robbed approximately three weeks ago. I'm telling you this now,
rather than sooner, since I believed that Paypal would do something
about my complaints during the interim, and that this would all be
resolved quietly. Today, 23 days later, this does not look like it will
happen. [..]
I do however, recommend doing several things:
1) Writing to Paypal, in letter, email, or fax form alerting them to
this travesty.
2) Calling Paypal on AbiWord's behalf.
3) Writing or calling your Congressman/woman, pointing out that Paypal
is acting like a bank, but not operating under formal banking laws.
4) Boycotting Paypal because of these reasons, and the fact that their
system is notoriously insecure, and encouraging others to do the same.'" Of all the groups to steal from -- AbiWord?
I had a paypal account. As soon as I saw the site http://www.paypalwarning.com I deleted it. This was out of simple self preservation, everyone gets bad press, but that much, and to that degree?? I have shown everyone I know that uses paypal that site - I feel duty bound to do so. Veteran Netizens certainly have seen or heard of this site, yet AbiWord decided to use it as their merchant account. Well, you knew the risks didn't you...
Yes, it sucks. It is pretty terrible that donations where robbed. But common sence could have avoided it. You call for a boycott now - well hundreds have been saying this for some time and it was ignored... People have been attempting to get PayPal to have to live up to the same standards of a bank for a long time now. I am sure it is a shock when it is you that gets ripped off but it shouldn't shock you that much that PayPal is being less than helpful.
NR
That's great advice - wish I'd heard it earlier. I got screwed just this way. I purchased something using PayPal and when the seller screwed me, I tried to get my money back through the bank. Too bad PayPal didn't use the VISA option on my debit card, but the debit account. So, my purchase wasn't automatically insured as it would have been had the payment went through VISA. PayPal is comprised of a bunch of blood sucking leeches. That goes for EBay, too. By the way, try and contact somebody at either establishment. Have fun.
He says, "...their system is notoriously insecure."
It seems to me that if the system is that insecure, the perps could have found something more lucrative to rob than the Abiword tip jar. I'm sure there are power sellers on ebay that do more business in a week than the tip jar sees in a year.
Perhaps his fund password was something like "abiword" or he responded to a scam e-mail...
Reading the complete post, I see "...Their silence implies to me that they are treating this matter as if I got mugged on the street, rather than as if someone walked into their bank and withdrew my money without my consent."
So it sounds as if it was not a hole but rather an error on Dom's part. I look forward to reading more about this to find out just how this happened.
Maybe if paypal acted good-hearted, and at least put up some easy contact info so you could get some help tracking down the scammers they wouldn't have such a hard time.
This is like putting your stuff in public storage, having the garage broken into, all your stuff stolen, only to find out they've replaced the attendant with an automated box and have chosen to leave you no way to contact a person.
It's despicable, and it stinks of fraud.
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
...just as soon as someone explains how the theft occured and why it is PayPal's fault. If the theft occured by someone hacking PayPal, then it is indeed their fault and I will cancel. But if the theft occured because Abiword had a simple to guess password, 47 people knew the password, or some other idiocy like that, then I have no sympathy...and I will continue to be a happy PayPal customer who has conducted thousands of dollars worth of transactions (both directions) and had no problems what so ever.
I do notice that the referenced note is long on inuendo and short on facts, and that in itself makes me suspicious.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
Being hard to contact isn't fraudulent, but I believe it is a good indication of possible fraudulent behaviour. Sort of like when a store quits answering the phone all of a sudden for weeks on end... you get this feeling that something isn't right there. And, strangely enough, it's never failed for me.
And if paypal wants to be an internet only company, fine. They should act like it, though, and get the asses moving on the emails. An internet only company should have given him an answer in under 24 hours. If any internet only company takes more than 48 hours to get something done for me, I get antsy.
This guys been waiting weeks! I've seen letters cross the atlantic and pacific oceans faster than they respond to problems.
Saying "Don't like it? Take your business elsewhere." is a cop-out. I'm soon going to be running a computer company, and if it were broken into and a customers machine stolen, I wouldn't tell them "too bad, and don't bother talking to me again". I'd probably go to jail.
So, if I can't cop-out, why can PayPal? Because everyone "knows" they're a bunch of crooks? That's a pathetic excuse.
[ And yes, I do do my business elsewhere. I'd rather give the crack addict my money to look after than PayPal. At least I'd know where it ends up. ]
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
How much money should someone be allowing to accumulate in a Paypal "donation" account? I ask because I think that anyone who lets the account grow too much (like beyond $100 or one transaction, whichever is greater) is begging for trouble. I know that there are transaction fees when you take money out of the account, so were the Abiword people being cheap by not withdrawing earlier?
For example, if there is a 2.9%+$0.30 charge to receive $100 from the account (see Paypal for details), that would be a charge of $3.20 leaving $96.80 in the check I assume they would send out. Even at $50, you're looking at $2.25 with $47.75 of actual money coming at you.
Clearly, were I running the deal I wouldn't be leaving money in this "fund" and I think that Mr. Lachowicz was a damned fool to do so, whether Paypal is generally believed to be a security risk or not.
Frankly, I have more sympathy for someone who loses $30 or $40 from their Paypal account because of this kind of fraud than I do in this case. Someone who loses such a small amount of money could have had some valid reason to have the money in their. Someone who leaves $800 sitting around, doing nothing (savings account interest rates are small, but Paypal interest rates, well, are nonexistant), probably needs a lesson taught to them.
Blaming Paypal alone would be a mistake.
So was the early subscriptions system a lure to get as many Slashdot fellow readers as possible into using PayPal ?
That really stinks. I wish Dom the best of luck getting his money back.
But, I'm not going to cancel my PayPal account over this just yet. I've had the account since the service began (remember when it was for Palm Pilots?). Never had a problem. I treat PayPal with kid gloves because they are not regulated the same way banks are (and they shouldn't be: they are a payment service, not a full-service bank), and they are a huge hacker's target.
Here what I do with my PayPal account (I use it quite a bit on eBay for buying and selling):
1) Set up a separate bank account for PayPal. I have a money market fund whose sole purpose in life is to transfer money between paypal and my regular savings account. I transfer the money out at least once a month or so.
2) never give PayPal any more information than they need. Give them one credit card (preferably exclusive to PayPal with a PO box billing address). Don't sign up for the piss-ant Money Market fund that requires giving them your Social Security Number. No extra emails, phone numbers, or mailing addresses. Change password often.
3) NEVER UNDER ANY CIRCUMSTANCES leave a balance in your PayPal account. Because it's PayPal's money, not yours, until you take it out (remember, it's not a bank). Withdraw immediately. Even if you need to pay for an auction later, use your bank/credit card to pay for it. (I use a Citibank card that gives a cash back bonus, so I actually get a small benefit from doing this.)
4) If they send you a free Debit card, cancel it. Don't sign up for the credit card either.
You have to keep in mind also, PayPal can freeze your money at any time. All that has to happen is someone file a complaint against you. They can lock your account. They can do various silly things.
I don't want to "blame the victim", but if your money is not in the PayPal account, it can't be stolen. And if there's a fraudulent charge on your credit card, it can be taken care of with a signed affidavit, or maybe just a letter, like any problem with your card. Your card has consumer protection laws associated with it, your PayPal account doesn't.
I did have one of my other cards stolen once and used on PayPal (had nothing to do with my paypal account, the perp opened his own). I wrote them and received a response and an affidavit to fill out, the next day. In fact, all my PayPal customer service mails have been answered the next day. (I have a "premier" / "merchant rate" account, which gets better treatment, ymmv).
By this point, with all the horror stories out there, I'm surprised anyone would keep a balance in their PayPal account.
"...system is notoriously insecure"
Bullshit. How about "I had an insecure password", or "I responded to one of those emails from a scammer that claimed to be PayPal", or "Another system I use was compromised and I stupidly use the same password everywhere" instead?
I'm gonna guess one of those scenarios is more likely than any security failing on PayPal's part. Certainly if there was a security hole in PayPal itself, there are much bigger fish to go after -- any of eBay's Power Sellers, for instance, probably have much more than $500 or so in their accounts at any given moment.
NO CARRIER
Comment removed based on user account deletion
It's the same question that affects the banks: who pays who?
The bank offers the service of holding your money in a safe location so that you don't have to worry about losing it. The bank also provides money services that require a certain amount of trust - chequing, lines of credit, etc. You pay the bank for these services.
On the other hand, you are providing the bank a service too. You allow them to use your money (for many reasons) and, in exchange, the bank pays you for this service in interest (although, not very well).
A bank requires trust not only from those who bank with them but also with those third parties who interact with customers of the bank. A cheque (and credit cards, too) only works if everyone trusts that the bank system works (sure, you can overdraft on a cheque, but the bank will report that).
PayPal _is_ a bank by definition. They can skirt around the issue as much as they want to, but they are a bank. More importantly, they are a (or should be a) trust. That is, everyone _trusts_ that PayPal is honest to the core - that you can trust them to hold your money and provide the services that they offer in a legitatmite and honest way.
They are not a savings bank, however, and should not be required to fall under the same laws as a savings bank. They are not (should not) be required to provide insurance on deposits and they should be allowed to verify all transfers and 'money movement' at their discretion.
The abiword theft doesn't make sense - did this person steal a password or something? Did (s)he compromise the PayPal system in some way? If the former is true, PayPal would not, necessarily, be liable - the person who stole the password would be. If, however, there was a security compromise, then PayPal should be accountable for the money - they should put the money back and sue the thief.
--
I want to touch on something that I've read alot on sites like paypalsucks - the issue of PayPal "double-dipping" and taking funds without permission to settle accounts.
IF YOU ARE STUPID ENOUGH TO AUTHORIZE ANY COMPANY TO DIRECTLY WITHDRAWL / DEBIT MONEY FROM ANY OF YOUR ACCOUNTS THEN YOU GET WHAT YOU DESERVE.
Don't be so fucking stupid and ignorant as to give _ANY_ company the keys to your accounts. So what if you have to enter your credit card # on each transaction? Or send a cheque instead of allowing them to directly withdrawl from any bank account. Don't get me wrong, if PayPal takes your money without authorization then it's still wrong on their part - you just helped it along. By not authorizing them to save your information you catch them in a much tighter corner.
In the end, it's all about trust. If enough people stop trusting them then they will either fold up or mandate themselves under the same laws that control the banks.
Price, Quality, Time. Pick none. What, you thought you had a choice?