Slashdot Mirror
Abiword's PayPal Donation Fund Robbed
SabberFlapper writes "According to this Announcement to the developer list of Abiword the Abiword fund was robbed. Dom Lachowicz writes: 'I'm duty bound to let you all know that the AbiWord Fund/Tip Jar has
been robbed approximately three weeks ago. I'm telling you this now,
rather than sooner, since I believed that Paypal would do something
about my complaints during the interim, and that this would all be
resolved quietly. Today, 23 days later, this does not look like it will
happen. [..]
I do however, recommend doing several things:
1) Writing to Paypal, in letter, email, or fax form alerting them to
this travesty.
2) Calling Paypal on AbiWord's behalf.
3) Writing or calling your Congressman/woman, pointing out that Paypal
is acting like a bank, but not operating under formal banking laws.
4) Boycotting Paypal because of these reasons, and the fact that their
system is notoriously insecure, and encouraging others to do the same.'" Of all the groups to steal from -- AbiWord?
That's why I hide all of my money in a mattress.
Can somebody explain how this theft occurred. It's not clear to me from the post.
They actually tried to tell me that I couldn't accept a payment without bank details a couple of days ago. When I pressed the only button that didn't cancel the payment I was *then* given the option to accept without adding bank details.
PayPal is like the stock market -- don't put anything in that you can't afford to lose.
is that any business which faces any regulatory liability would not stand by their customers, esp. under a threat of letter writing campagns to congressmen who have the potential to do some real damage via congressional inquiries....
LedgerSMB: Open source Accounting/ERP
Frankly, I suspended my PayPal account months ago. This episode just confirms my doubts about their service. It's like your bank gets robbed and tells you sorry, your account is zero now... I think everyone who owns a Paypal account should write and eventually cancel their own account. It happened to Abiword but it could happen, and i -bet- it's happening, to anyone. They just targeted a substantial account, this time.. Ofcoures it's internet, its point and click, its insecure, bla bla bla but it's real money. People has to realize it's real money. It shouldnt make a difference if they rob my PayPal account or if they rob my house, but alas, it does. Internet has reached a critical mass of people years ago, but still when you do business there you feel like you are not in 21th century, but back in the far west...
I had a paypal account. As soon as I saw the site http://www.paypalwarning.com I deleted it. This was out of simple self preservation, everyone gets bad press, but that much, and to that degree?? I have shown everyone I know that uses paypal that site - I feel duty bound to do so. Veteran Netizens certainly have seen or heard of this site, yet AbiWord decided to use it as their merchant account. Well, you knew the risks didn't you...
Yes, it sucks. It is pretty terrible that donations where robbed. But common sence could have avoided it. You call for a boycott now - well hundreds have been saying this for some time and it was ignored... People have been attempting to get PayPal to have to live up to the same standards of a bank for a long time now. I am sure it is a shock when it is you that gets ripped off but it shouldn't shock you that much that PayPal is being less than helpful.
NR
I hate to jump to "lawsuit!", but this is an instance where a sternly-worded letter from a lawyer might at the very least get their attention. Unfortunately, you'll end up spending more than the stolen funds to pay said lawyer.
Any lawyers out there willing to help out AbiWord pro bono?
One has to wonder if the Abi folks knew about PayPal's failings ahead of time. If so, then had they looked into other ways of obtaining donations? That is to say, if the Abi folks are saying "Look, we knew that PayPal sucked and was insecure, but we used them anyway, so please write them to tell them how much they suck" then it's a little harder to take their complaint seriously.
I've used PayPal for auction stuff. I was fortunate enough to get payments mostly through PayPal from a large USENET auction I held a while ago. But once that big chuck of money was in there (we're talking less than $1k) I had them cut me a check and send it to me so I could put the money somewhere I trusted...a real bank! Even now, I never keep more in the account than I could bear to lose, should something go wrong.
That the Abi folks weren't taking better care of their money hardly seems like PayPal's fault. Many people know PayPal has been difficult to deal with...it's no big secret and it's even been talked about on
I don't want to defend PayPal too much here. They're clearly sleazy sometimes (if not all the time). But that doesn't absolve the Abi folks from being more careful with their benefactors' cash.
Curmudgeon Gamer: Not happy
He says, "...their system is notoriously insecure."
It seems to me that if the system is that insecure, the perps could have found something more lucrative to rob than the Abiword tip jar. I'm sure there are power sellers on ebay that do more business in a week than the tip jar sees in a year.
Perhaps his fund password was something like "abiword" or he responded to a scam e-mail...
Reading the complete post, I see "...Their silence implies to me that they are treating this matter as if I got mugged on the street, rather than as if someone walked into their bank and withdrew my money without my consent."
So it sounds as if it was not a hole but rather an error on Dom's part. I look forward to reading more about this to find out just how this happened.
Comment removed based on user account deletion
Even if they do outsource their support to India, I'd bet they keep some sort of stats about emails and the issues covered...maybe if enough people complain and cancel their accounts someone will listen...unlikely but it's worth a hope.
-tcp
...just as soon as someone explains how the theft occured and why it is PayPal's fault. If the theft occured by someone hacking PayPal, then it is indeed their fault and I will cancel. But if the theft occured because Abiword had a simple to guess password, 47 people knew the password, or some other idiocy like that, then I have no sympathy...and I will continue to be a happy PayPal customer who has conducted thousands of dollars worth of transactions (both directions) and had no problems what so ever.
I do notice that the referenced note is long on inuendo and short on facts, and that in itself makes me suspicious.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
How much money should someone be allowing to accumulate in a Paypal "donation" account? I ask because I think that anyone who lets the account grow too much (like beyond $100 or one transaction, whichever is greater) is begging for trouble. I know that there are transaction fees when you take money out of the account, so were the Abiword people being cheap by not withdrawing earlier?
For example, if there is a 2.9%+$0.30 charge to receive $100 from the account (see Paypal for details), that would be a charge of $3.20 leaving $96.80 in the check I assume they would send out. Even at $50, you're looking at $2.25 with $47.75 of actual money coming at you.
Clearly, were I running the deal I wouldn't be leaving money in this "fund" and I think that Mr. Lachowicz was a damned fool to do so, whether Paypal is generally believed to be a security risk or not.
Frankly, I have more sympathy for someone who loses $30 or $40 from their Paypal account because of this kind of fraud than I do in this case. Someone who loses such a small amount of money could have had some valid reason to have the money in their. Someone who leaves $800 sitting around, doing nothing (savings account interest rates are small, but Paypal interest rates, well, are nonexistant), probably needs a lesson taught to them.
Blaming Paypal alone would be a mistake.
Paypals complaint resolution works like this:
File complaint
Paypal emails other party on your behalf
Paypal receives no response for other party after X number of days(duh)
Paypal deems your money unrecoverable (sorry)
Filed fraud w/ my CC company
CC company investigates (and when they finally stop laughing) remove charge from my CC (thank you!)
Recieve nastygram from PayPal for not initiating the charge back through Paypal for the 10 dollar fee instead of the free service my CC provides.. (dick heads!)
Luckily my CC company came through with no problem. But I was scammed on a PS2 system on Ebay (long story) the sad part is that there were about 20 of us that lost out on the ebay thing. A couple of them used paypal and got nothing! and since they didn't use a CC (which paypal would rather u use a straight bank transfer) they got screwed. Got nothing back. Sad.
Thank you. Drive through. (:wq)
So was the early subscriptions system a lure to get as many Slashdot fellow readers as possible into using PayPal ?
To close your paypal account follow that link. I just closed mine.
Then send them an e-mail explaining why. I'm going to now.
P.S. It seems to me the seller of the camera/PDA must have mailed the thing somewhere. Get that address. Contact local police. Contact EBay's fraud division. ETC. I'd be surprised if this money cannot be recovered. In the meantime, I hope Abiword is busy setting up a C2it account.
Like Digital Freedoms? Then donate to EFF before they're gone.
That really stinks. I wish Dom the best of luck getting his money back.
But, I'm not going to cancel my PayPal account over this just yet. I've had the account since the service began (remember when it was for Palm Pilots?). Never had a problem. I treat PayPal with kid gloves because they are not regulated the same way banks are (and they shouldn't be: they are a payment service, not a full-service bank), and they are a huge hacker's target.
Here what I do with my PayPal account (I use it quite a bit on eBay for buying and selling):
1) Set up a separate bank account for PayPal. I have a money market fund whose sole purpose in life is to transfer money between paypal and my regular savings account. I transfer the money out at least once a month or so.
2) never give PayPal any more information than they need. Give them one credit card (preferably exclusive to PayPal with a PO box billing address). Don't sign up for the piss-ant Money Market fund that requires giving them your Social Security Number. No extra emails, phone numbers, or mailing addresses. Change password often.
3) NEVER UNDER ANY CIRCUMSTANCES leave a balance in your PayPal account. Because it's PayPal's money, not yours, until you take it out (remember, it's not a bank). Withdraw immediately. Even if you need to pay for an auction later, use your bank/credit card to pay for it. (I use a Citibank card that gives a cash back bonus, so I actually get a small benefit from doing this.)
4) If they send you a free Debit card, cancel it. Don't sign up for the credit card either.
You have to keep in mind also, PayPal can freeze your money at any time. All that has to happen is someone file a complaint against you. They can lock your account. They can do various silly things.
I don't want to "blame the victim", but if your money is not in the PayPal account, it can't be stolen. And if there's a fraudulent charge on your credit card, it can be taken care of with a signed affidavit, or maybe just a letter, like any problem with your card. Your card has consumer protection laws associated with it, your PayPal account doesn't.
I did have one of my other cards stolen once and used on PayPal (had nothing to do with my paypal account, the perp opened his own). I wrote them and received a response and an affidavit to fill out, the next day. In fact, all my PayPal customer service mails have been answered the next day. (I have a "premier" / "merchant rate" account, which gets better treatment, ymmv).
By this point, with all the horror stories out there, I'm surprised anyone would keep a balance in their PayPal account.
"...system is notoriously insecure"
Bullshit. How about "I had an insecure password", or "I responded to one of those emails from a scammer that claimed to be PayPal", or "Another system I use was compromised and I stupidly use the same password everywhere" instead?
I'm gonna guess one of those scenarios is more likely than any security failing on PayPal's part. Certainly if there was a security hole in PayPal itself, there are much bigger fish to go after -- any of eBay's Power Sellers, for instance, probably have much more than $500 or so in their accounts at any given moment.
NO CARRIER
...under US federal banking laws and this article from CNET explains why better than I could.
1. No, you shouldn't be worried about it, BUT you shouldn't be giving Paypal your bank account information. You should only be dealing with Paypal on the basis of a bank-issued credit (not debit) card.
2. If you have more than $50 in Paypal, you should take it out immediately. You shouldn't keep a balance with Paypal. If someone buys something from you and the money goes to Paypal, just take it out ASAP (though if they are small transactions, for convenience you might want to wait until you are up to $50 or so).
3. There are indeed viable alternatives to Paypal. One example is Bidpay from Western Union. There's no account balance, you simply buy a Western Union money order (online, of course) and they send confirmation to the seller who can then be assured that their money is on the way. Each transaction is its own beast and nobody leaves any money hanging with them. Some of the above messages contain other alternatives.
4. I don't know if Paypal has to change. I think the consumer perception of them is the problem. Too many people think of them as a bank when they clearly are not. They can't even be confused with a bank if people would simply maintain ZERO balances with them and use them purely as the money middleperson as they were originally intended.
Of course, Paypal has a tendency to foster the impression that they're a bank, so their marketing can take some blame as well.
It's all about education. If somebody isn't giving you interest on money they're holding for you or isn't federally insured - i.e. credit unions, banks, savings and loans - you really need to either move your money elsewhere or, as in my case, SPEND IT.
My wife opened a Paypal account for me, and one for herself, then transferred $6,000 from my account to hers. We didn't see that money again for three months, as they pretended to be "investigating" the transaction for possible fraud. Never mind that we talked to them many times on the telephone, and send proof of our ownership of the accounts several times, and pleaded with them to resolve this, as we needed the money.
The delay was beyond any point of being able to pretend that they actually made any effort to resolve the situation. It was in fact more than 10 days after we first contacted them before they would even open what they call an "investigation". They claim that their procedures are set up to combat fraud, but it's just a way of establishing deniability. That is, they pretend that they have no intention whatever of stringing me along as long as they can, while they collect interest on my money. (And no, they never did offer any compensation for the lost interest, let alone the many hours we were forced to spend pursuing them, to get our money back.)
You think mine is an isolated case? It is by no means. Just do a web search for paypal+complaint. See all the distressed people. See the lawsuits.
It's a transparent scam: by locking up the money of only a certain percentage of their customers, and treating the rest reasonably well, the people who claim that Pay Pal engages in a pattern of sleazy misconduct will never be believed, because they will always be outnumbered by customers who have never had a problem.
That doesn't make it right.
Life's a bitch but somebody's gotta do it.
I'm not sure what others' experiences have been with this company, but I'm looking into getting it myself... A new company, called NetSpend (www.netspend.com) is offering reloadable MasterCards which you can either put money onto at any store or check cashing location that allows it, or get money deposited to via online transaction... The bonus, of course, is that you can access your money directly (while paying the average $1-$2 fee for ATM usage), and a paltry $20 per year charge to maintain your account...
The only apparent drawback of the program is that you can only transfer funds from one NetSpend account to another, so of course, your buyers/contributers need to have a card themselves... Considering that the fee is extremely low, and the fact that NetSpend is on the BBB, they seem a bit more straightforward than PayPal... Also, they don't need to pass any credit application procedures, or open a bank account (unlike secured credit cards), it can be extremely simple to obtain.
Another added bonus is that the credit card acts as a secondary form of ID...
Just because you can mod me down, doesn't mean you're right. Shoes for industry!
... since there have been enough paypal bashing for one day, how about folks kicking in a buck or two to raise some more funds for abiword?
Heck, if some nimwit in NYC can raise 20k to help pay off their credit card bill from donations, surely at least $600 can be raised to help abiword? Hell, maybe we can get some of that infamous Slashdot effect directed towards kicking a buck to their back account.
-Bill
SlashSig Karma: Excellent (mostly affected by moderatio
Sure enough Paypal processed the payment to some individual for $6,009. Wife freaks. Writes to paypal, they tell her tough shit, they can't do a thing about it, please ensure she has money in her accounts to fund the transaction.
So the wife cancels her credit card, talks to bank to make sure they will bounce the draft, etc...
Sure enough, next day, a draft for over six grand bounces, first $29 bank bounce charge fee. Pay pal autowrites her a nastygram saying to fund the account, that she MUST fund the account due to her paypal user agreement and they will try again in two days. Wife writes back, DON'T TRY AGAIN. Again, they say there is nothing they can do about it.
Again, another bounce, another $29 fee from bank. Finally, paypal gives up.
Some tips for all that she uses that saved her....
Like another posted said earlier, Paypal is like playing the stock market, don't put in what you can't afford to lose. Just in her case, it looked like she was going to lose much more than that for a while there.
The money belongs to PAYPAL! So the theft was from PAYPAL, not ABIWORD. So it's PAYPAL that should be calling up the FBI. Why haven't they? Because maybe they'd end up being investigated for their shoddy business practices.
now we need to go OSS in diesel cars
Character from Ayn Rand's novel Atlas Shrugged. Throughout much of the first part, it was a widespread fad to ask "who is John Galt?" whenever one didn't know the answer to a difficult question.
Higher Logics: where programming meets science.
Comment removed based on user account deletion
After all, they bought them: Cnet
?sp
So this Jun character bought the camera with stolen money. What I don't get is this. As soon as that transaction went through, abiword should have contacted all parties involved in the transaction and told them to stop. In other words, don't ship the camera, by explaining to the seller that it is being paid for fraudulently. This shifts the burden.
Then, was this money left in the Paypal account, or was paypal just used as a conduit to rip off the bank?
I have to agree with a lot of others, who say to not leave much money in the account. There's just no upside, unless they were saving up to pay a seller who wouldn't take credit card payments.
Finally, to further protect yourself if you need to se Paypal: 1) sweep your account daily, 2) contact your bank and tell them to not allow transfers to Paypal, or 3) attach a bank account to Paypal that has a low balance.
Paypal is not a bank, they don't claim to be. And you can sue Paypal, as a judge ruled their arbitration process was unreasonable , more or less.
Good luck recovering those funds. Go after the transaction endusers, as they have some liability here for receiving stolen goods/ property.
It's the same question that affects the banks: who pays who?
The bank offers the service of holding your money in a safe location so that you don't have to worry about losing it. The bank also provides money services that require a certain amount of trust - chequing, lines of credit, etc. You pay the bank for these services.
On the other hand, you are providing the bank a service too. You allow them to use your money (for many reasons) and, in exchange, the bank pays you for this service in interest (although, not very well).
A bank requires trust not only from those who bank with them but also with those third parties who interact with customers of the bank. A cheque (and credit cards, too) only works if everyone trusts that the bank system works (sure, you can overdraft on a cheque, but the bank will report that).
PayPal _is_ a bank by definition. They can skirt around the issue as much as they want to, but they are a bank. More importantly, they are a (or should be a) trust. That is, everyone _trusts_ that PayPal is honest to the core - that you can trust them to hold your money and provide the services that they offer in a legitatmite and honest way.
They are not a savings bank, however, and should not be required to fall under the same laws as a savings bank. They are not (should not) be required to provide insurance on deposits and they should be allowed to verify all transfers and 'money movement' at their discretion.
The abiword theft doesn't make sense - did this person steal a password or something? Did (s)he compromise the PayPal system in some way? If the former is true, PayPal would not, necessarily, be liable - the person who stole the password would be. If, however, there was a security compromise, then PayPal should be accountable for the money - they should put the money back and sue the thief.
--
I want to touch on something that I've read alot on sites like paypalsucks - the issue of PayPal "double-dipping" and taking funds without permission to settle accounts.
IF YOU ARE STUPID ENOUGH TO AUTHORIZE ANY COMPANY TO DIRECTLY WITHDRAWL / DEBIT MONEY FROM ANY OF YOUR ACCOUNTS THEN YOU GET WHAT YOU DESERVE.
Don't be so fucking stupid and ignorant as to give _ANY_ company the keys to your accounts. So what if you have to enter your credit card # on each transaction? Or send a cheque instead of allowing them to directly withdrawl from any bank account. Don't get me wrong, if PayPal takes your money without authorization then it's still wrong on their part - you just helped it along. By not authorizing them to save your information you catch them in a much tighter corner.
In the end, it's all about trust. If enough people stop trusting them then they will either fold up or mandate themselves under the same laws that control the banks.
Price, Quality, Time. Pick none. What, you thought you had a choice?