Implications of Paypal *Merchant Account* Confirm Bank Account transaction.

When a vendor opens a paypal *merchant account* to receive funds the
paypal account is/can be associated with a Bank checking account. My
friend has done just that with paypal and intended for funds to move
at his exclusive and explicit order in one direction---from paypal to
checking.

In due course paypal's robust security architecture asked for
"Confirmation" of the checking account.   They had seeded his checking
account with some microdeposits, simulating "withdrawals *from*
payapal" to his checking account.
They asked him to login to his paypal merchant account with his secret
password and tell them the precise amounts. On the presumption that
these amounts could only be known to the real paypal merchant who
really could access the correct bank checking account they have their
validation---what they call a Confirmation.   But wait.  They seem to
couple that clever double-check with an entirely separate pre-approval
to permit funds to move in the opposite direction---from checking to
paypal merchant account.  Based on my advice my friend selected the
"Agree" rather than "Decline".  Now I feel nervous about this advice.
While "unconfirmed" sounds bad, what he agreed to may be worse.

Q1) In a paypal merchant account associated with a "Confirmed" bank
checking account does the paypal co. gain the *capability* to subtract
funds *from* bank?

Q2) If the capability does exist, but is purportedly "safe" because
the paypal account password is completely unguessable and unhackable
(yah, right), what happens if paypal is hacked?

Q3) Can paypal  itself decide that it *needs* funds NOW, and just
takes them from checking?

Q4) Can the bank be instructed to permanently block all
transfers/debits from checking to paypal?

Basically, I feel I may have hurt my friend's interest by promoting
paypal and then curtly advising him to "Confirm" his bank account. 
Was I wrong?

In providing an Offical Answer please do *not* rely solely on the
paypal website for material about the "Confirmation" process.

---

Clarification of Question by grthumongous-ga on 11 Oct 2005 15:19 PDT

thank you all commenters.  

TechsoEasy, are you saying that in addition to being able to drain
your Paypal_account, the Paypal_Inc people can also drain your
"confirmed" checking account, albeit only $500 at a time?  Please
confirm.

Grthumongous --

My biggest worry would be whether or not your friend was in fact
replying to a spoofed Paypal account.  Many of us without Paypal
accounts routinely receive Spam/fraudulent "Confirm Your Paypal
Account Information" e-mails from offshore sites.

Have you authenticated the Paypal domain?

Best regards,

Omnivorous-GA

omnivorous,
good point.  Spoofing is out of control.
The Paypal domain was authentic.

I got the same confirmation request from Paypal shortly after I did
the linking to my checking account, I got a secon request about a
month later and haven't since. The request is clearly legit, I never
did confirm that request and I have not had any problems because of
it. I don't think Paypal a reputable company would withdraw funds from
your account without your authorization.

Now, that said. Because of the way the banking system is set anybody
anywhere in the world can withdraw funds from your account and nobody
can do anything about it as long as they abide by certain rules. I
learned this the hard way, for obvious reasons I won't post how it is
done. I don't think any real company would withdraw funds from your
account, just not worth risking a multimillion $ bussiness for a
couple hundred bucks.

Don't forget that many people use their paypal account to pay for
things, and link it diectly to a credit card or bank account.  I
certainly went through exactly the same process as your friend only in
reverse - paypal hit my credit card with a couple of very small
amounts.  I don't know if they assume that a merchant account may be
used for payments as well as receipts.

You might want to read http://paypalsucks.com/sitemap.shtml   IMHO
this is mostly people expecting paypal to take over the credit risk
that they have set up by shipping second-hand computers to Russia etc.
 You could be reassured that they are mostly whingeing about paypal
reversing a receipt IN PAYPAL thereby leaving them with a paypal
overdraft, not paypal debiting their bank account with the amount
they'd "received" from their defaulting customer.

On q4, if I were your friend, I would ask the bank.  Paypal could only
withdraw money from his account if he has given it a general
permission to do so.

Don't think for a minute that PayPal provides a TRUE "merchant
account", a term most often associated with the major credit card
issuers such as VISA or NOVUS, or AMEX.  These traditional merchant
accounts are significantly harder to get, but for good reason... the
credit card companies have a dual responsibility to both the
cardholders and to the merchants... neither of which they want to lose
since both are their customers.

If you run a business which relies on accepting credit card payments
for the majority of your transactions... be aware that PayPal can cut
off your account WITHOUT notice.  The traditional merchant accounts
would NEVER do this (which is why they are more stringent in accepting
new merchant accounts) because they understand that your business is
at stake.  If there is a dispute from a customer through a traditional
merchant account, the merchant has the right to answer the dispute or
there will be a "charge-back".  Too many charge-backs and the account
will most likely be cancelled... but at least with fair warning.
(Obviously, it would be instantaneous if fraud was involved).

However, two years ago I was just starting a new Internet venture
which I had spent five months developing and had invested tens of
thousands of dollars to get everything ready... the week before we
were to launch the site -- timed with the beginning of the Christmas
shopping season, PayPal (our only means of accepting payment) froze my
account "on suspicion" of fraudulent activity.  They would not provide
me with any detailed evidence of such activity, they withdrew the
$2,000.00 I had in the account, and essentially shut down my business
before I had a chance to even get it launched.  Numerous calls and
letters to their "resolution" department were only met with extremely
COLD response... I was apparently guilty of something for which I was
given absolutely NO information about.

After the fact, my own analysis of the situation was that a part-time
employee I had hired may have been doing some fraudulent trading on
EBay, and because he did some of that while logged into my network, I
was presumed to be involved.  Even though I fully cooperated with
PayPal, I never was able to restore my account with them.  The delay
in launching, plus the confiscation of my funds from my PayPal account
(which were NEVER returned) ruined the company.  It took us another
three weeks to secure an alternate payment method (these things are
much easier now for many on-line merchants, but still problematic). 
By this time, we missed the opportune selling period for the holiday
season and were never able to recover.  Obviously with a lesson
learned.

So, I'd be less concerned about PayPal withdrawing funds from your
account (they actually can only withdraw up to the amount you allow --
usually around $500.00) but much more concerned with relying on them
as a payment processor for your customer transactions.

You won't be able to completely block ANY merchant account provider
from debiting your checking account since that's one thing they can do
to protect themselves against dishonest merchants... and there are
plenty of those as well.  My suggestion (and that of many small
business consultants) would be to open a separate "Merchant" bank
account for these funds to swing through.  This means a
double-transfer of funds... but it would keep your primary account
safe from being debited without notice.

Good Luck!

TechSoEasy

No, I am not saying that they can drain your bank account...
however... I do recommend that you use a separate sweep account for
ANY merchant transactions, including PayPal.  Check with your local
bank about this because it's a common practice.

TechSoEasy