Online Finance: Loophole in laws let scammers take buyers for a ride online

Person-to-person online payment services, such as PayPal, have become the method of choice for paying for items bought at Web auctions. Thieves are taking advantage of the anonymity of the Web.

"I'm not an expert," declares Sam Johnson, who lost more than $100 when he used PayPal to pay for hard drives that were never delivered. "But if you ask me, they're acting like a bank and they should be held to the same rules as a bank."

Quick-building a fail-safe system
When you use a credit card to send money through these payment services, the company charges your card, deposits the money into a "stored value account" and transfers the money to the recipient's stored value account.

- advertisement -

When you get your credit card statement, it shows a charge by the payment service -- not by the person you sent money to. This makes a world of difference to credit card companies because, as far as they're concerned, their involvement ends when they transfer money to the payment service.

These payment services work well for people who know and trust each other. Roommates can settle phone bills; co-workers can split restaurant tabs.

"It's not there to guarantee that the two parties are on the up and up," says Paul Jamieson, senior analyst for banking and payment services with e-commerce authority Gomez. "That's fairly clear in the terms and conditions of PayPal's service."

Users can leave money in their stored-value account to trade back and forth. They can transfer it to a checking account when they wish.

Like mailing paper money
Sometimes, in cases of fraud, you can get a credit card company to go to bat for you. Usually the payment service washes its hands of responsibility. This is expressed in the terms and conditions that users are expected to read.

PayPal has a clear user agreements, and anyone who takes time to read it understands the risks.

Find the fine print
PayPal's user agreement emphasizes that the stored-value account is not a bank account and does not fall under banking regulations. PayPal stresses that users are responsible for verifying one another's identity and that the company is not responsible for "disputes that arise between users relating to payments made or any other transactions between individuals."

That's quite blunt and clear. So initially PayPal was sympathetic, but not particularly helpful, when victims of the "harddrives4sale" scam began complaining.

In June of 2000, someone using the Yahoo identity "harddrives4sale" began selling seven sizes of hard drives on Yahoo's auction service (online auctioneers almost never advertise their true names). The seller had a spotless record, according to buyers' feedback posted on the site.

Johnson bought eight hard drives and paid with PayPal, but nothing arrived in the mail. He checked harddrives4sale's feedback, which had plummeted as more than 100 would-be buyers began complaining that they had sent money via PayPal but not received merchandise.

Johnson contacted Yahoo (which never responded, he says), PayPal (which immediately assigned an investigator and a customer-service representative to victims of the scam), the FBI, several news organizations and fellow victims. He has become the hub of an informal e-mail network of harddrives4sale's victims, and estimates that about 150 people were taken for around $10,000.

What if you shout help and no one comes
Another victim of the harddrives4sale scam, Aleksey Maksimov of Miami, complains that no one bothered to help.

"Imagine that in real life you will be robbed at the mall, you try to yell, but mall's security will just ignore you (like Yahoo did) and police will tell you that you need to contact your robber by his fake address and/or mail and try to get your money back (like PayPal did)," he says in an e-mail.

Johnson figures that the thief known as harddrives4sale created several user IDs, both with Yahoo and with PayPal. The thief used fake IDs to boost his reputation on Yahoo Auctions. And it appears that the thief used fake IDs to create at least three PayPal accounts, collecting the money with one, transferring the money to another, transferring the money to yet another, then canceling the middle account.

A suspiciously similar scam happened around the same time on Yahoo Auctions, this time with someone using the screen name "justgreatdeals" who purported to be selling digital cameras and flash memory cards. The victims of that scam call the bogus seller "justgreatsteals," says Alex Leopold, a New Yorker who lost $104 on a pair of flash memory cards that never arrived.

Refunds now, guarantees later
PayPal spokesman Vince Sollitto says the company is taking steps to prevent similar scams. He points out that some would-be buyers were able to get refunds (known as "chargebacks") from their credit card issuers.

"We're developing a broader chargeback system to guarantee against fraud from both ends of the transaction, buyer and seller," Sollitto says. "In the spirit of the fact that we're moving toward that system, we're going to refund the money to the people who were taken in this incident."

PayPal is now "confirming" its users' accounts by testing whether they have been linked to bank accounts, which require Social Security numbers and signature cards to open. If you send money to a confirmed PayPal account, "you're 100 percent protected against fraud," says Elon Musk, head of X.com, which owns PayPal. "If there's a clear case of fraud then we will be happy to make a refund."

Most of PayPal's competitors don't guarantee chargebacks in case of fraud.

Raising the comfort level
ProPay allows users to pay directly with a credit card so they can ask their card issuer for a refund in case of fraud. The credit card statement shows the name of the seller and not ProPay.

"It's a true credit card transaction, which is protected through Visa and MasterCard and through the federal government's regulations," says Brad Wilkes, ProPay's president and founder.

"For e-commerce to grow, people need to have a high level of comfort," Wilkes says. Aiming a dagger at his biggest competitor, he adds: "What's happened with PayPal has not been helpful at all. It's been more of a friend to scammers than to buyers and sellers."

Musk retorts that PayPal has helped to put crooks "in the slammer."

"I'm sure they would disagree" with Wilkes, he says, adding that X.com's security team consists of people recruited from the FBI and detective agencies. "If I were a fraudster, I wouldn't touch us with a 10-foot pole."

He says PayPal's chargeback rate is among the lowest of any online merchant and is comparable to the lower rates typically reported by offline retailers.

Back in the USSR
Meantime, some victims of the harddrives4sale and justgreatdeals scams will have second thoughts before paying online again. They include Maksimov, the Miami resident who compared the scam to a theft at the mall where no one will help. Maksimov moved to the United States from gangster-infested Russia a year ago.

"I thought that law enforcement agencies and customer support services here are more responsible and helpful than in corrupted Russia," he says. "Now I can see that it's not exactly that way and will be very cautious, as I was in Russia."

-- Updated: Feb. 19, 2003