PayPal blocked Flipper Zero account with $1.3M | Hacker News Reader

PayPal blocked Flipper Zero account with $1.3M

twitter.com

213 pointsDzheky105 comments

PayPal performed a "freeze and seize" on our account ~12 months ago, netting just over 50k EUR. They then went on a war of attrition, enumerating across distinct companies, shareholders seizing funds across all accounts (including accounts of unrelated companies and personal accounts in Hong Kong and Australia)

No information was given. After the 180 days "freeze" period, they announced that the funds would not be returned, ie: they stole the money.

We lawyered up. Their legal team refused to acknowledge official communications from our lawyers, citing "Customer Privacy Protection".

When we turned up the heat, we were told that our French lawyers (for a French company, and a French account) had no jurisdiction - the account was managed by PayPal Luxembourg.

We retained Luxembourg-based lawyers. PayPal Luxembourg refused to communicate with the lawyers, regurgitating "Customer Privacy Protection".

We lodged a complaint with the CSSF, the Luxembourg monetary watchdog. PayPal finally replied via the CSSF, citing that our account was selling illegal products, ergo the proceeds were illegal, ergo PayPal deserved to keep them.

None of the products they cited were ever featured on our site. They included screenshots of other sites. When this was transmitted to the CSSF, PayPal silently released all funds owed, but continued to defend their position.

We are now pursuing damages; PayPal Luxembourg is now claiming that the CSSF has no jurisdiction over them, because the accounts are French / HK / Australia.

PayPal has an active policy of abuse and racketeering. They know the legal system. They use multiple jurisdictions in their T&Cs to maximise and legalise their theft (IE, PayPal Luxembourg cites UK law in the T&Cs to allow punitive damages for perceived breaches of their illegal contracts).

They know the legal system, and use their multi-national entities to avoid oversight from watchdogs. They know customers don't have the resources to pursue them. We've spent well over 100k to recover 50k, but someone has to stand up to these thugs.

If you're in a similar situation: Don't be intimidated. Get lawyers, and pursue them via the monetary authorities in your country. They have made theft a business model; apply pressure on the entities that can apply pressure on them, and you'll have a good chance to get your money back.

Please consider writing a blog post online, so there's a permanent link to your story online somewhere.

You have described a pretty elaborate system designed to dodge accountability when customers ask questions. You should consider talking to a business journalist as well. Here in Canada, the public broadcaster's website has a "Go Public" section where well-documented customer complaints are publicized. In most cases, the company pays up what it owes, but only after the story becomes public.

https://www.cbc.ca/news/gopublic

sounds like all a shady company has to do to get away with fraid, is to become its own customer and block every criticism with 'cant prove we did it, because privacy' the way crypto scammers do with 'cant prove we did it, because decentralized'

Yeah, I have a similar story myself. They still have my money hostage. You are amazing going to reach out to CSSF tomorrow

That's fucked up! I can't fathom the mindset required to scam people like that, let alone do it at an institutional scale. Good on you for taking a stand, that helps everyone in the long run.

My default reaction to being scammed is to feel ashamed. A cashier took a $10 out my change as a kid, my dad finding out and going back and confronting the clerk was painful. With experience I've gotten more (maybe too much so!) alert to scams, confidence schemes and dark patterns. A lot of them operate at a level of plausible deniability, or even subconscious action, where the person profiting doesn't have to know what's going on.

Last winter the game EFT had a winter marketing blitz, which they paired with authentication servers being down for old accounts ... as a returning player I had to buy a new account to participate.

You spent well over 100k and recovered 50k.

If you were also compensated for your legal expenses in the process, then sure "don't be intimidated" is a calculated risk.

If you didn't, then it seems like you are a loser either way and should just encourage customers not to pay with PayPal. Sharing the story with your customers and other developers does more damage to PayPal than fighting.

PayPal had those kind of problems simce at least 15 years. Why are people still using it ?

What alternatives do we have for global payments? Stripe I already know about. Anything else?

Nice to google something like "paypal sucks" and seeing problems of 20 years ago... Which is why I will never accept money there.

I am not familiar with Flipper Zero, but I can attest from first hand experience that Paypal does not really care about its customers.

I struggled for 3 months to get Paypal to pay out a odd $300 which I received as a refund because I cancelled a newspaper subscription. I am not in the US and had a Paypal account linked only to my credit card.

Paypal said that due to financial regulations in my country my Paypal balance may not be used at all - no withdrawals, sending it somewhere or paying with it. I may only make a payment via my credit card.

In the end I only got my money after requesting to close my account - and since they could not keep my money, the matter was escalated higher. But not before they in all seriousness suggested that I donate my money to an official Paypal charity.

But wouldn't donating to Paypal charity be paying with it? Thus something not allowed?

Probably because they are a russian company [0]. Yes they have an Inc. in the US but most likely the money goes to Russia. They are violating some sanctions.

0, https://twitter.com/flipper_zero/status/1503384490026151938

0, https://www.flipperdevices.com/jobs

They are not Russian taxpayers. Also half of the team is Ukrainian.

And the main issue is the silence from PayPal and complete lack of communication.

I would say what the main issue here is what PayPal allowed them to establish a business account (June 7th) and happily took money from their customers. Now both the company AND it's customers are fuc^W scammed out of their money.

Seems like Stripe doesn't have a problem with them (because they are incorporated in Delaware, not in Russia?)

The team is ethnically split between russian and ukrainian, but that's about it. The company was set up as a non-russian entity way before the war, which is why sanctions didn't cause them much problem when they started shipping the product. Shipping was done through Hong Kong, the manufacturing process (which they went into crazy details about in their blog posts) is done in China.

I don't think the whole "they are a russian company" makes much sense as an argument here. For one, it would he helpful if Paypal actually tried explaining their reasoning, instead of staying silent.

They have been US company long before the war. You are just saying they are affiliated with Russia just because they have many Russian employees? That's right?

Wasn't the company started by a Native Russian? I remember the kickstarter. https://www.linkedin.com/in/zhovner

So was Google by Sergey Brin, who was born in Russia, so what? :)

He was not a Russian citizen living in Russia during that time. So there is a huge difference.

So what's your point then? Everything made by a Russian is bad or what? :)

Flipperzero could have shown more Ukrainians than Russians, but... America could side with the Russians in the conflict and discount the Ukrainians.

so "Everything made by Americans are bad and unreliable for foreign users"

It's a US sanction. Yes, it would be bad for the employee who makes the decision that this account isn't within the sanction's scope. If US government disagrees, the employee will likely go to jail.

It's expected for companies to overdo the sanction considering that under-doing could get employees a long jail time.

Plus, Paypal employees get paid the same whether or not Flipper Zero is within the sanction's scope.

US sanction against what? Against USA company?

Do you know how sanctions work?

What kind of sanction is being violated in your opinion?

Are these rhetorical or you genuinely don't know?

> What kind of sanction is being violated in your opinion?

You are missing the main point.

What if you are an employee and make a wrong judgement call? The punishment is you going to jail for a long time.

It is safer to overdo the sanction. You don't get paid more either way, and there is no chance of you going to jail.

Are there any official sanctions that affect non-Russian companies with Russian-born founders and employees?

Sanction is usually a bit vague. What I think happens is that an employee from Russia accessed PayPal dashboard.

What should you do?

If you are an employee, would you risk a jail time for this?

The answer would be a huge no.

A handful of specifically named entities, and that's about it.

What is your point?

Nope, Pavel is Ukrainian from Odessa region. He's Odessa National Polytechnic University alumnus, you can see it in his LinkedIn Profile.

> You are just saying they are affiliated with Russia

And where did I said that?

Sorry, I misinterpreted your message

No, because they have an office in Moscow and the money ends up going to Russia.

They had a similar issue with Stripe few months ago which was partly resolved (Stripe unblocked 70% of money which was enough to them to go on with production).

Or could it be because of their product? https://flipperzero.one I’d not be shocked if their product danced somewhere on the line of legality. In a similar way that as it’s illegal to own lock pick set in some states, which can be also considered a personal pentesting hardware.

Unlikely. The tweet thread says they asked for compliance information related to the business (address etc), which to me indicates it was sanctions-related.

I don't understand how they left $1.3m sitting in a single account however. Surely they're not paying for bulk h/w component orders through PP.

It's not as cut-and-dry as it seems. Noone leaves 1.3M in an account. When your account starts generating income, they place a 'light hold' on the account - requesting 'reasonable' information.

During this time, you can still receive funds, and you're promised quick resolution. You provide the documentation. They drag their feet. They request more information. They drag their feet. All the while, your account has accumulated more funds that you can't access.

Then, they'll request something impossible, ie: give us proof of delivery (not shipment) of these 500 orders. Inevitably, there'll be one order that was returned / was delivered without signature / etc.

You'll try to reship the customer, but you've got a 3 day deadline. You miss the deadline, and the account gets perma-frozen for 180 days, but you still believe you'll get your funds back.

180 days later, you'll be notified that your funds aren't eligible for return, because you cost them the equivalent of what was in your account due to the time invested by their legal and risk teams - because buried in their T&C they evoke Common Law allowing for punitive damages for T&C transgressions.

It's calculated extortion to seize as much money as possible.

> When your account starts generating income, they place a 'light hold' on the account - requesting 'reasonable' information.

So is the strategy to make nightly transfers out of PayPal to a real bank of whatever you took in that day?

Can't transfer out if the account is under hold.

I mean before it's on hold. Keep transferring out. In other words, don't let 1.3 million sit in there.

Good to know, thanks

What is sanction-related is SWIFT almost frozen in Russia, for all entities, irregardless their presence in sanction lists. So, if one have money on PayPal, he cannot move it to a bank easily. And then cannot pay from that bank back to a Western contractor. Ironically, as the result of that cross-border slowdown, Russians now have big account balances on PayPal.

I had a PayPal support person flag my account for fraud because I asked to speak to her manager regarding a minor annoyance with the way she was handling my case. (She refused and my account was immediately flagged for fraud, my project was paused and they ultimately unblocked it because obviously no fraud was happening, but by this point we’d lost all momentum. I’m 100% certain she did it because she was annoyed with me, I also know there’s not a thing I can do about it)

I’d never trust PayPal with a nickel let alone over a million bucks.

Why on earth would anyone do business with PayPal after all the shady dealings that have been reported over the last ten years?

It has been almost 20 years since I first heard that PayPal probably isn’t looking out for their clients! https://www.somethingawful.com/news/paypal-fiasco-summary/

It's ironic that Flipper Zero - a product in the security space - would use a shady company like PayPal.

What are the alternatives for global payments other than Stripe?

PayPal doesn't care. A lot of artists use it for commissions, since it's really the easiest way to send money from person to person, and I've heard so many horror stories of artists getting their accounts locked for no apparent reason. Some of em get their accounts back after making a big enough fuss on Twitter, but most don't.

I am having vivid flashbacks from my fights with PayPal. I would rather have account at random American bank and going personally to bank to make SEPA payments than ever expose myself to PayPal.

You will have a hard time making SEPA payments from a US bank. Perhaps you meant SWIFT wire payments?

That said, [Transfer]Wise (which is not legally a bank) will assign you American banking details and you _can_ send SEPA payments from there.

I'm not justifying this on any level but I'm also starting to lose sympathy for businesses who get screwed by Paypal. Screwing people by freezing accounts is Paypal's MO. It's their signature move. It's their default behavior. This isn't even remotely secret.

If, after knowing that, you choose to keep your money with that business, that's to some degree on you.

When more than 50% or your customers pay with PayPal, what do you suggest?

There are plenty of other options. Bitcoin for one.

You can come up with all sorts of reasons why this is bad or won't work if you want.Feel free to keep your money instead with a company who you know for a fact has no problem taking it from you then. Again, zero sympathy when the inevitable happens.

In other news, using a payment provider with no contracts and no guarantees for collecting $1.3 million is not a good idea.

Every time someone says that cryptocurrency has no legitimate use case, incidents like this come immediately to mind.

Except the world of crypto is ten times shadier than PayPal.

There you go. I don't think some of the respondents here have operated with PayPal at a large scale.

Web2 payments are going just great! /s

I’ve had a horrible experience with Paypal in the past and I harbor an unnatural hatred for the company. Granted with the size of the customer base most people will be fine, but once Paypal soft lock the account Flipper Zero should have immediately removed the ability to pay via PayPal to limit the damage.

Always limit your exposure and never keeping any amount of money with Paypal that you’re not prepared to lose in the worst case scenario, because Paypal is accountable to no one.

What's the safest way to transfer money relatively anonymously nowadays?

by relatively I mean that I don't care if gov/police knows, but the person who sends/receives money doesn't know me, I just don't want people from games to know me

I've used paypal account with random name like Snarky Snark

and managed to transfer like 300usd, but I'm worried that the next time they may block me somehow

Somewhat regrettably given the connotations also associated, cryptocurrency. In countries where there are legal, regulated exchanges, this pretty much meets the requirements there.

Why regrettably? Also, crypto doesn't mandate anonymity if you go by the original Satoshi whitepaper. You'll have to specifically recommend an anonymous ecosystem like Monero. And at that point, it's like regrettably mentioning American dollars because the Ruble has bad connotations.

> transfer money relatively anonymously nowadays

Monero and that's pretty much it

Russian banks are managing deposits in etherium, and if you want you could send money over in alt-coins, bounce it around through other alt coins some and then retrieve it elsewhere, issue is that you will lose a fair bit on the exchanges with the rates, transaction fees etc

Also, you will need atleast a visa/mastercard internationally enabled card associated to a bank to your name to do any of that. Do that, or buy it personally/insitu from someone

Money order in post office / banks / WU. The place generating the order will usual check your ID but they do not require you to include that info on what's sent to the recipient.

Zelle / venmo are better in cases where you are withing their account limits AFAIK. I'm not aware of either of them having the history of seizing user funds that Paypal has.

Venmo is owned by PayPal and will freeze your account just like PayPal.

I can't believe I didn't know that. Thank you for calling it out.

Even suing them isn’t necessarily going to work. Eg, a class action against them this year ended with a whimper when a CA judge granted their motion to compel arbitration as per their ToS: https://casetext.com/case/evans-v-paypal-inc

Anti money laundering laws forbid banks and facilitators from disclosing the true reason for freezing the account.

If PayPal told them they'd literally be breaking federal law. So a money laundering flag seems most plausible given the silence.

Gotta love George W. Bush and his war on terror. A lot of the bullshit we deal nowadays with money and traveling started on his government

So what's the resolution in that situation? Does Flipper Zero just throw their hands up and lose the money?

They can go public, which is what they've done here and on Twitter.

After that, they have to consider legal action, and it won't be cheap.

Except financial companies are given civil immunity for this kind of thing if they file a SAR. It's effectively a license to steal. And I suspect it has less to do with any actual crime and more to do with the fact that some of the team is Russian.

PayPal should be forced to pay back legal fees when they lose..

That's only if the government instructed them to do it. If PayPal made the decision themselves, it's up to them.

why?

Wasn't it because they basically told backers that "they didn't purchased anything", and instead of focusing on fulfilling kickstarter backers orders, started selling them in shops, so you could actually get the device faster purchasing it normal way in e-store, instead of backing the campaign, which pissed off a lot of people who started complaining and got muted? I've heard that even talking about that on their discord is bannable offense, and everything is either countered with jokes, sarcasm or put under the rug.

Can't confirm - I was a backer and not an early one. My device was delivered all right in fair time.

Not at all — I was a backer a year or two ago (but not quite early enough to get a black unit) and just received mine a month or two ago.

In the last few weeks I read several stories here on HN with the same pattern: "company X blocked my/our account and refuses to give any explanation". Just a few examples of X: Google, Oracle, Citibank, and now PayPal.

What's going on with big companies? Did they just decide to give up with their reputation?

I think it's probably just cheaper not to care. Customer support costs money, lots of money if you have lots of customers. Also, if people depend on your product enough, or rather, if the perceived cost of moving away is higher than the perceived cost of staying, they won't leave. At some point it's cheaper to hire a few lawyers so it's hard to hold you accountable, and to just suck up the few users who actually go through with leaving you over your shitty behaviour.

Maybe a slow break towards corpo-governments? They are starting to realize they can ignore the government and laws without repercussions.

As someone who was defrauded by flipper zero, I am glad that paypal is holding onto this money until after the products are delivered to customers. Zoe told me that my money was forfeit and I will not be receiving my flipper zero because I did not confirm my address in time. L

I find this whole thing confusing. PayPal's very name would suggest that it was initially set-up as a way for friends/acquaintances to split a bill or what have you. So why on Earth would a business use it and especially to the tune of $1.3M??? I'm not very techie so don't all scream at once, but why wouldn't a company use whatever local {Business Bank} is closest to them that has an actual branch??? Something like Fifth Third, M&T or whatever that has an actual SMB component?? I know Wells Fargo can no longer be trusted either, but surely the B2B banking space isn't as bad as the Retail side? Paypal didn't have a separate biz focus until after they hooked up with Ebay, correct? So that would suggest to me that the "holes" in their offering on the business side is very much "caveat emptor?" Or am I missing some essential part of the argument???

This really sucks, I was interested in getting one of these when they come back into stock for my country.

Another notch in the "never use PayPal" belt.

I ordered one just a couple of months ago and received a ship notice a week or two ago. (Delivery expected next week!). It appears they're shipping.

Paypal is f..g scammers

Yikes. Probably has something to do with a regex on the word "hack".

The company that brought us Peter Theil and Elon musk.

This is a Russian company with an office in Moscow. Blocked and done right.

https://twitter.com/flipper_zero/status/1503384490026151938

Do Russian citizens not deserve to make an honest living?

> Do Russian citizens not deserve to make an honest living?

Do Ukrainian citizens not deserve a life free of a war of aggression caused by Russia's invasion? Sanctions are mild inconvenience for Russian citizens compared to what Russia's government is imposing to the Ukrainian citizens. Not that I would defend Paypal though, they are a shitty company.

Russian citizens can earn an honest living after Russia leaves Ukraine and pay trillions in reparations as the result of the killings and the destruction in Ukraine.

This kind of thinking is called collective punishment and ordinarily is discussed as a human rights violation.

> This kind of thinking is called collective punishment and ordinarily is discussed as a human rights violation.

Yes, Russia bombing civilians in Ukraine certainly is a human right violation indeed, that's the collective punishment Russia's government is imposing on Ukrainians citizens.

Russia is punishing its own citizens as well they'll have to collectively pay Ukraine back of all the destruction their government caused, for the centuries to come, after Putin is long dead.

https://en.wikipedia.org/wiki/Two_wrongs_don%27t_make_a_righ...

Sanctions against Russian citizens aren't wrong at first place.

Jesus christ a boycott is not collective punishment.

Are all muslims also subject to these sorts of reparations demands (for the killings and destruction of 9/11)?

> Are all muslims also subject to these sorts of reparations demands (for the killings and destruction of 9/11)?

Islam isn't a nationality.

What about Donbas residents continuously harassed and killed by Kyiv for over 8 years?

Russia will pay for this too, as Russian aggression did begin in 2014, and not just now.

The money from the sale will eventually go to Russia. This post means nothing. They publicly call the war in Ukraine a "special military operation" - like Russian propagandists. And they continue their activities in Russia, answering questions very rudely https://dou.ua/forums/topic/39415/

“We are radically against the ongoing "special military operation" and none of our team members support it. All sensible Russian-speaking professionals in the IT industry adhere to the same opinion.”[0]
Notice the quotes and asterisk around the phrase special military operation.

From a follow-up tweet in that thread: “ We refer to these events using the "officially approved" wording in order to comply with the new law, violation of which is punishable by up to 15 years in prison.”

[0]https://twitter.com/flipper_zero/status/1503384492731510792?...

As a Ukrainian, I don't care if they sell in Russia. This is a boutique product for a very small community. It's not a huge corporation. Let them make a living. The complete absence of common sense in these discussions worries me.

They claim they use the phrase "special military operation" because the law requires them to.

https://twitter.com/flipper_zero/status/1503384498402119690

A lot of the people working on Flipper Zero are Ukrainian, not Russian

Reply on news.ycombinator.com