A failure of security systems at PayPal is causing concern for German banks

Heise is a bit nasty with technology, and it's a bit harder to get rid of their thing, but I can read everything without accepting anything.

Putting the "text" back into HTTP, hyper text transfer protocol.

But fraud prevention is not free and has negative returns at some point.

I dislike it when people use "the optimal amount of fraud isnt zero", because it is wrong and makes the underlying problem harder to understand, which is that people like to overoptimize a single desirable property(fraud prevention) without considering other desirable properties(like ease of use and a low rate of false positives for legit transactions)

But I kinda suspect the ROI is higher for social engineering into an online account portal to Zelle a bunch of stuff around vs waiting for ACH transfers. Breach a login vs find an ACH list and transfer stuff out of the high-value accounts without triggering any flags (imagine you had access to that Paypal list - how are you trying to exfiltrate from millions of accounts without looking suspicious?).

I am amazed on how this practical solution can't be implemented for age verification instead of all those ID uploads etc.

And because of that we have leeches like Sofortüberweisung. They basically proxy the web interface of your bank and you'll give them full access to your account, so they do the transaction for you by scraping your banks web interface (and your transaction history) and report success to the vendor.

All three of my banking apps offer adresse books.

why couldnt i sent money back? I see the sender and the IBAN

I can even in some cases cancell payments

where are you at?

me france germany italy and switzerland.

Are you from the states or canada? The parent talked about europe.

SEPA transfers are (at least mine have been) max. 1h until the transfer is complete (some limit this to "banking hours"). Instantaneous transfer is common.

It seems to me like there is great variety depending on what bank you use.

API's are common, and even the same between banks now with PSD2.

Tbh, a banking barcode (or EPC QR if you prefer) displayed on the seller's webpage with unique reference + reading it with your phone and making the payment is that internet payment method via giro. The webshop uses PSD2 open banking to get notified of new transactions and knows when it is transferred.

Banks have APIs you can integrate with, which e.g. KDE's money app used to support in the past.

The actual underlying transaction system is extremely well designed and reliable, it's just missing the nice APIs that other payment systems have.

There was a earlier competitor much better than PayPal, called Giro-Pay: https://de.wikipedia.org/wiki/Giropay

It had all the stuff PayPal had at launch, also some of the feature made it into the eventually-died "Paydirekt" (which also died)

The main reason could be the high fragmentatin across the EU market.

Though, WERO, now we have a new appraoch, this time with support von ECB :-D

What giro system are you talking about here? Do you mean the postal giro system that has existed in Europe since the 1960s and has been used for postorder shopping since before the Internet existed? That system was already obsolete in NL last century when we had the first digital invoicing systems via e-mail (and digital personal banking via dial-up), and we've had direct online payments via iDeal since 2005. Are you saying that some countries are still relying on paper-based payment instructions in 2025?

I don't know a single bank that offers an "address book" in their online banking app/website.

Conversely, I don't know a single online banking portal that does NOT offer such basic functionality. Santander, ING, and Rabobank all do.

And because the system comes with a degree of anonymity

What do you mean? Every payment in my bank's transaction history shows the account number on the other end of the transfer.

For example, during Covid when interest rates where negative - some major German banks like Commerzbank charged interest from customers when their balance exceeded an amount like 50000€. Now that the interest rates have gone up - they are not even close to passing on those high interest rates. The same Commerzbank now asks for 50000€ in assets otherwise they charge a 4.90€ subscription charge from their customers.

So yeah there might be technicalities but nothing stops those technicalities being addressed until the law does.

Which is complete nonsense as the transaction is actually forward-payed, and guaranteed by the central European bank, exactly for that reason.

So, in fact, the only reason why certain banks delay payments is so that they can keep the funds "in transit" to earn interests.

Plenty of banks don't play that game, so if your bank does, they are taking the piss and it's time to change.

Charge backs was also always fairly easily done via your bank. Though you did have to call them, so yes PayPal was/is easier. I don't know, the trust in PayPal was always really really low.

EU scale there are tons of solutions: iDeal (expanding to EU from NL), Klarna, sofort..

Each country had a local solution. Direct transfers, or better direct debit, was the common way in Germany. You literally just entered your bank account number and that was payment, the seller would debit it from your account. Zero authentication, and it worked - never had a fraud issue (in the background, I assume sellers checked the delivery address against some database before accepting this, as the seller would ultimately be on the hook for any fraud).

Aside from manual bank transfers (seller ships when the money arrives 1-3 business days later) there were also two systems based on direct bank transfers. One (Sofortüberweisung/Sofort) was essentially institutionalized phishing - you give a third party your banking credentials, they log into your account, snoop around a bit, wire the money to the merchant using your credentials and confirm to the merchant that your account has enough money and the wire is happening. The other was a similar service but by the banks, so you'd log in directly at your bank to authorize the transfer.

Most other European countries had other local systems that covered this need, but there was nothing global. Globally, your best bet for small amounts is unfortunately likely still PayPal unless your counterparty accepts crypto. For bigger amounts, there is Wise and similar services (note that I've had a horrible experience with Wise - KYC asking for things that didn't exist, luckily before they had my money to hold hostage). Wiring directly to accounts with Revolut also works reasonably well.

For transfers within the Euro zone, a regular SEPA bank transfer is easiest, with the only "downside" that you need to ask for the destination IBAN rather than just a phone number or similar that some of the other systems support.

https://en.wikipedia.org/wiki/Wero_(payment)

8 million transactions in only a few months (mostly in France), I wouldn't say "nobody's using Wero"

WERO is an application/UI layer on top of SCT INST payment scheme, which adds some additional features like "send to email" etc. as well as other pay-specific features in the future (pay-per-request, which is also a defined way in the SEPA/EURO rulebooks and processing docs)

This is correct. For some reason, many people (merchants surprisingly!) love PayPal and only accept payments through it, especially those outside the US and UK. Sometimes "guest payments" aren't an option, and that means you either get a PayPal account or don't purchase the product/service.

They blocked me claiming suspicious activity occurred in my account (just a low traffic personal account). Ignoring me wanting to know what suspicious activity was it and if it needed, or actually already was, reported to the authorities.

Unluckily this deletion does not hold well, occasionally with weird merchants only offering PayPal payment - credit card through PayPal - the paying fails using my old email used in the purchase and was used with PayPal before. They keep forcing me to log in. But can't! It is deleted!

I did not trust their sloppy ways then, the feeling is stronger now.

Federal government provided electronic money accounts and transfer systems, along with federal government provided identity verification APIs, where the fraud requires defrauding the government. Basically, a government utility. They do it with passports, why not with digital travel?

Obviously, this has to go hand in hand with constitutional inalienable rights to protect people's access to electronic money accounts and identity verification.