Assessing Criticism of PayPal

PayPal serves the small business market. Right now they may seem to be riding high, having just completed an IPO (Initial Public [stock] Offering) with a market capitalization of $1 billion (at least this week). But over the past couple of years, they have attracted a number of vocal critics. One of my readers wrote this week, "I'm convinced they are setting up a LOT of people for a HUGE scam." They're defending themselves against several lawsuits and some of the anti-PayPal websites are pretty in-your-face: PayPalWarning.com and PayPalSucks.com. 

How are merchants like you and me to decide whether or not to trust PayPal? How are we to understand and evaluate the criticism? This week I spent several hours on the phone with PayPal's VP of Corporate Communications, Vince Sollitto, PayPal's Senior VP, International, Sandeep Lal., and Dave McClure Director of Geek Marketing for the PayPal Developer Network (yes, that's what he calls himself).

I tried to ask the hard questions raised by PayPal's critics and compare the answers with my own experience as an Internet merchant for the past four or five years. I've also spent hundreds of hours researching e-commerce from merchant accounts to payment gateways. I've tried to get to what I believe is the truth. I'm sure my conclusions won't satisfy the rabid PayPal-haters. But they need to satisfy me -- since I use PayPal for some affiliate payments and take very seriously my responsibility to point my readers in the right direction.

First, though, it's important to understand that PayPal is a brand new kind of entity -- neither a bank nor a credit card, but more of an online payments processor. PayPal has enabled millions of sellers and merchants. The financial services industry doesn't have a neat category for this kind of service yet, nor do government regulations.

PayPal's niche is primarily new, bootstrap businesses run by merchants who have never done business on the Web before -- most auction sellers, but increasingly e-tailers. They allow start-up merchants in more than a dozen countries to take credit cards and sell online in US dollars without having to pay the upfront and monthly costs of a merchant credit card account -- all for 2.9% and a 30¢ transaction fee -- lower for higher-volume merchants (average $1000 per month or more).

To understand PayPal, we need to understand the kind of fraud risks they face. They struggle with two kinds of fraud -- buyer fraud and seller fraud.

Buyer Fraud

In the first kind of buyer fraud, the buyer makes a purchase with a stolen credit card and the merchant ships the goods. Only later does the real card owner make a complaint, the merchant credit card company initiates a chargeback, and payment is reclaimed from the merchant. With the second type of buyer fraud, the buyer uses his own credit card, the goods are shipped, and then the buyer initiates chargeback -- claiming that he never ordered the product or never received it. If you've been an online merchant, you know that the banks automatically rule against the Internet merchant. If there is a question, the merchant eats it -- it's an unfortunate fact of life. Industry experts estimate that 1% to 3% of Internet transactions are fraudulent. I've been fortunate to have a rate of about 0.5%, but buyer fraud is real, and merchant vigilance is the only remedy.

PayPal got a wake-up call in the summer of 2000 when Russian hackers found thousands of credit card numbers. Instead of using them to buy goods and services, they decided to go after PayPal where they could quickly turn these stolen credit cards numbers into cash. They wrote computer programs that opened thousands of PayPal accounts, and then transferred money from one account to another until they withdrew it in cash, costing PayPal $5 to $10 million. Oops. No wonder PayPal is fraud-shy.

To combat this type of fraud, their Chief Technology Officer developed software, aptly named "Igor," that scans transactions looking for patterns of suspicious behavior. When Igor spots something fishy, bells go off and whistles scream (virtually, of course), and a human operator looks at what is going on.

Prevention is the negative strategy. PayPal's positive strategy was to implement a Seller Protection Policy. In a nutshell, so long as a merchant ships goods to an address where PayPal confirmed the buyer, the merchant is not liable for either the chargeback fee or the customer refund amount.

Of course, merchants may decide to ship to unconfirmed addresses, but at least they have some way of assessing their risk. Experienced Internet merchants know that occasional chargebacks are one of the costs of doing business on the Internet. Sad but true.

In 2000 buyer fraud hit PayPal pretty hard. The hackers quickly turned from PayPal to their competitors with the result that most of them went out of business. eMoneyMail.com now limits its e-mail payment service to BankOne members.

Seller fraud

If 2000 was the year of buyer fraud for PayPal, 2001 was the year of seller fraud. In too many instances, merchants would collect payments but not ship goods in a timely fashion -- if at all. Irate consumers would contact PayPal. This resulted in another computer program, this one named "Ilya," who scans for patterns that might indicate a fraudulent merchant -- a sudden influx of payments, sudden high dollar value sales, recent changes to a merchant's address, etc. If Ilya spots a suspicious merchant, a human investigates. Often, a security person will call the phone number given in the merchant's profile or check the address -- and sometimes these turn up invalid. Often this is an innocent oversight, but sometimes it's just plain fraud. To protect buyers, PayPal may have to step in and freeze the merchant's account until they can get it sorted out.

But the result of PayPal's diligence is a transaction fraud rate of 0.42%, substantially below Internet fraud rates as a whole. PayPal has succeeded in their chief goal -- to make the entire PayPal network a safer place for buyers and sellers to do business.

Freezing PayPal Accounts

But freezing PayPal accounts has raised the ire of many vocal critics. How should we evaluate this?

PayPal handles 200,000 transactions per day. The vast majority of transctions flow through the system instantly. Only 1% of those indicate some problem. But 1% of 200,000 is 2,000 transactions per day that PayPal flags for some reason, and potentially 2,000 unhappy sellers or buyers.

PayPal doesn't freeze PayPal accounts as a first line of defense. Often it'll spot a suspicious payment made late at night from a bad IP address. It may be flagged as "pending reversal." This gives the merchant a warning not to ship goods yet, but also means that those funds won't be released immediately to the merchant.

I know something about bad IP addresses. I have personally accumulated more than 50 IP addresses on which I have detected fraudulent transactions through using open proxy servers to conduct IP-spoofing. I check the IP address location (yes, you can do that) against the address of the buyer. I check for a phone number and a "free" e-mail address. If they don't check out, I'll pick up the phone and call or send an e-mail inquiry before shipping. I've been burned far too often to be careless. I can't blame PayPal for being careful -- even if inexperienced merchants see it as PayPal withholding "their" money.

If the antidote for suspected buyer fraud is to flag a transaction for "pending reversal," the antidote for suspected seller fraud is freezing or suspending the merchant's PayPal account until things can be sorted out. This is the only way to protect buyers -- and PayPal -- from rip-offs. Upon investigation, sometimes PayPal finds actual seller fraud, such as selling phony PlayStation 2s and not delivering. More often, it finds evidence of seller inexperience, such as delaying shipment until the merchant can accumulate enough orders to purchase the product at a discount, or some other naive mistake. Sometimes PayPal will require merchants to supply them with identifying documents to prove that they are legitimate. Some merchants take offence at having to fax in their driver's license.

Recently, PayPal has been sued for not thawing frozen PayPal accounts. (See Lisa Napoli, "PayPal sued over frozen funds," MSNBC, February 21, 2002. http://www.msnbc.com/news/712822.asp) I ask Vince Sollitto about the cases. "We feel they are completely without merit," he replies. Time will tell.

In PayPal's defense, however, Sollitto notes that many novice merchants are coming at PayPal accounts with a "consumer mindset" rather than a "merchant mindset." Experienced Internet merchants know that the alternative to PayPal's seemingly arbitrary actions are merchant credit card processors that are more expensive and no less arbitrary. I've had to deal with that first-hand.

What about strident complaints concerning PayPal freezing accounts? Isn't there some truth here? After all, where there's smoke, there's usually fire. I have no way of determining the validity of each case. I expect that sometimes PayPal has acted incorrectly and will need to reverse itself. Sometimes the complainers don't understand or take time to understand, and aren't being realistic.

Customer Service Complaints

But what happens when there's a problem that PayPal doesn't handle right? How can you get your problem addressed in a timely fashion? I've heard a number of complaints from my own readers about repeated e-mails to PayPal that don't get answered promptly. Inadequate customer service is a big PR problem for PayPal right now -- and causes frustration for PayPal members.

Detractors charge that PayPal intentionally makes phone numbers hard to find. I think they're right. I asked Sollitto about this. He responded, rather candidly, "We have two types of customers -- those who pay to use our service and those who don't. Paid customers get an 800 number to which the average response time is 9 seconds. Others must use e-mail to resolve problems. 85% of the e-mails are resolved and closed in 24 hours. 99% within 4 days." He has his numbers down pat. He's had to answer this question before.

Sollitto adds that users are given a phone number and address for complaints when they sign up. I check carefully, and yes, indeed, there is such a number. Is it obvious or easy to find? Hardly.

I decide to test the customer service number given to paying Business and Premium members. Sure enough, there it is, under PayPal's online complaint form, alongside a mailing address. I have to go three clicks deep to get to the phone number and must know where to look, but it's there. I call on a Friday afternoon about 4 pm. A machine tells me the wait time is currently two minutes. Less than two minutes later a real person picks up the phone, asks questions to identify that I am the account owner, and then inquires how she can help. "This is a test," I tell her, "and you pass the test."

Now I call the regular complaint number. By this time, it's about 5:40 pm Friday evening. This number isn't toll free, but I have a low long distance rate and some time. "Please wait for the next available caller," the machine says, but doesn't tell me the expected wait time. I wait and listen to soft rock music interspersed with promos for PayPal's services. Finally, 23 minutes later, a friendly voice comes on the line, "This is PayPal, may I help you?"

In all fairness, I know from calling my Merchant Customer Service phone number that instant response isn't all that common. I've spent literally hours waiting to talk to the right person for this service I'm paying for. Is the existence of poor customer service from my Merchant Customer Service any excuse for PayPal's long wait times? No. But it gives me a comparison to the real world.

"Why don't you put the phone number in the 'contact us' section?" I ask Sollitto.

He replies, "Fraud reports are handled more efficiently for both PayPal and the member when submitted on our online form, not by phone. We're able to offer an inexpensive service because we provide customer service through e-mail."

Then I think about my own experience. For years, I put both my phone number and mailto e-mail address at the bottom of every page on my website. I finally had to move that information to the contact page next to an online form that was much more efficient, with the words "I prefer you to send me e-mail before phoning." That helped cut down substantially on the calls from non-paying but well-meaning readers who wanted to pick my brain for free. The new method works much better for me and allows me to survive and meet customer needs.

I keep pressing Sollitto on the customer service matter. He acknowledges, "We're planning to hire another 50 customer service personnel this year." Good.

Disclaimers and Protections

One of the complaints I see on anti-PayPal websites is that the Terms of Service are not fully disclosed to new sign-ups. That's not true. To sign up, you need to check a box affirming that you've read them. I read through it -- well, "scanned through" is more accurate -- and found that the Terms of Service are quite thorough. They outline 19 different reasons that an account might be frozen. Is this a simple document? No. But it is written in English, not legalese. Of course, the business relationships are complex, not simple.

One of my readers complained that PayPal had too many disclaimers. I look. They have no more disclaimers and clarifications than those contained in the fine print of my merchant credit card account, my bank account, and my consumer credit card accounts (except the latter are always in unreadable 8 pt. type that it takes a magnifying glass to even see, much less read).

One of the problems is that novice buyers and sellers expect to get the same kind of buyer protection from a PayPal account that they do with a credit card. But PayPal is not a credit card, but a different payment option. I ask Sollitto about this. He points out that consumers are faced with many payment options -- cash, credit card, debit card, checks -- and PayPal. Each has its advantages and disadvantages. The consumer needs to know what his protections are with each, and make wise choices.

Apparently, so long as PayPal purchases are funded by a credit card, those purchases receive the same legal protections as do credit card purchases. But if a PayPal purchase is made from money accumulated in the account and NOT from a credit card, then that purchase is not subject to the same legal protections as a credit card.

High Fees

On one of the PayPal-hater websites, someone makes the complaint that PayPal was good until it raised its prices to 2.9% plus 30¢ transaction fee. Prices are too high, says the complainer, and PayPal is raking in the money. This complainer compares PayPal's high rates with "the average merchant account of 1.5%."

I find this complaint ignorant. PayPal's rates are not too high. The average merchant account discount rate in your neighborhood retail store may be 1.5%, but for online purchases the discount rate is usually between 2.3% and 2.5%, occasionally higher, plus a transaction fee of 10¢ to 30¢. In addition, merchant accounts typically assess a $150 application fee, a monthly minimum of $25 in discount rate fees, and a $10 to $20 per month "report fee." On top of that, the merchant has to pay for a payment gateway that charges a set-up fee, costs $10 to $50 per month, and assesses an additional 10¢ transaction fee.

If you're used to free PayPal service, then 2.9% must sound expensive. According to my research, not until you are receiving $1,500 per month does the cost of a merchant account and payment gateway dip below the PayPal cost, and not by very much. And for higher volume PayPal merchants, the rate is 2.2% plus the 30¢. That rate is excellent! The "high fees" complaint is bogus. I believe PayPal's prices are very good for merchants.

PayPal is able to offer these rates because they have aggregated millions of users to lower their own costs and have built a safe community where fraud is reduced. Yes, they've priced it so they make money. But if they don't make money, they're out of business. You and I need PayPal to make money so we can have a great service and increase our options.

Sollitto believes that PayPal's small merchant clients have been overcharged by other vendors because of their low sales volume. "We serve a lot of inherently-risky merchants," he says. "But we provide more service and access to their funds than the next more expensive alternative. We're cheaper than anywhere else." I can't disagree.

Patent Infringement Lawsuit

Now I move on in my questioning to another PayPal problem -- a patent infringement lawsuit just days before PayPal's scheduled IPO, filed by CertCo, a privately held, New York-based online security company. "What about it?" I ask Sollitto.

He replies, "We found it a malicious attempt to disrupt our IPO or extort money. CertCo had their patent for two years, and we've been providing our service for two-and-a-half years. But they sent a letter to us just days prior your IPO suggesting 'we license their patent.'" It'll be interesting to see how the courts handle this case -- and how they handle CertCo.

State Banking Regulation Inquiries

On top of a class action lawsuit and a patent infringement lawsuit, bank regulatory authorities in four states -- California, New York, Idaho, and Louisiana -- are investigating whether PayPal is engaged in a banking business. The charge is that PayPal is a bank because they allow members to retain a balance for future transactions. A court in Louisiana barred PayPal transactions, but on appeal its ruling was overturned before it could take effect.

"What is a bank's business model?" asks Sollitto. "To take deposits at a lower rate, loan out the money at a higher rate, and make money on the spread." He argues that PayPal's model is much different. "We are a payment processor, a fee-for-service business. You give us money, tell us where to send it, and we charge a fee to the recipient for receiving the money. If the recipient doesn't want to pull his money out of our system, we give him that opportunity."

A crucial question that might define whether PayPal is a bank or not hinges on how they handle this money. PayPal members have an opportunity to put any balance in their accounts in the PayPal Money Market Fund and earn interest -- at a top rate. If a member hasn't elected for the money market fund, the balance is placed in an FDIC insured bank.

"We just received a ruling from the FDIC (Federal Deposit Insurance Corporation)," says Sollitto, "that (1) PayPal is not a bank under FDIC guidelines, and that (2) money in member banks on behalf of customers qualifies for FDIC insurance." In other words, according to Sollitto, even though these funds are mingled in the account, in PayPal's records they are kept separate, and that legally qualifies each individual member for up to $100,000 in insurance. (See the press release on PayPal's site. http://www.paypal.com/cgi-bin/webscr?cmd=_ir-release&rid=268046)

According to PayPal's Dave McClure, about 2% of PayPal's revenues in Q4 2001 were based on interest on funds held for others; 98% was fee-based. In 2002 they will earn no money from the funds of others -- either on the money market fund that charges no management fees or on the FDIC insured deposit account where no one will get interest.

I think PayPal makes a good case that they are not a bank. "We need to get together, meet with regulators from these states, and explain our business model," says Sollitto.

It may be that states aren't pressing the investigation so much as jealous banks. Who knows?

Competition from eBay Payments BillPoint

I asked Sollitto about competition from eBay Payments BillPoint, eBay's in-house e-payment transfer network. He notes that PayPal is accepted on more than 70% of all eBay auctions, compared to BillPoint being accepted on 28% of them. He estimates that PayPal is used to consummate 28% to 30% of eBay auctions, with BillPoint used for another 5%. He points out that eBay is competing largely within their own eBay auction marketplace, while PayPal has diversified its base much beyond auctions.

eBay's price point is just about the same as PayPal's, and they, too, offer buyer and seller protections. But at present, only US and Canadian sellers can accept payments made through BillPoint, compared to a much broader international clientele that PayPal has developed.

International Growth

From my vantage point, PayPal is a tremendous asset to small merchants outside the US who want to sell in US dollars and who can't afford a US merchant credit card account. Currently PayPal members can come from 39 countries -- that is, they can buy and sell as PayPal members. But at present, only members from 12 countries outside the US can withdraw money from their PayPal account into a local bank account -- and if you can't withdraw money from your sales, it's hard to run much of a business. Here is a map showing countries where PayPal members are allowed. The dark green countries can withdraw money to a local bank account.

http://www.wilsonweb.com/wct5/images/paypal_countries.gif

I ask Sandeep Lal, from PayPal's international division, how they go about adding countries to this list. "We're adding countries with greatest  'traction,' " he says. By "traction" he means the largest numbers of existing PayPal members. He outlines three hurdles that face PayPal -- and any e-payments network -- as they seek to extend to new countries:

1. A country's financial infrastructure. While western countries have a highly developed financial network of banks, credit card payments, automated funds transfers, etc., less developed countries don't have an easy system to plug into. With a developed financial infrastructure, he observes, if PayPal has a relationship with one bank, it can route funds to other banks within the country. But countries like India don't have an electronic clearing system that enables this. Lacking that, PayPal would be forced to make arrangements with a number of banks, resort to the more expensive SWIFT system, or issue standard checks -- none of which are cost effective with PayPal's price structure.
2. International money-laundering treaties. Most countries are signatories to agreements designed to prevent money laundering. A number of Eastern European countries are not signers -- and Internet merchants and consumers have found them a haven for credit card fraud. You don't see these countries on anyone's list of network member countries.
3. Country financial regulations. Many countries have complex laws that require PayPal to register as a company to do business there -- with stiff costs and responsibilities. Since e-payment networks are a brand new financial model, most countries have to figure out how to handle them.

Fortunately, PayPal has been both diligent and successful in adding several countries in previous months, and plans to announce a new group of countries soon. If you've ever tried to transfer funds from one country to another inexpensively, then you know how refreshing and seamless PayPal's system is. PayPal is doing the pioneering spadework that will eventually ease e-payments transfer to much of the world.

I ask Sandeep about emerging systems in Europe. He mentions NoChex (UK), PayBox.de (Germany, Austria, Spain, UK), and MinutePay (France). I would add PayCash.ru (Russia, Ukraine, Latvia, and the US). But PayPal's 14 million members worldwide dwarf the size of all these networks put together. "Our competitors are finding that they have to go through the same pains as we have," says Sandeep, "but they are constrained by the scalability of their market" -- that is, the markets in each of these countries is smaller than the US where PayPal gained its tremendous momentum.

The Bottom Line

From where I stand, PayPal still needs to work on its inadequate customer service system. Paying customers have a right to expect better, more responsive, service.

But when I consider other complaints against PayPal, I find several of them ignorant or unrealistic in their expectations.

Should merchants be hesitant to trust PayPal as a tool in their business? I don't think so. I think PayPal has a sound business model that they are pursuing aggressively to the benefit of all buyers and sellers. The company is not teetering, ready to collapse.

Instead of just complaining, we need to applaud when something is well done. PayPal provides us all a great service, and I for one am applauding -- even though it's physically challenging to applaud at the same time as I'm trying to balance the phone receiver on my shoulder waiting on hold for customer service.