Paypal---watch out!

Real PayPal. It's an option they offer if you don't want to wait.

that was my thinking...

In fairness, it is only an option.

Is it paranoid to want to protect my account details? It gives them FULL access. Every other vendor I have ever dealt with has been able to transact with my account without access.

Here the handheld device and dynamic code is a mandatory requirement.

Well, Terrance, let me dispel you of your confusion.

PayPal, as a merchant services company, needs the ability to pay money into your bank account and, if you want to spend more than you have, take money out of it.

As the barriers to creating a PayPal account are so low; you are essentially anonymous; they need to establish that you own the bank account you want to use for these purposes before actually moving money to or from that account.

Otherwise, you could copy the routing and account number off any check anyone in the world writes you, and steal money from them with PayPal -- just claim it's your account and make a withdrawal! Yes, the necessary information to move money to and from a bank account is written right on every check you write, and nobody is crying doom over this.

So how can PayPal verify this is your account? Knowing your credit card or "CSV number" (sic.) surely doesn't help verify access to a bank account. A credit card need not even be linked to one. This point you brought up is unrelated to the task.

What would work is transferring some secret amount of money to that account, then verifying the person using the PayPal website has access to the account the money ended up at.

So, they give you two options:

1) Provide your online banking login. By doing so, you establish that you own that account, and by retrieving the recent transactions, PayPal can verify that same account is the one they made the secret deposits to.

2) Read your bank statement yourself and type in the amounts of the secret deposits.

Now, PayPal is a big company. Publicly traded. $12 billion a year in revenue. A quarter billion active users. All of which have *already* given PayPal access to their money -- with either a linked bank account or credit card.

And their core service is security and identity. Not payments. What made PayPal successful where their competitors in the dot-com era went out of business was defeating fraud where the others didn't. PayPal knows how to do security.

So the implication that some IT worker at PayPal can steal your bank account surreptitiously is ridiculous. PayPal knows security, internal and external. The connection between you and PayPal is secure. The connection between PayPal and the bank is secure. And random IT workers don't have access to your credentials -- nobody does -- they're never stored or shown anywhere in plain-text. They don't even leave the computers they're temporarily stored on until your account is verified in plain-text at any point -- they make dedicated hardware for this type of application where even the hardware owner never has access to the decryption keys. They can't half-ass this kind of thing either -- the PCIDSS mandates that a company like PayPal have on-site audits on a regular basis by outside companies that ensure they are handling the data securely.

Recurly, one of PayPal's competitors, learned that recently when their hardware encryption system failed and they accidentally let the failure replicate to the backup system. They no longer had a way to decrypt their own stored payment data to process payments for their users.

You forgot the rest of the quote.

PayPal asks for your password every time you log in to the site. Obviously they ask for passwords sometimes. Everyone does. That common saying is advice against giving your password over an insecure channel, like e-mail, where anyone between you and the recipient could read the message in transit.

Wow. Totally forgot about them mentioning that. They mention that they will not ever ask for passwords or sensitive info. But yet there going to now.

Chad

They aren't asking you for it - they are saying "if you are one of those customers who insist on instant verification - here's how you can do that".

It's optional - not required. It's offered as service - not demanded.