0

I have a US bank account and a paypal account. I wanted to withdraw money from my bank account to my paypal account. The first step was to link the account. I did that by giving paypal my account number and routing number. Then paypal made 2 transfers of a few cents. I told paypal what the amounts were, and they confirmed that my account was now linked. I then requested that paypal withdraw X amount of money to my paypal account, and after 5 days, they did.

I was really surprised that my bank let that go through without me having to confirm with my bank that I am okay with paypal withdrawing money. In fact, the only information that paypal needed was my account number and routing number, both of which are public (-ish) information. Confirming the 2 small transfers was just a step to make paypal believe that I owned the account, but my bank never performed a check to see that it is indeed my intention to transfer $X to paypal.

This leads me to my question, if someone has my account number and routing number, can they also withdraw money? Furthermore, is my bank account now under paypal's "control"? Even if I choose to unlink my account, paypal still knows my account number and routing number. Do they now have the ability to withdraw whatever they want for perpetuity?

Obviously I can sue paypal if they wrongfully withdrew money from my account, but it seems odd that my bank even lets it go through in the first place without my confirmation (I only told paypal that I wanted to transfer $X, not my bank). After all, supposedly, I can't just ask your bank to transfer me $X to my account, and have you sue me if that was done without your permission.

3
  • Well, didn't you have to create a login to Paypal, and have to verify that you have access to the bank account by telling them the two small deposits. Anyone trying to use PayPal with your account will have to do the same steps (or have access to your PayPal account).
    – AKdemy
    Aug 4 at 9:18
  • Paypal's policy is the test 2 deposits. Is that the bank's policy? From what I understand, the 2 deposits is not a bank requirement. If paypal decided not to require 2 deposits, would their withdrawal (using the account number and routing number) work?
    – HanMah
    Aug 4 at 9:26
  • Would it be submitted? Sure. Would it be honored by the bank until it was challenged? Maybe. Would you challenge it successfully? Why not?
    – keshlam
    Aug 5 at 2:17

3 Answers 3

3

From a security standpoint, your primary protections are that unauthorized withdrawals would be a civil or a criminal matter and that your bank has a fraud department. Companies don't want to get sued and people don't want to go to jail. Banks don't want to have unhappy customers calling up that their account was cleaned out.

If you give me your routing number and account number, I can withdraw whatever amounts I want from your bank account. At least until the police show up at my door with a lovely pair of silver bracelets for me. Financial service companies are going to have guardrails in place to detect and prevent fraudulent/ mistaken transfers so the most obvious/ straightforward paths to actually steal money are going to be cut off. But criminals will generally be able to get around those controls eventually if they want to.

In the olden days when you paid for virtually everything with paper checks that had your account number and routing number printed on them, this was a much larger potential vulnerability. Your handyman/ dog walker/ grocery store cashier could have read off the numbers on the bottom of your check and decided to rip you off. In the vast majority of instances they didn't. Today, it is much more rare that you would give your account number and routing number out, generally only to companies that you trust.

Could PayPal in 2023 go rogue, save your information even when you tell them to delete it, and then steal a meaningless-to-them amount of money from you? Sure. But that's way less likely than your dog walker in 1983 finding themselves in a financial pickle and using the check you wrote them to steal a meaningful-to-them amount of money from you. And that largely didn't happen.

4
  • > If you give me your routing number and account number, I can withdraw whatever amounts I want from your bank account. At least until the police show up at my door with a lovely pair of silver bracelets for me. ----------------------- That sounds off to me. There are many stories of people who steal something in broad daylight, and then get caught and jailed sometime later. However, I don't hear of many people who withdraw money from randoms account (only to possibly get jailed later). And I know of many situations where people are willing to be jailed for a brief moment with money.
    – HanMah
    Aug 4 at 15:48
  • 2
    @HanMah - It's not particularly common because 1) you don't write a lot of checks to criminals or give them your ABA & routing number, 2) your bank is pretty good at stopping fraud, and 3) it's generally not too hard to arrest people who do this so criminals in need of quick cash choose other routes. But, for example, a famous computer scientist had to stop his "bug bounty" program because people would post the checks they got online and criminals would use the ABA & routing number to withdraw money from his account www-cs-faculty.stanford.edu/~knuth/news08.html Aug 4 at 16:28
  • Oh wow. I guess that answers my question, the account and routing number are enough to withdraw money (until it gets returned). That explains why paypal was able to withdraw money and leaves me disappointing in the security of US banks.
    – HanMah
    Aug 5 at 19:29
  • The bank's security is reasonably good. It's just not visible to you under normal circumstances --- it happens behind the scenes. And a certain amount of lids is built into their business model just as a certain amount of shoplifting is built into a store's business model; it isn't practical to sic lawyers on every kid who, once in their life, swipes a candy bar.
    – keshlam
    Aug 7 at 5:15
3

The PayPal user agreement states that:

"Before linking a bank account, you should review and understand the consumer protection rights and remedies available for different payment sources under the Electronic Fund Transfer Act (EFTA) and Fair Credit Billing Act (FCBA)."

It is also written there that:

"When you use your bank account as a payment method, you are allowing PayPal to initiate a transfer from your bank account to the recipient. For these transactions, PayPal will make electronic transfers from your bank account in the amount you specify."

It was your choice to do so. Although Paypal is not a bank, the company still needs to comply with the same government regulations as other financial institutions (source).

That's why PayPal also writes:

"If we're unable to confirm your identity, you’ll only be able to send money and make PayPal purchases using your bank or debit/credit card, not your PayPal balance."

If you don't trust an institution, you shouldn't agree to the terms and link an account.

6
  • I feel like you are misunderstanding my question. I have 2 parts. 1: Can I personally initiate a transfer from your bank to mine? Presumably not. So, why can't I and paypal can? 2: Since paypal is on the list and can initiate transfers, do they now have the power to withdraw as much money from my bank account as they feel like, forever, with the only safeguard being the ability to sue them after the fact?
    – HanMah
    Aug 4 at 10:20
  • 2
    I think you just have a general misunderstanding of what financial services companies are (which you are not, which is why you cannot simply withdraw from my account). You gave them the rights to withdraw money when you tell them. As soon as you withdraw that right, they can no longer do it. Again, it's the same with any online payments service, brokerage, credit card, .... It's a service they offer, that you opt to use but don't have to.
    – AKdemy
    Aug 4 at 10:45
  • So to clarify, an account number and routing number is enough information for a "financial services company" to withdraw money. But for others, more information is needed. Paypal is defined as a "financial services company" (I assume by following some government regulation), so they can withdraw whatever they want (not necessarily legally, but practically). Am I understanding it correctly?
    – HanMah
    Aug 4 at 15:35
  • 1
    @HanMah yes, basically routing+account numbers is all you need to make an ACH debit, which is exactly how checks are processed as well. These debits are traceable and reversible, so as long as you report fraudulent transactions in a timely manner the risk is not on you, it's on the bank.
    – littleadv
    Aug 4 at 16:31
  • 1
    Reversing a deposit -- voiding a check, essentially -- is a different operation from withdrawing funds already there. PayPal can pull money back into escrow if there's a dispute between seller and buyer. In fact that ability to protect the parties when someone is being unscrupulous a major reason PayPal came into existence. See other Answers about PayPal for more details. Yes, there is occasional abuse, in both directions, but arguably less seller abuse with PayPal and thus more buyers willing to risk buying from strangers they know nothing about.
    – keshlam
    Aug 7 at 2:05
3

Essentially this is the same as an electronic "check". The bank decides whether to accept the unsigned transaction, knowing that if you challenge it they are on the hook for the money and have to recover it from whoever submitted the debit, or more accurately from that party's bank who then recovers it from the account, possibly charging a bounced check fee or equivalent.

Your bank will ignore suspicious transactions or check them with you before paying.

So there's limited risk, though it may be an unmitigated nuisance and there may be some bank fees before it gets straightened out. And it does mean you need to be especially careful about reading your statements to be sure everything is legitimate.

The simplest way to get additional protection is to open a separate account for online access use, and give authorization only for accessing that one. Keep just enough money in it to cover your expected spending, plus enough to avoid the bank's low-balance fee if any. Then, should the worst occur, only this small account is tied up until it gets straightened out. Given the ability to easily transfer funds between accounts, this doesn't add a lot of hassle and it does address the biggest concern.

4
  • This is a little over optimistic - a relative had thousands sucked out of a bank account through some PayPal API bug and the bank did not block the transactions or check with the relative -- but they did reverse them pretty quickly after they were reported as fraud. Aug 4 at 18:26
  • To me, if the bank makes .e whole, that's safe. Maybe not safe for them, but that's their business, literally.
    – keshlam
    Aug 4 at 20:05
  • Agreed, but there was stress and worry (and forms to fill out) and it took over a week for the money to reappear. Nobody reimbursed for the NSF fees either. Aug 4 at 20:23
  • 1
    Granted. Lemme add a note on precautions.
    – keshlam
    Aug 4 at 20:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .