How does PayPal remove money from your credit card account?

Question

If I transfer money between my bank account and someone else's bank account, the process is that my bank sends the money to the other bank account directly (nobody but bank A and bank B involved). But how exactly does PayPal work? I never signed any direct debit agreement that I remember, so they can't be pulling it via that, keeping it for some time themselves, then sending it on to the recipient. What law/rule allows Paypal to pull funds from my credit card account?

Please don't say because I opened a PayPal account, because I realise that. What I want to know is why my bank accepts PayPal's word that I said they could do that, and how my bank knows that I said it was ok for PayPal to take any one particular amount at any one particular time? What, if anything, stops PayPal charging whatever they want whenever they want to my credit card account?

My reason for wanting to know this is to understand what risk I am at if either PayPal, or someone that has hacked PayPal, decides to charge some huge amount to my credit card account?

I'm in the UK, if that matters.

Answer 1

From PayPal's User Agreement:

3.13 Credit Card Information. If your credit card account number changes or your credit card expiration date changes, we may acquire that information from our financial services partner and update your Account.

In theory, what stops PayPal from charging some huge amount on your card is that you could call your credit card company and reverse the charges claiming fraud which would then cost PayPal as the funds would be pulled back and a fee assessed to PayPal.

Answer 2

In the UK there is a significant difference between taking money out of a bank account and out of a credit card account. Banks typically require explicit authorisation before they will transfer money out of a bank account - for example a direct debit agreement. (North American banks are much less strict, and will transfer your money to any reasonably reputable financial organization who asks for it - don't get me started!).

However credit cards run very differently. Essentially the onus is on the vendor to get the authorization, which is why you can sign a credit card slip at the corner store, or give your credit card details over the phone, or fill in an online form, and have your credit card account charged. When you signed the credit card agreement you agreed to let people do this. It's also why the credit card company will reverse a transaction if you claim it was unauthorized.

So essentially PayPal is like the specialty store you phone up to order something and give your credit card details to - they have just as much authorization to charge your account. Your only protection is that the credit card company will investigate any transactions you claim are fraudulent, and will reimburse you if it is- even if they can't recover the money themselves.