Consumer complaint received 2023-09-19
Company: Paypal Holdings, Inc
State: VA
Product: Money transfer, virtual currency, or money service
Sub-product: Mobile or digital wallet
Issue: Managing, opening, or closing your mobile wallet account

Complaint:
Details of the Experience : Starting sometime around 2023, whenever I logged in to access my Paypal account online through a web browser, after entering and verifying my credentials, I would be blocked from progressing to my actual account management by a " Add your phone number '' screen. This " add phone number '' page had been popping up prior to 2023, but previously there was always a small " skip '' option provided ; whereas now there is no way to progress without entering a phone number. This means I can not access my account at all unless I give Paypal a phone number. I have had this account for many years, possibly a decade or more, so long that I can not remember even the number of years, and in all that time I have always made use of Paypal 's services through a web browser without the need for a phone number, nor do I have any desire to provide XXXX to this company. Yet now they are forcibly and illegally violating my rights and the rights of " hundreds of customers '' ( in its own representative supervisor 's words ) by blocking access to their customer 's accounts unless a phone number is entered. In addition, knowing that this is illegal, they are lying about this when being asked by their customers. 

Without the means to access to my account, I am blocked from everything including online customer support. The only recourse Paypal left to me was the XXXX hidden on their website, through which I contacted them. 

My first call and second calls were disconnected halfway after an automated answering service picked up, before I could even talk to an agent. On my XXXX call, the very first thing the automated service demanded is " the last XXXX digits of your social security number ''. I want to make it clear that I have never provided my social security number to Paypal, and due to security and privacy concerns, wished to provide this to them EVEN LESS than my phone number. However, just like the " add phone number '' page was illegally blocking total access to my account, this " XXXX digit SS # '' demand by the answering system was illegally blocking total access to customer service. It is literally the first thing that the automated system demanded when the call finally went through, and I was offered no option to bypass or speak with a representative. Since the XXXX number was the last and ONLY option left to me to even contact Paypal after my access to my account was blocked by the " add phone number '' page, I was forced to capitulate and provide the last XXXX digits of my SS #. Then and only then was I asked for other information to identify my account, including the last XXXX digits of a credit card that I had used or is using with Paypal on my account. 

After providing both my bank account and credit card number that I had on file with Paypal, I was abruptly forwarded to a representative, " XXXX ''. When I explained that I was blocked from accessing my account by the " add phone number '' page, and very clearly stated that I do NOT wish to give Paypal my number, she tried to stonewall me by saying, there is nothing she can do to remove the page block because " that's the system ''. When I stated that without access to my account, I can not do anything, not even close the account, she tells me that she can close the account for me over the phone. I reiterated I would need to manage my account first to arrange payments before I can close it, she finally said she'll check my account and see if there's anything else she can do, then mentions that there is a " security check '' placed on my account. She informs me that I need to answer some questions with " publicly available information '' to bypass it. Due to past experience, the ambiguous wording of her " security check '' misled me to think that she was asking the questions to verify that my caller identity as the actual account holder. Naturally I raised the question of why the previously provided bank account and credit card numbers were not enough to identify me as the account holder, and she merely brushed the question aside by stating that's how the system is setup and I would need to answer the questions or there is no other way. When I pointed out the security risk and sheer inanity of using " publicly avaiable information '' as a way of verifying account holder identity, she again used " the system '' excuse and reiterated she will not provide an alternative. Thus I was misled into thinking that I needed to answer these questions in order for her to check my account and be able to provide service to me at all. Thinking I had no choice, and under the false impression that I was merely verifying my identity as the account holder, I again was forced to capitulate and proceed with the questions. She the started to ask me a series of questions, though really it was all along the lines of " which of the following information is associated with you ''? Each time I was given a group of answers and asked to choose the one, if any that had any association with me. The first and second group consisted of street addresses, then there was a question of a person with a name I didn't recognize, and information presumably related to them. After XXXX of these groups, in which over half of the information I did not associate with me, the representative informed me that I had failed the security check and she still could not remove the phone number requirement for my account. 

When it was obvious I wasn't going to give up easily, " XXXX '' stated she will forward me to a supervisor who might be able to help me with this. After more waiting, I was forwarded to a supervisor who provided his name as " XXXX '', ID # : XXXX. It was obvious I wasn't the first person who had called in about this issue, and he was used to dealing with it. Immediately and without my prompting, he stated that he was aware I was calling about my inability to access my account without providing a phone number and " yes, I know this is a discrimination against handicapped people and against people who can not afford phones ''. And indeed, Paypal 's practice of forcing phone numbers and blocking account access was also violating the rights of said people, in addition to my privacy violation. It's clear someone else already informed him of those things, and he and Paypal is well aware of the violations, yet is purposefully carrying on with the practice. When I informed him of the additional privacy violation, he immediately agrees to that as well, and then proceeded with lying straight to my face, by telling me that the " add phone number '' page blocking account access is actually a " technical error '' that they " don't know how it happened ''. He admits that it's " been going on for months '' ( consistent with my personal experiences ), and when I questioned why it took months to fix a simple " error '', he perpetuates the bald-faced, flimsy lie by stating " Do you know how many customers we have? We have XXXX  of customers, it will take a long time to fix this ''. I was temporarily speechless, stunned into silence while deliberating which I should point out first : his sheer lack of intelligence that made him think that I would believe such a poor lie, or his sheer lack of respect in repeatedly, flat out lying to my face. He wants me to believe that Paypal unintentionally removed the " skip '' button on the " add phone number '' page that forcibly blocks customers ' access to their accounts and it would took literal " months '' and they still haven't fixed it for everyone affected because Paypal has " XXXX  of customers ''? Never mind the fact that it takes a mere second to add or remove XXXX line of code, all of this is in direct contradiction to what " XXXX '' the representative before him just stated to me. Before I could do either however, he attempts to mollify me by saying that because I have now contacted them about this, he will now " elevate my account to the front of the line with the technical team '', so the issue should be fixed for me within " XXXX hours ''. When I verified with him that this means I would be able to access my account without providing a phone number after XXXX hours, he then changed tune and said, " well XXXX hours *at least*, give it a week. '' Then he told me to call them again if it's not fixed. 

It has now been well over a month since that phone call. I have checked after XXXX hours, after a week, after XXXX weeks, and today. Nothing has changed. The same " add your phone number '' page still pops up in the exact same place after verifying my login credentials, and there is still no way to bypass it without entering a phone number that they will accept. I should state that I have actually tried to enter a phone number, the same phone number that I called Paypal with that day, which was my secondary phone number when I didn't wish to give out my primary, and Paypal 's system will not accept it. I informed the representative " XXXX '' about it at the time, and her only response was a mere " mmmmh ''. 

Before I ended the call with supervisor " XXXX '' that day, after he promised the " XXXX hours '' resolution to the " add phone number '' issue, I had also raised the issue with the phishing questions that were asked to me by the previous representative. At the time I had still believed that the questions were meant to confirm my identity as the account holder, and so I only pointed out the illogical and dangerous problem with using " publicly available information '' to confirm account holder identities. I asked why it wasn't enough that Paypal already had my bank account and credit card numbers and that I had already provided those when the system wanted them to verify my account holder status. And like " XXXX '', " XXXX '' obfuscated the issue and did nothing to clarify the misconception -- -that none of the information used in the so called " security check '' questions were really needed or used for verifying my account holder status, and he ultimately did nothing to clarify their true purpose to the customer. It was only after the call, I belatedly realized how deeply suspicious and illegal these questions were, that it was all a phishing scheme to pinpoint my personal identity, far beyond what I had already provided to Paypal and beyond what was necessary to provide their services, with information that I never provided and could not even be reliably attributed to me. I do not know the true illicit purpose of these privacy violating phishing schemes and information extortions that Paypal has going on, but I do know that it is deeply illegal and I am very angry. 


Summary of Violations I am writing to report the egregious violations by the company providing the virtual wallet payment service known as Paypal, primarily consisting of XXXX issues : XXXX. Illegally extorting and extracting personal information and violating privacy rights and financial rights by blocking customers ' access to their accounts unless a phone number is given to Paypal. 

XXXX. Denying any access to even reach a customer sesrvice representative or contact the company about account issues unless the last XXXX digits of their Social Security number is provided. 

XXXX. Using misinformation and outright deception to get the customer to answer phishing questions regarding personally identifying information that XXXX or XXXX not be theirs, and misrepresenting this as a means to " pass security check '' to allow access to their accounts. The personal information used in the questions was never willingly provided by the customer, and likely obtained through the aforementioned Social Security number and background checks. It is information that they can not even be sure is accurately associated with the customer they are asking, hence the phishing. By their own words, they are using " publicly available information '' in the questions. The exact purpose of these questions was never accurately explained to me by Paypal 's customer service representatives, instead they simply used vague and misleading words like " to pass the security check '' and states that this is the only way to return access to my account without obtaining my phone number. Meanwhile, the entire time I thought the rep was asking the questions to verify that I was the account holder. Even though I repeatedly pointed out the sheer illogic and security risk of using " publicly available information '' to verify if a caller was the account holder, especially since the information in said questions was never provided to Paypal as the customer in the first place, all the representatives merely continued to stonewall and offer no reasonable explanation or alternative. 


# # Note to CFPB # # Please do NOT provide the phone number I have given CFPB to Paypal as it is my primary phone number and would defeat the entire original purpose of this complaint.

Company response to consumer: Closed with explanation