PayPal Tried to Make Wire Fraud Legal for Itself Through Its Terms of Service

PayPal’s Payment Routing System Is a Toxic Consumer Practice And Americans Should Think Twice About Giving the Company Access to Their Money

“PayPal Acknowledges That Its Internal Risk System Can Restrict Payment Methods and Force Bank Funded Transactions Into Slow Moving eChecks. The Practice May Be Buried in Its User Agreement, but Consumers Should Demand Something Better Than We Put Wire Fraud in the Fine Print.” – Patrick Zarrelli

PayPal built its financial empire on convenience and trust. Connect your bank account, add your debit and credit cards, select how you want to pay, press a button and PayPal handles the transaction. For millions of Americans, that familiar checkout process creates the reasonable expectation that the payment method presented and selected during a transaction is the payment method PayPal will actually use.

Behind that simple interface, however, PayPal operates a much more complicated payment routing system that gives the company substantial discretion over which payment methods are available and how certain transactions are processed. PayPal openly acknowledges that its risk-management system can limit available payment methods and that some bank funded payments can be processed as eChecks, transactions PayPal says generally take four to seven business days to clear and sometimes longer.

South Florida Media recently obtained a customer service message that puts the issue in unusually plain language. A PayPal representative explained that the company’s “internal security system” determined that a particular payment could only be sent as an eCheck, even though the customer had a bank account and credit or debit card connected to the account. The representative explained that PayPal reviews transactions before they are sent and that its security system determines which payment methods are available.

PayPal’s own published policies confirm the core mechanics behind that explanation. The company says it may limit payment methods when a transaction appears unusual, when it wants to ensure sufficient money exists in a customer’s bank account or for another reason PayPal determines indicates possible risk. Its current U.S. User Agreement similarly gives the company significant authority over preferred, selected and backup payment methods.

That may be disclosed contractually, but consumers should not confuse a company’s ability to write favorable language into its own contract with an ethical standard for handling other people’s money. The combination of enormous corporate discretion, opaque algorithms and dramatically different transaction times creates a toxic consumer practice that deserves serious scrutiny.

If PayPal wants to offer an eCheck, there is nothing inherently wrong with that. Put “eCheck approximately 4–7 business days or longer” directly on the final authorization screen, identify the bank account that will be charged and let the customer decide whether to proceed. What consumers should not accept is a financial system so opaque that they need customer service, transaction histories and a lengthy legal agreement to understand why their money is moving differently than expected.

A Debit Card and an eCheck Are Not the Same Thing

The fundamental problem with treating payment routing as an invisible technical detail is that payment methods are not interchangeable from the consumer’s perspective. People select debit cards, credit cards and bank accounts for specific reasons. They may want a transaction immediately reflected against a debit account, prefer the protections or billing cycle associated with a credit card, or knowingly choose an ACH based bank transfer because they are willing to wait.

PayPal’s own documentation demonstrates how significant the distinction can be. The company describes an eCheck as an electronic funds transfer funded by a customer’s bank account. Unlike a bank- unded transaction in which PayPal pays the recipient before receiving the underlying funds from the customer’s bank, an eCheck requires PayPal to wait for those funds before paying the recipient. PayPal says the process usually takes four to seven business days, excludes weekends and holidays and can sometimes take longer.

PayPal considers that difference significant enough to warn recipients not to ship merchandise or provide services until an incoming eCheck clears because they will not be paid if the eCheck ultimately fails. Consumers therefore have every reason to consider the payment rail material to their decision. A payment expected to move rapidly and a payment capable of remaining pending for more than a calendar week are fundamentally different consumer experiences.

PayPal Has Given Itself Enormous Control Over How Consumers Pay

The current PayPal User Agreement deserves close attention because it demonstrates exactly how much authority the company has reserved for itself. PayPal says customers can select preferred payment methods and choose a payment method for individual transactions. The agreement also says that each time a customer uses PayPal’s Send Money feature, the customer authorizes PayPal to charge the “selected payment method.”

But the agreement contains extensive provisions governing situations in which preferred or selected methods cannot be used. For certain automatic payments, for example, PayPal describes a backup payment hierarchy that can include a PayPal balance, bank account, PayPal branded credit card, debit card, credit card and eventually an eCheck. The agreement specifically identifies fraud risk, insufficient funds and expired payment methods among circumstances that can make a preferred or selected payment method unavailable.

There is nothing inherently illegitimate about maintaining backup payment systems. The problem is transparency. Consumers should not have to become experts in PayPal’s internal funding hierarchy to know which account is about to be charged and how the transaction will be processed. PayPal controls the interface. PayPal controls the risk algorithm. PayPal determines which payment methods are available. PayPal writes the User Agreement. PayPal processes the transaction. When one company exercises that much control over somebody else’s money, transparency should increase with that power, not completely disappear behind it.

The Critical Question Is What Happens Before the Consumer Presses Send

The evidence reviewed by South Florida Media establishes that PayPal can restrict available payment methods and process some bank-funded payments as eChecks. The customer service message obtained by SFL Media reinforces that PayPal’s internal security system can make those decisions even when multiple financial instruments are attached to an account.

What the screenshot alone does not establish is that PayPal took a debit card transaction after final authorization and secretly converted that completed transaction into an eCheck. Establishing that specific sequence would require the complete transaction record, including what appeared on the final authorization screen and which funding source was selected. That distinction should not end the investigation. It identifies exactly where the investigation should begin.

When does PayPal make the decision to require an eCheck? What funding method does the customer see immediately before pressing the final authorization button? If PayPal changes the available funding method because of its internal risk system, is that change always displayed prominently before the customer becomes committed to the transaction? Can the customer reject the eCheck and cancel? Those are not obscure technical questions. They go directly to meaningful financial consent.

If PayPal decides before authorization that an eCheck is required and clearly tells the consumer, there is little mystery: the customer can accept the delay or walk away. If consumers can become committed to materially different processing without clear transaction level disclosure, that raises a much more serious consumer protection issue. PayPal should make the answer unmistakable.

“Security” Cannot Become a Magic Word That Ends the Conversation

PayPal unquestionably has legitimate reasons to maintain sophisticated fraud controls. A payment processor operating at its scale faces stolen cards, account takeovers, compromised credentials, insufficient funds, chargebacks, identity theft and organized financial crime every day. Consumers themselves benefit when fraudulent transactions are stopped. But legitimate fraud prevention does not give a company an ethical blank check.

PayPal’s own help documentation says payment methods can be restricted because a transaction is unusual, because PayPal wants to ensure sufficient funds exist in a bank account or because of any other reason the company believes indicates possible risk. That last category leaves consumers confronting an extraordinarily broad corporate decision making system they cannot inspect.

The consumer cannot see the algorithm, evaluate its assumptions or independently determine why PayPal restricted a particular transaction. PayPal knows. The consumer does not. That imbalance makes disclosure more important, not less. A financial company should never be able to answer a customer’s concern about how their money is being processed simply by invoking an “internal security system” and expecting the conversation to end there.

Putting Something in the User Agreement Does Not Make Every Practice Acceptable or Legal PayPal of All Corporations Should Certainly Know That 

Technology companies increasingly rely on massive click through agreements to justify practices that ordinary consumers would never negotiate individually. PayPal is hardly alone in doing this, but the practice becomes especially troubling when the company involved has direct access to consumers’ bank accounts and cards. A user agreement is a contract. It is not legislation.

The Electronic Fund Transfer Act and its implementing Regulation E establish federal protections governing electronic fund transfers, including provisions addressing disclosures, documentation, consumer liability and error-resolution procedures. Whether a particular PayPal transaction violates those requirements depends on the specific facts, and nothing uncovered by South Florida Media establishes that PayPal’s eCheck system is inherently unlawful.

But PayPal cannot simply legalize conduct that would otherwise violate applicable consumer law by writing a sentence into its own terms of service. No private corporation can. That is the flaw in the idea that consumers should simply accept whatever happens because they “agreed to the terms.” A consumer clicking an acceptance box years ago does not transform every subsequent corporate decision into meaningful, informed consent. The actual transaction matters. The actual authorization matters. The information displayed at checkout matters.

If PayPal knows before a transaction is completed that it will be processed as an eCheck rather than through another expected funding mechanism, the ethical standard should be obvious: tell the consumer before the money moves.

PayPal Has Already Faced Federal Action Over Consumers’ Payment Choices

PayPal’s history makes the issue of payment method transparency particularly difficult to dismiss. In 2015, the Consumer Financial Protection Bureau brought an enforcement action involving PayPal Credit, formerly Bill Me Later. The allegations involved a different product and different conduct, and they do not prove that PayPal’s current eCheck practices violate the law. But the case is highly relevant to the principle of allowing consumers to know and control which payment method they are using.

The CFPB alleged that PayPal enrolled consumers in PayPal Credit without their knowledge or consent and, in some cases, caused consumers to use PayPal Credit when they intended to use another payment method such as a linked credit card or checking account. The agency said some consumers affirmatively selected another payment method yet still found purchases charged to PayPal Credit.

The resulting federal consent order required PayPal, in the PayPal Credit context, to clearly and prominently identify the payment option being used during checkout and provide consumers with a way to select another available payment option. If a consumer selected another payment option, the order prohibited PayPal from processing that payment through PayPal Credit. PayPal ultimately was required to provide $15 million in consumer redress and pay a $10 million civil penalty.

Again, the 2015 case concerned PayPal Credit, not today’s eCheck system. But its relevance is impossible to ignore: federal regulators have already confronted PayPal over circumstances in which consumers’ intended payment choices did not match the payment method ultimately used. More than a decade later, consumers should not have to fight the same philosophical battle over something as basic as knowing how they are paying.

The Question of Who Benefits From Delayed Money Deserves an Answer

Consumers are also entitled to ask what happens economically while payments are pending. There is currently no evidence establishing that PayPal deliberately routes transactions into eChecks so it can hold customers’ money and collect interest. South Florida Media will not present that allegation as fact without financial records or other credible evidence supporting it. But that does not make the financial question illegitimate.

The CFPB has previously examined the economics of money stored on nonbank payment applications and found that payment companies can have financial incentives associated with customer funds maintained on their platforms. In a 2023 report examining services including PayPal, Venmo and Cash App, the CFPB warned that consumers were storing billions of dollars through payment applications and noted that companies can generate revenue connected to funds maintained within their ecosystems.

That is not proof that PayPal profits from eCheck settlement delays. Those are different pools of money and different circumstances. But it demonstrates why consumers and regulators should ask precise questions rather than dismiss concerns about payment float as conspiracy theories. When does money leave the customer’s bank during an eCheck? When does PayPal receive it? Where is it held before the recipient receives it? Does PayPal, a banking partner or another entity receive interest or another financial benefit during any portion of that process? Does PayPal have any economic incentive whatsoever for a transaction to settle more slowly?

If the answer is no, PayPal should say so clearly.

If the answer is yes, consumers deserve to know.

Follow the money and publish the answer.

This Is Not Proven Wire Fraud Yet, But “Not Criminal” Is an Embarrassingly Low Standard for PayPal

Consumers understandably become angry when they believe a financial company has interfered with the way they intended to move their money. But the evidence currently available does not establish federal wire fraud. Wire fraud requires far more than an irritating, opaque or even potentially unfair corporate practice. It requires evidence of an intentional scheme to defraud involving money or property and the use of interstate electronic communications in furtherance of that scheme. PayPal’s published eCheck policy and the customer service explanation obtained by South Florida Media do not establish those criminal elements. There is no reason to overstate the case because the verified facts are troubling enough.

More importantly, “we haven’t proven it’s a federal crime” is an absurd standard by which to judge whether Americans should tolerate a financial practice.

Consumers should expect corporations handling their money to meet a substantially higher standard than merely avoiding criminal prosecution. The relevant questions are whether a practice is transparent, fair, properly disclosed and worthy of trust. That is where PayPal has a consumer relations problem.

The Toxic Part Is the Combination of Corporate Control and Consumer Opacity

The larger problem is not the existence of eChecks. It is the imbalance of power created when a technology company inserts itself between consumers and their own financial institutions. A customer can have money in the bank, a functioning debit card, a functioning credit card and all three attached to PayPal. Yet PayPal’s internal system still determines which payment options it is willing to make available for a particular transaction.

The consumer cannot inspect PayPal’s risk model. The consumer cannot see what triggered it. The consumer cannot negotiate PayPal’s terms. The consumer cannot force PayPal to process a payment method the company has rejected. PayPal possesses nearly all of the information and nearly all of the control. That is precisely why PayPal should carry nearly all of the burden of making the transaction transparent.

Instead, consumers can find themselves dealing with pending transactions, eChecks, internal security decisions and contractual funding hierarchies that bear little resemblance to the simple “send money” experience that made PayPal successful in the first place.

That is the toxic practice: not an eCheck itself, but the combination of control, opacity and delay surrounding how payment decisions are made.

Consumers Should Stop Treating PayPal Like a Bank

There is another reason consumers should reconsider how much financial authority they give payment applications. The CFPB has specifically warned Americans that money stored on nonbank payment apps may not carry the same federal deposit-insurance protections associated with conventional bank and credit union accounts. Its 2023 analysis specifically included PayPal among the major payment platforms examined and warned that funds stored through these services can be subject to different protections depending on how the account is structured.

That does not mean every dollar associated with every PayPal product is uninsured. Certain arrangements may qualify for pass through insurance under specified conditions. It does mean consumers should stop assuming that a familiar financial application is functionally identical to an insured checking account. PayPal is an intermediary consumers voluntarily place between themselves and the traditional financial system. Consumers should therefore periodically ask whether they still need that intermediary.

Americans Should Seriously Consider Whether They Still Need PayPal

PayPal remains useful. It offers convenience, enormous merchant acceptance and its own purchase-protection programs. Millions of transactions are completed without consumers encountering significant problems. None of that means consumers owe PayPal permanent access to their financial lives. If a merchant accepts the same debit or credit card directly, consumers should ask what PayPal is adding to that particular transaction and whether the benefit is worth adding another company with its own algorithms, contractual rights and risk controls between the customer and merchant.

For consumers who value PayPal’s protections or convenience, the answer may be yes. For consumers uncomfortable with the company’s payment routing discretion, the answer may increasingly be no.

Customers who believe PayPal used a funding source they did not authorize should preserve everything: screenshots of the final payment screen, transaction confirmations, emails, PayPal messages, bank records and customer service communications. Those records are far more valuable than angry speculation because they can establish exactly what the customer selected, what PayPal displayed and what ultimately happened.

Consumers can then use PayPal’s dispute process, their financial institution’s applicable procedures and consumer-regulatory complaint channels when appropriate. Everyone else can make an even simpler decision.

Stop using PayPal.

Consumers do not need a lawsuit, congressional hearing or federal enforcement action to decide that a company’s financial practices no longer deserve their trust. Markets work because consumers can walk away.

PayPal Can Fix This Problem Tomorrow

Perhaps the most frustrating part of this controversy is how easy it would be to eliminate. PayPal knows when its risk system restricts payment options. PayPal knows which funding source will be charged. PayPal knows whether a bank funded transaction is being processed as an eCheck. PayPal knows that an eCheck generally takes four to seven business days and sometimes longer. There is no technological mystery here.

Put the information directly on the final authorization screen in language nobody can misunderstand: Payment Method: eCheck. Funding Source: Bank Account Ending XXXX. Estimated Processing Time: 4–7 Business Days or Longer. Continue or Cancel.

If PayPal already provides that level of disclosure consistently for every affected transaction, it should document the process publicly and make the policy unmistakable. If it doesn’t, it should start immediately. Consumers should never discover after initiating a financial transaction that the process is materially different from what they reasonably believed they authorized.

PayPal Wants Consumers’ Trust. Complete Transparency Should Be the Price.

PayPal’s eCheck system has not been proven to constitute wire fraud, theft or a deliberate scheme to profit from payment delays. Those are criminal or factual allegations that require evidence, and responsible journalism should not manufacture evidence that does not exist. But PayPal does not get a free pass merely because its practices have not been proven criminal.

The company acknowledges that its internal risk management system can restrict payment methods. It acknowledges that some bank funded transactions may be processed as eChecks. It acknowledges that those transactions generally take four to seven business days and can take longer. Its User Agreement gives the company broad authority governing preferred, selected and backup funding methods. Those facts should make consumers pay attention.

For a company whose business depends almost entirely on people trusting it with their money, the standard should be extraordinarily simple: tell consumers which account is being charged, tell them exactly how the payment will be processed, tell them approximately how long it will take and tell them before they authorize it. PayPal does not need another thousand words in its User Agreement. It does not need another explanation about an internal security system. It does not need consumers to become experts in ACH settlement and payment network architecture. It needs transparency.

If PayPal cannot give consumers that basic level of control every time it touches their money, Americans should seriously consider closing their accounts and taking their business somewhere else.

Sources & Further Reading

PayPal — Why Was My Payment Sent as an eCheck?
PayPal eCheck Help Center

PayPal — U.S. User Agreement
PayPal U.S. User Agreement

PayPal — Why Is My Incoming eCheck Pending?
PayPal eCheck Clearing Information

Consumer Financial Protection Bureau — 2015 PayPal Credit Enforcement Action
CFPB PayPal Enforcement Action

Consumer Financial Protection Bureau — 2015 PayPal Credit Consent Order
CFPB PayPal Consent Order

Consumer Financial Protection Bureau — Regulation E: Electronic Fund Transfers
CFPB Regulation E

Consumer Financial Protection Bureau — Analysis of Funds Stored Through Payment Apps
CFPB Payment Apps Report

Consumer Financial Protection Bureau — Consumer Advisory on Money Stored in Payment Apps
CFPB Payment App Consumer Advisory