There are changes coming after the 31st of March 2020 which will impact how you log into your PayPal account and you need to ensure you have an up-to-date mobile phone number registered on your account.
The Second Payment Services Directive (PSD2) is a new European Union directive replacing the First Payment Services Directive, which regulates payment services in Europe. Part of PSD2 the new security requirements that will impact online businesses accepting card payments.
PSD2 introduces further security requirements for making electronic payments, accessing your account or making changes to your account in order to reduce the risk of fraud. These requirements, which apply to all countries in the EEA, include Strong Customer Authentication (SCA). This is an authentication process that validates your identity when you are using any payment service. #
In the future, PayPal may have to request at least 2 factors of authentication when you make a payment, access your account or making certain changes to your account. These can be something you know (password), something you have (a one time password sent to your mobile), or something you are (like a fingerprint). For most people this will mean access to the mobile registered on their account to receive a one time password via SMS text message.
Most of the time you will be able to login or pay with PayPal by just entering your email address and your PayPal password as usual. But from time to time, PayPal may ask you for a One-Time Passcode sent to you you by SMS. This is one of the methods that helps PayPal to identify you if they have doubts about your identity or regulations require them to apply 2 factor authentication and no other methods are available.
Naturally as a business, if you have multiple people accessing your PayPal account this is going to cause problems – especially if it’s someone like your accountant that doesn’t even sit in the same office. Adding friction to the process is never welcomed by users, regardless of how much it’s wanted by suppliers and mandated by legislators. Best to be prepared however, and if you’ve not checked that you have an up-to-date mobile phone number registered on your PayPal account make sure you update it before you’re locked out of your account.
11 Responses
my number is up to date but PayPal has insisted that it still be updated.
i’m trying to explain this by email to PayPal – the story continues….
I received an email about this that looked like it was from PayPal but the domain it wanted me to ‘update my details’ was at ‘paypal-communications.com’ NOT ‘paypal.com’. As such it looked like another one of those spoof/fraud emails trying to get me to click a link, and dismissed it as such until I saw this article.
I even checked-up on it by logging into PayPal directly to see if it requested any action there, and nothing showed up.
How are we to know this is genuine when they use a different domain name on their links to what we normally login to? This is the main trick fraudsters use, and this email I received could still be fraudulent for all I know, having copied a genuine email and changed the URL…
How are we supposed to know it is genuine if they don’t also post the notice on their web site? It is also not easy to talk to anyone at PayPal to verify it either. Even spoof emails these days often include recipient names, so that is not good enough these days to determine genuine from spoof emails. Genuine known domain names in URLs are important.
I assumed the email about this I received this week from the dodgy looking “PayPal-communication.com” domain was spam, like many hundreds of other phishing messages we receive.
When I logged into my account directly there was no messaging about it so this confirmed the idea that it was spam.
I manage the charity Paypal account but don’t have a work mobile phone. How am I supposed to continue to use the service as I do not wish to use my personal number?
I have had a go at Paypal several times over their practice of including clickable links in their emails – obviously ignored. Fraudsters can continue to exploit this and make their millions. Madness!
Paypal do offer a system of sub-logins allowing personal details to be stored against a sub-user who can then log in to the main account.
But this system is broken and doesn’t allow access to critical functions, so you have to enter the main system and be authorised by name there. And the authorisation there is broken too so wouldn’t accept my name which is now forever different on the system and I have to tell them a different name when I log in.
In short. Shambles.
Probably better than eBay payments V1.0, though.
I do not have a mobile (cell) phone – only landline. How will this new procedure
affect my transactions with PayPal?