It's funny that I was just on the phone with PayPal customer support for the past hour. I told them PayPal is a sinking ship. I was also questioning how PayPal can be a multi-national business when the CSR (customer service rep) literally told me "I don't recommend you [US citizen] use PayPal if you live or travel abroad"<p>Yesterday I login to PayPal and it text messages a 2FA auth code to an old, supposed-to-be deleted, phone number. There is an option to "try another way" where they call the new phone on file and I dial in a code they show on the web. This worked yesterday and I confirmed the old phone number is not visible in the UI.<p>I've been living abroad and originally signed up for Google Fi. One day, Google Fi disconnected my data and phone access. SMS still works, but there are cases where you need to "authenticate" with a phone call. Turns out Google Fi has a policy in place where they disable your data/phone access if you've been abroad for over a year. Due to covid and other situations, it didn't seem worthwhile to return to the United States just to resolve this phone issue. CSR didn't seem to be trained on this case, and it took several hours and multiple escalations before anyone in customer support knew about this policy existed. Google has a bad reputation for customer service, and they made a half-baked attempt at building out a customer support team with Google Fi, but it's a joke. As a former Google employee, I understand but still find it absolutely unacceptable. The performance review cycle is broken when no one has any ownership about the product after it's shipped. Customer Support felt 80% implemented, and the product manager moved on to the next shiny thing. Google's effort to invest in training the customer support staff to be exceedingly nice and soft spoken really shows. I just wish the customer support staff were trained to actually fix issues instead of re-iterating the also useless online documents and in-app copytext of Google Fi. I've worked with GCP tech writers to publish some docs for GCP, and if it's the same org producing the customer support FAQ/script and peripheral copy in the app/online docs, I'm not surprised why it's useless.<p>Google Fi has all the traits of an abandoned Google project. Funny enough, I noticed yesterday they rebranded to "Google Fi Wireless". I'm sure someone got a promotion as part of that initiative. At any rate, because of the inability to do authentication over the phone, I migrated to Google Voice as I was able to keep my phone number. Google Voice has signs of age and abandonment too. But it did the job... for a while.<p>Today I followed the same pathway to login to PayPal and was locked out.<p>Yesterday there's a bug in Chrome where I do not hear sound from Google Voice calls. The initial ring makes a sound, but then nothing, so I know my browser and OS has been configured to play sound for Chrome. This was after Google showed a banner linking me to docs, which in turn instructed me to go to chrome://settings/content/sound to allowlist Google Voice. Not sure why this is needed, when the default behavior is "Sites can play sound". Still didn't work. Hopped over to Firefox and got a warning that "this browser is not supported" when attempting to login to Google Mail. Not sure what kind of security vulnerability exists at the seam between Google Account login and a few months old version of Firefox. Thankfully with an update I was able to get Firefox to produce sounds for Google Voice calls and was able to 2FA into PayPal.<p>Today I forgot about the Chrome bug, and after 3 attempts, PayPal locked me out. I was told to call customer support. The CS rep said they will "disable 2FA" on my account. They noted that did not see the old number listed on their side either. PayPal still has my old phone number in a database somewhere, even though I requested it deleted. Can't tell if this is or isn't a data retention violation. I received three separate emails in the following order: "you added <new phone number>", "<old phone number> removed", "<new phone number> removed". I attempt to login and greeted with "Confirm your phone number with a code ... <new phone number>". The two options are to receive a text or a call. Immediately after the clicking, I see "Sorry, we couldn’t confirm it’s you". The two options now are to "try another way" which goes back to that previous screen, or to call customer support. Customer support said I might have issues if I am using a VPN. I told them I have not been using a VPN. Customer support tells me I might have issues if I am accessing PayPal from abroad. Customer support tells me to try again in 24 hours. I ask CSR if they know it will work or they think it will work. They tell me they think. Everything was a "maybe" and that there was no way for them to override the automated system. I told them the automated system is throwing me in a loop and to contact customer support. I understand they are in a bad position due to corporate, but I asked them what is the escalation path. They said there is none. I asked to speak to a supervisor. The supervisor had a novel idea of initiating a password reset. They issued a password email. While we're waiting for the reset email, we're going back and forth on the absurdity of this process. I asked them why am I seeing the screen to confirm my phone if 2fa has been "disabled". They explain that the phone number is used as a means of confirming my identity. I told them I'm calling them on the phone right now. How else am I supposed to prove my identity if they say the phone number is the source of truth of my identity? They're vehemently defending PayPal, but reiterated there was no escalation path. All they can do is report asynchronously to "IT" and hope one day things change. 15 minutes go by and the email finally comes. Unfortunately the password reset link expires after 10 minutes. I asked the CSR rep if think it's absurd that control is handled over to the automated system, and customer support can't do anything. There should be an escalation. For example, why is there a 10 minute limit on the password reset email if it takes 15 minutes for them to come. They told me this is a "one off" and "industry standard security policy". We do this password reset thing three times, but the emails always comes in after the expiration time. They told me these systems have been in place before they joined PayPal and will remain in place after they leave PayPal.<p>I've been responsible for building auth/identity systems dealing with security reviews. A lot of these processes at PayPal seem illogical security theater and there is no feedback loop to fix them. The CSR rep practically told me it's best not to rely on PayPal if I don't live in America, even if I am American. They proposed a create a PayPal account in the country I currently reside in. Yeah, no. I am dubious when they can barely handle the United States case well, and I am living in a country with a much more byzantine bureaucracy. Funny enough, I've worked on an analytics / operations team at one of the largest FinTech players in the US where one of my projects was optimizing the CSR operations. Our products handled diverse user base pretty well. I don't understand how PayPal can succeed as a multi-national business.<p>Our lives are growingly dependent on digital systems that are increasingly complex, but they are still so jank. In this case of PayPal, they've prematurely handled off control to the machines without any way for customer support humans to intervene. At least in the country I live in it's acknowledged that the IT infrastructure sucks, and so there is always a way for human intervention. Corporate America's quarterly business cycle leads to these cost reductions that delegate more and more to automated systems that aren't robust. I feel like we've past the inflection point of where digital technology was without a doubt improving our lives.