PayPal and zero-dollar invoice spam

PayPal employee here (and I&#x27;m hiring Node.js developers :P ).<p>I actually got two of these messages while I was out for the holiday break. I don&#x27;t work on the team that handles invoicing; but, I (among others) made them aware of this issue and they are definitely working on a fix.<p>The challenge, of course, is that there are plenty of legitimate reasons for sending $0 invoices and we don&#x27;t want to artificially make our product worse for our many legitimate customers by going too far in trying to stop this spam.

On one hand I hate spammers and their ilk. On the other hand, I have to congratulate them on finding a neat hack around spam filters which is technically not breaking false claimant laws . The simple fix is to disable $0.00 invoices as any actual invoice for services not rendered is fraud.

All of these approaches are used to take advantage of the email deliverability rates of large reputable companies that send lots of email. Paypal is a new one, but Hotmail and Facebook have in the past been used for similar things. With Hotmail, you could define a custom &quot;I&#x27;ve changed my email address&quot; message, which would contain your spam message, and then it would send it to up to 5,000 &quot;contacts&quot; for you with near-100% deliverability. Some people automated this, and with that they were able send millions of messages per day. I haven&#x27;t looked recently, but Facebook&#x27;s &quot;invite friends&quot; feature has been used similarly in the past.

&gt; @AskPayPal: I recommend deleting that tweet, it has your personal info<p>&gt; @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email!<p>This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.

Has PayPal just not tried to fix anything or add features other than a CSS refresh in, like, ever?

Not mentioned in the article, but paypal allows you to send a single invoice to up to 100 different email addresses with a single click.<p>It also allows a 1-click way to email anyone that &quot;hasn&#x27;t paid&quot; with an update.

I wonder what the reasoning is that PayPal allows you to &#x27;send&#x27; someone $0.00?<p>I&#x27;m not really surprised at how terrible the support via Twitter is. I almost never use chat&#x2F;email support these days with any large company-because of how useless it has become.

Why would you put a clickable link to the spam website on your blog though?

For a PayPal employee to post here and say he made a team aware and they are working on this it&#x27;s utterly laughable.<p>There was a post here on hn over two years ago for the same issue which was top post and generated a lot of news.<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6526481" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6526481</a><p>It is obviously very well known to them for years but they continue to do it

You can send invoices to people to get paypal to show their name to you and connect names to emails

I&#x27;ve been getting the same emails for a while now. I sent to paypal through email and got no response. I also added on a topic I thought was relevant on their forum, and a guy there said he reported it and got a less automatic response than I did.<p><a href="https:&#x2F;&#x2F;www.paypal-community.com&#x2F;t5&#x2F;Access-and-security&#x2F;Getting-Spam-Invoices&#x2F;td-p&#x2F;352294" rel="nofollow">https:&#x2F;&#x2F;www.paypal-community.com&#x2F;t5&#x2F;Access-and-security&#x2F;Gett...</a><p>I haven&#x27;t got more messages lately, so I&#x27;m guessing they managed it already.

I saw the same sort of thing a few years ago with Google Calendar invite spam. If I remember correctly, I&#x27;d even get a meeting reminder with the spam message.

If we were ever to reach singularity, it would be partly thanks to the motivation created by the spammers.

I read the title and thought of spamming zero dollar gift on Minecraft!

Horrible PayPal customer service. This person should not be allowed on their Twitter account.

This is brilliant :)