1

As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments.

I also noticed that Paypal offers a "verified ID" service so that we can be sure that the proposed paypal account is truly who the user says they are.

I haven't investigated this API deeply, but think there is probably a creative way I can use this tight coupling between a Paypal ID, and the HTTP/REST result returned to my application to verify various aspects of the buyer.

Question

  • Can Paypal be reliably used to verify Identity, residence, or any other aspect of Identity?

  • Are there some aspects of identity that Paypal should not be used for with 3rd parties? (Citizenship, residency, etc)

makerofthings7
  • 50,090
  • 54
  • 250
  • 536
  • Related: [How can I verify the Identity of a US or UK individual?](http://security.stackexchange.com/q/36166/396) – makerofthings7 Sep 26 '13 at 23:42
  • I think the PayPay ID would be a verification of e-mail registered with PayPay and probably not much more. – domen Sep 27 '13 at 13:01

3 Answers3

2

Paypal do offer an Address Verification Service. Paypal won't tell you the customer's address, but you can ask Paypal "Does this address match the credit card billing address?" and get a yes/no response.

https://www.paypalobjects.com/en_US/vhelp/paypalmanager_help/using_address_verification_service_(avs).htm

paj28
  • 32,736
  • 8
  • 92
  • 130
1

No - you can't verify the identity of anyone this way.

Verification activities can give you a degree of confidence in the identity of the individual, so for example, the Know Your Customer (KYC) activities banks in the UK use include:

  • meeting the customer face to face
  • validating copies of utility bills
  • confirming individual looks like the photo on their original passport or other government approved ID

On the internet, there is no personal contact, so a criminal can provide a picture of any passport. Hopefully PayPal validate that the passport is not registered as stolen, but even this is not verification (as the owner of the passport may not be aware of its loss), it is simply an element of verification, which in conjunction with verification of an email address offers a bit of confidence they are who they say they are.

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
-1

I was requested by Paypal to deliver bioinfo with picture and passport copy and so, so in terms it can be secure as the passport copy had to be verified (eg by local police). This could still be a fraud, but who would deliver picture, passport copy and bank account and still being criminal :-) ? I guess it is more and more secure. But if You wish to be safe, then demand high secure at Paypal and a verisign identification. Master Card is also a good start for identifications, when demanding vericode.

Sorry english is not my main language, but i hope You get the idea :-).

Klavs Rommedahl
  • 7
  • 1
  • Similar with my first paypal account, but about a year ago I opened another one (I moved, and you can't change countries on a paypay account. You can change the e-mail addresses, and switch accounts though!) - I don't remember them requiring anything. – domen Sep 27 '13 at 13:00