I was surprised to get the offer shown here in my mailbox. PayPal is sending me a debit card unless I actively stop them. I’m no security expert, but I can count at least a half dozen ways this is a terrible idea:
- The only security in place to ensure that the person who receives the card is actually the intended recipient is the call that you would have to make to authorize it. Whatever they ask for — say, a social security number — is likely information that’s easily accessible from any of the hundreds of reported security breaches. There’s no other safeguard.
- I think this is the first piece of physical mail I ever received from PayPal. If it was sent to the wrong address, the debit card would be as well.
- Even if it is sent to the right address, someone else at my address — a spouse, child, or tenant — could receive the card and start making charges, especially if they know enough of my personal information to authorize it.
- If I don’t notice this piece of mail or the card that subsequently arrives, and I throw it in the recycling bin, somebody could pick it up and start using it (after accessing my stolen information to authorize it).
- Since so many of these cards are being sent out, this increases the effectiveness of subsequent phishing emails. If I receive an email that says “Final authorization for your PayPal Business Debit Card,” I might think it’s legit and not realize that it’s actually a phishing email intended to steal my PayPal credentials.
- To stop the card being sent, I needed to go to PayPal.com/NoThanks, where it asked for my PayPal user ID and password. If I mistype that web address, I might easily end up at Paypl.com/Nothanks, Papal.com/NoThanks, or any number of other spoofed accounts. A phishing site set up at that location is well positioned to receive my PayPal credentials and run up false charges.
Putting all that aside, why is it my responsibility to stop PayPal from sending me a card I never asked for? I have enough credit cards. Forcing me to take action to stop one being sent is an offensive abuse of my relationship with PayPal.
Even if it’s possible to block fraudulent charges on a card like this that’s used in an unauthorized way, it would take time and effort and likely damage my credit rating. I don’t need any more sources of financial liability that I didn’t ask for.
If I have a financial relationship with a company and it wants to offer me a credit or debit card, I can live with that. But no company should send cards unsolicited and require me to opt out. That’s just rude, and potentially dangerous.