Hello, I had a client sign up with us earlier today. I noticed that the clients PayPal was non-us, so just to check it out I figured I would review their info. I saw that the name on the PayPal account was different from the name on the clients account for the hosting. Should I be concerned with that, or just wait to see what happens?

I would request ID to be faxed to match the paypal account holder. Does the IPs location match the city/state?

It matches the hosting account info, the PayPal info doesn't have a shipping address.

It's common enough, at least for post pay services. Sometimes, someone else in the company with a paypal account will be asked to pay a bill. Sometimes multiple paypal accounts are used to pay one account in different months.

On a new signup where paypal is part of the process, you might want to check that they are at least in the same city, and also ask why. If you don't get a plausible answer, then you have to wonder why.

Most of our payments are out of country. We don't even think about it. As long as paypal takes it, we don't care. If a chargeback happens, so be it.

I think I'll just let it go. I'll live if I get a chargeback; it's a $4/month plan.

Iit's a $4/month plan.

There you go. Not even worth worrying about :D

The way we look at it is that it's only cpu cycles that would have gone up the chimney as heat.

I think I'll just let it go. I'll live if I get a chargeback; it's a $4/month plan.

:eek: You've just invited a bunch of scammers over to your house with that statement.

:eek: You've just invited a bunch of scammers over to your house with that statement.

That would benefit them in no way whats-so-ever. What's the point in scamming for web hosting? If they put any illegal or destructive content up I can simply remove it with the click of a button. So they get one month or less (depending when I find out they stole someone's paypal) of free hosting and benefit how? I don't see the risk/reward for a $4/month hosting account.

Yep, after transaction fees it's somewhere south of $3.50

Starbucks wouldn't worry about it, and they'd already be out the coffee, cream, sugar, and lid. :D

Banks don't worry about either. If fraud costs Y percent, and blocking it costs Y+Z percent, the rational choice is to let it happen.

By no means am I willing to accept fraud customers. I'd just rather weed out the bad ones as they come along rather than lose good customers due to extra fraud checks/measures, such as faxing ID's etc. If it were for a $100 order or something similar, then yes, I would probably request some type of verification.

Well, there you go. There's a balance between risk of loss, cost of said loss and effort expended.

Nothing was said about unconditioally accepting or encouraging fraud.

If it's a big order then it's cause for concern. If it's something small, i just ignore it. You made the right choice

Was your customer sign up from the Phillipines by any chance? if it was, I will keep an eye out because more than likely the will be running some spam scripts. I just had three account sign up from the Phillipines and one paid using paypal and the name on the account on paypal was different than the name on their account they sign up.

This morning they ran a script and try to sent over 100,000 emails all spam.

That would benefit them in no way whats-so-ever. What's the point in scamming for web hosting? If they put any illegal or destructive content up I can simply remove it with the click of a button. So they get one month or less (depending when I find out they stole someone's paypal) of free hosting and benefit how? I don't see the risk/reward for a $4/month hosting account.

In the meantime, maybe the shared IP gets blacklisted for spam from one of these accounts. Then the phone starts ringing from your customers asking why all of their emails are bouncing. Then try to get the IP delisted....weeks later customers are leaving.

Can you afford that?

In the meantime, maybe the shared IP gets blacklisted for spam from one of these accounts. Then the phone starts ringing from your customers asking why all of their emails are bouncing. Then try to get the IP delisted....weeks later customers are leaving.

Can you afford that?


I'm really evaluating taking any orders from outside of the US anymore.

base my experience just watch this client and not to long after get account client like this 90% will ask refund with insane reason

Was your customer sign up from the Phillipines by any chance? if it was, I will keep an eye out because more than likely the will be running some spam scripts. I just had three account sign up from the Phillipines and one paid using paypal and the name on the account on paypal was different than the name on their account they sign up.

This morning they ran a script and try to sent over 100,000 emails all spam.

I'll check it out. Thanks

It really is a pain when someone signs up just to send spam or launch attacks from your server. A while back I made this generic guide when we had some new support people. It was an attempt at a formula that codifies my gut instincts.

We are in the US and have a few customers in Europe and many in Canada, but we generally don't take any accounts from other parts of the world.

At the time this was written (early 2007) we only took paypal and 2checkout and most of the fraudulent orders came from paypal payments. We now have additional payment types and a full merchant account, but it is still the paypal payments (which most of our customers use) that we watch most closely.

This is based upon "bad" points. Our order records include the IP of the person placing the order on the order page.

1) - Old/New Customer Check:
Verify that this customer name and/or email address is not a current customer.
If they are an existing customer, you can skip the fraud check.
If they are a new customer, do the fraud check.

2) - Fraud Check: {subject to change - work in progress}
If the email address is a free, anonymous email box, like gmail, yahoo, hushmail or hotmail, then they get 5 bad points.
Copy the IP address from the order (shown at the bottom of this email).
Visit: http://www.ip2location.com/free.asp.
Paste the IP in the "IP Address(es)" box and click the "Find Location" button.
Make a note of the country and state (region) of the IP address.
Look at the payment email.
Does the country and state match the IP location?
If the country and state do not match (and are not nearby), they get 20 bad points.
If the payment is 2checkout, verify that the payment IP is the same. If not, then they get 30 bad points.
(That should never happen.)
If the payment is PayPal, they get 5 bad points.
If the payment is 2checkout, they get -5 bad points.
If the payment is PayPal and no address is included with the payment, they get 10 bad points.
If the email address on the order and the email address on the payment do not match, they get 5 bad points.
If the name on the order and the name on the payment do not match, they get 10 bad points.

0-10 bad points - Process the order.
11-20 bad points - Process the order.
21-30 bad points - Verify the order by email to the payment address.
31-40 bad points - Verify the order by phone.
41+ bad points - Immediate refund

For example: (This order)
It is a gmail address: 5 bad
The IP and payment country and state match: 0 bad
The payment is 2checkout and the IP matches: 0 bad
The payment is 2checkout: -5 bad
The email address is the same on the order and payment: 0 bad
The name on the order and the name on the payment do not match: 10 bad
Total bad points: 10 - Process this order.

Hope that helps!

This is just crazy. On your scoring system, i am a automatic 40 or more. I use gmail for no company stuff, plus i use paypal. Becuase i have crappy Comcast, i sometimes get a IP out of NJ and im no wheres near NJ. I have never provided shippping info in paypal for hosting.

Man, i would leave for the trouble you would just give me.

It really is a pain when someone signs up just to send spam or launch attacks from your server. A while back I made this generic guide when we had some new support people. It was an attempt at a formula that codifies my gut instincts.

We are in the US and have a few customers in Europe and many in Canada, but we generally don't take any accounts from other parts of the world.

At the time this was written (early 2007) we only took paypal and 2checkout and most of the fraudulent orders came from paypal payments. We now have additional payment types and a full merchant account, but it is still the paypal payments (which most of our customers use) that we watch most closely.

This is based upon "bad" points. Our order records include the IP of the person placing the order on the order page.

1) - Old/New Customer Check:
Verify that this customer name and/or email address is not a current customer.
If they are an existing customer, you can skip the fraud check.
If they are a new customer, do the fraud check.

2) - Fraud Check: {subject to change - work in progress}
If the email address is a free, anonymous email box, like gmail, yahoo, hushmail or hotmail, then they get 5 bad points.
Copy the IP address from the order (shown at the bottom of this email).
Visit: http://www.ip2location.com/free.asp.
Paste the IP in the "IP Address(es)" box and click the "Find Location" button.
Make a note of the country and state (region) of the IP address.
Look at the payment email.
Does the country and state match the IP location?
If the country and state do not match (and are not nearby), they get 20 bad points.
If the payment is 2checkout, verify that the payment IP is the same. If not, then they get 30 bad points.
(That should never happen.)
If the payment is PayPal, they get 5 bad points.
If the payment is 2checkout, they get -5 bad points.
If the payment is PayPal and no address is included with the payment, they get 10 bad points.
If the email address on the order and the email address on the payment do not match, they get 5 bad points.
If the name on the order and the name on the payment do not match, they get 10 bad points.

0-10 bad points - Process the order.
11-20 bad points - Process the order.
21-30 bad points - Verify the order by email to the payment address.
31-40 bad points - Verify the order by phone.
41+ bad points - Immediate refund

For example: (This order)
It is a gmail address: 5 bad
The IP and payment country and state match: 0 bad
The payment is 2checkout and the IP matches: 0 bad
The payment is 2checkout: -5 bad
The email address is the same on the order and payment: 0 bad
The name on the order and the name on the payment do not match: 10 bad
Total bad points: 10 - Process this order.

Hope that helps!

Actually, you would only have 15 points and we would process the order. There is no penalty at all for using gmail and you only get 5 for paypal and 10 for no address. Since the IP was US, we wouldn't count it against you unless we looked it up and hit a web server (possible compromised relay) instead of an ISP. (i.e. We can't verify your IP against your address that isn't provided so no NJ mismatch points.)

Even if you gave yourself another 10 points by using a name that didn't match your paypal name, or another 5 by mismatching your email on the order with your paypal email, that would only trigger a verification email to your paypal address. You almost have to try to get any activation delay at all.

I sincerely apologize if my post was over-summarized and made it difficult to follow.

We have seen this as well. PayPal discourages completing transactions when this occurs. I would discourage it as well.

As was stated in this ticket sometimes other employees pay for services and what-not but what that usually leads down to is the company saying they didn't approve the purchase, refuse to reimburse the employee, then your left holding the bag.

This is why business credit cards charge normally at a higher rate because it's very easy for the company to say Lisa or Dan wasn't authorized to use the credit card but Don would of been.......

$4 bucks is $4 bucks but if you get too many problems on your PayPal account PayPal could see your account as being a risk and possibly limiting your abilities.

send a mail via post to the address with a code on it. suspend there account till they come back to you with that code.

or call them