I am Tom Freeland, a lawyer in Oxford, Mississippi. The picture in the header is my law office. I'm on Twitter as NMissC

Missing Posts: If you have a link to a post that's not here or are looking for posts from Summer of 2010, check this page.


Beware: PayPal might secretly ask you for a Power of Attorney!

I had someone send me money via Paypal.  It obviously does me limited good in Paypal, so I wanted to transfer it to my bank.  I put routing information for an account into Paypal, and it said it now needed to verify the account, something I though I’d already done with that account, some time ago.  The verification screen had two options:  One where they deposit a smidgen of money in the account, ask you to confirm it, and then take it back, and a second where they confirm instantly.  I thought I remembered doing the former, but went ahead an clicked to do the second.

It presented me with an ominous screen, which asked me for the security questions for my online banking (!) AND for the password for my online banking (!!).  I thought: What?  So I clicked through to the Terms and Conditions for this account verification (there was a link here.  The link does not allow you to go to the terms and conditions even if you are logged into Paypall).

The first paragraph has me promising to give them accurate information.  The second stunned me (emphasis added where this thing really gets weird):

THIRD PARTY ACCOUNTS. By using the Service, you authorize PayPal and its supplier Yodlee, Inc. (“Yodlee”) to access third party sites designated by you, on your behalf, to retrieve information requested by you, or as required by PayPal to confirm your bank account. For all purposes hereof, you hereby grant PayPal and Yodlee a limited power of attorney, and you hereby appoint PayPal and Yodlee as your true and lawful attorney-in-fact and agent, with full power of substitution and re-substitution, for you and in your name, place and stead, in any and all capacities, to access third party internet sites, servers or documents, retrieve information, and use your information, all as described above, with the full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection with such activities, as fully to all intents and purposes as you might or could do in person. YOU ACKNOWLEDGE AND AGREE THAT WHEN PAYPAL OR YODLEE ACCESSES AND RETRIEVES INFORMATION FROM THIRD PARTY SITES, PAYPAL AND YODLEE ARE ACTING AS YOUR AGENT, AND NOT THE AGENT OR ON BEHALF OF THE THIRD PARTY. You agree that third party account providers shall be entitled to rely on the foregoing authorization, agency and power of attorney granted by you. You understand and agree that the Service is not endorsed or sponsored by any third party account providers accessible through Service.

So they propose I give PayPal a power of attorney that it can “be me” for purposes of accessing the internet, and using information about me and my bank account on the internet?  What?!?

I have never seen a power of attorney provisions in a term of service agreement.  I want to highlight that this TOS did not require me to view it before agreeing to it; it was hiding in a link two-thirds of the way down a form.

And from there, the TOS disclaimed all warranties, of course, and any consequential damages for this thing going off the rails, AND provided that I would indemnify PayPall and its affiliates for damages (including their attorneys fees) caused by my use of the service or violation of the terms, etc.

I decided, well, all right, I guess I’m using the slower form of verification, after which PayPal more or less confirmed that my memory was correct, the account had already been verified.

7 comments to Beware: PayPal might secretly ask you for a Power of Attorney!

  • They be trippin’. I always just use a credit card when buying stuff online rather than PayPal. Now I know why.

  • NMC

    I had a brief moment of thinking: I’m somehow on some other website and am being offered up a chance to be hacked. No way a legitimate business would ask me to give up this kind of information.

    Apparently, yes way.

  • I did a Lexis search, but I can’t find that the agreement has been the source of litigation yet, at least at the appellate/district-court level.

  • Not Lee

    The blog Boing Boing deals with these issues and the fact that the click-here agreements with software etc are too frequently making us criminals. Cory Doctorow, who contributes to Boing Boing, gave a great talk at Square Books last year on the subject.

    PayPal used to be famous for having mirror sites that pretend to be PayPal while gleaning your info for their own purposes.

  • Tedd

    “Don’t be evil”…whoops wrong megacorp…

  • Ben

    You could do your duty as a responsible citizen and file a complaint with our state’s AG’s office … if you can figger out which form to use. And no matter which form you select, you are assured it will be the wrong one:


  • dmitryb

    It looks like this is a standard thing not limited to PayPal. I just tried to add an external account to a bank account (big brokerage site) for transfers and remembering to having read this thing about Pay Pal a few weeks ago, decided to take a look at the bank’s Terms and Conditions for Instant Account Verification. It’s the same language as what PayPal has asking for limited power of attorney.

Leave a Reply