I have a small web site where I sell software that I write. Payments for the registration/license codes for my software are done via PayPal. I have an automated IPN script that links to my PayPal account that processes each payment automatically and then dispatches an email to the buyer's email address associated with their PayPal account, that explains how to register the software and provides a buyer with their personalized registration license code. All in one email.

Sometimes a person who made a payment may send me a follow-up email via the feedback on my site, with the message as follows (the actual email I got today, verbatim):


My name is ______, I just bought a license from Software_Name. I bought via Paypal, but only after completing the purchase remembered that I no longer have access to the email address you are registered (gives_paypal_email_where_payment_came_from).

I would like the license was sent to another email: some_other_email_address.

How do you treat such requests? Or is there any way to verify that the person whose PayPal account was used, indeed made this purchase and that someone didn't just steal their PayPal account?

  • They could just go to PayPal and change their email there. Seems fishy to me. - Imagine you call Amazon and claim I just bought that TV from you but I don't really live at that address anymore, can you send it somewhere else instead? - what do you think amazon would do? – Aganju Dec 29 '15 at 3:07
  • @Aganju: Yeah, thanks. I thought so too. But what puzzles me is this -- if this person cannot change their email through PayPal, how could they make a payment then? – c00000fd Dec 29 '15 at 3:29
  • right. That's why I think it's fishy. – Aganju Dec 29 '15 at 3:29
  • @Aganju: No, I mean, to make this payment, I link to the actual PayPal page where someone has to provide their email and password to proceed. So if they have those, why can't they just log in to PayPal and change that defunct email? That's what's strange to me.... Or, maybe PayPal has some additional actions that need to be done to change the email.... – c00000fd Dec 29 '15 at 3:32

My experience with PayPal is that you usually have to re-login to make a purchase. If they have the password to login, then they have the password to change their email. At worst, they can call customer support and have PayPal manually make the updates.

But that has nothing to do with you. Your relationship with this person is as a merchant with a customer. Because of that explain that, in the interest of both your security and their own, you can only deliver to the PayPal registered address or email to the PayPal registered email. (Also, be sure not to give out what those are, also in the interest of security.) Suggest that they contact PayPal customer service to resolve their PayPal issue and that, because it is a PayPal issue, there is nothing you can do to resolve it.

I know this may seem like a customer service run-around but it's because of scams like what this may be that these stances are necessary.

  • Yes, makes sense. I appreciate the effort. I replied with a similar message and never heard back. Thus the only question I have at this point is what kind of a scam was that? They could clearly access this person's PayPal to make a payment but could not change the email on the account. Strange. – c00000fd Dec 29 '15 at 16:22
  • @c00000fd When you add an email address to your PayPal account, you're required to verify it by clicking a link in an email PayPal sends to the new address. When you click that link, the first thing it has you do is enter your password even if you're already logged in. I suspect that PayPal doesn't require repeat logins for serial purchases. In some countries (e.g.: China) internet cafes are popular. People sometimes forget to logout. Combine all these things and you get a situation ripe for the scam you're seeing. – Ouroborus Dec 29 '15 at 23:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.