"Log in with a one-off code" option is effectively an authentication bypass, and I want it disabled.

[lucidityy]

I have protected my PayPal account with two-factor authentication and turned off SMS as a two-factor method, as it is not secure.  

However, recently PayPal started offering me "Log in quickly with a one-off code" as a login option. In fact, "Log in quickly with a one-off code" is even less secure than having SMS as a two-factor authentication method.  Effectively this method bypasses my password and Authenticator token and uses only my phone for authentication, meaning that someone could steal my SIM card and then get into my PayPal account and make unlimited purchases. I am very annoyed about this, I do not want PayPal adding authentication bypasses to my account, I want it to be secured using the method I have chosen.

I called up and asked for this to be turned off, and the person I spoke with agreed, but PayPal is still offering this option.  Does anyone know of a way to turn it off?  I want this option turned off completely and permanently.  I do not care if it is more "convenient".  There are hurdles to jump through before my bank account to be accessed for a very good reason, and I do not want them bypassed. 

Any help would be appreciated.

[blubble]

Unfortunately I've run into exactly the same situation and resolution. The person I got on the phone said there wasn't any other options that she was able to find.

As you've said, this is pretty frustrating; my mobile phone is not a secure device and nor should my mobile number+email address be the single factor authentication to my bank account (it's not too hard to transfer ownership of mobile numbers). I would not have even linked the account to my mobile number if I hadn't been forced to to conduct a larger payment. This is a big step down in terms of security for me.

I only use the account for purchases, not to receive money, so in terms of what to do next I think it'll be this:

1. Since your post was recent, hopefully the change is recent also and they'll back it out in the next week or so (not holding my breath). After a week or so I'll move to step 2.

2. Change all my recurring payments to use Visa or another option (I don't think there are many fortunately).

3. Close my PayPal account and start paying for ad-hoc things with Visa. I'll probably do this via PayPal when offered (so I'll have to put in my name, address etc. as well as the card every time), because at least they're a trusted party to give the Visa number to.

The option of using Visa everywhere isn't great either (23 numbers and you're done), but since I'm doing that in many places anyway the above should at least reduce the number of lower security ways people can extract from my bank account.

I also considered 'bypassing' this issue by changing my PayPal email address to a password-like alias (e.g. <removed> at mydomain.com), but unfortunately PayPal shares this email automatically with merchants, so it wouldn't be possible to keep it secure.