Data breaches are the number one concern. Since PayPal outsources their call centers to Non-US territories that information can easily be breached. I always find that amusing when I get a call center representative that is in the Philippines. That's another soap box story for another day.
As far as the original topic goes recently ran into this myself with PayPals current deceptive business practices, from my perspective, after approximately three years of being a "customer" with their service and barely utilizing it. Apparently their third party system can't identify me. Eventually they changed their tune from the last four to the entire SSN. Makes me question the validity of their business practices and their services. In other words they are doing unsafe practices which contradicts their "motto".
The law is quite clear that if they can't prove that they are directly a banking institution, which they never willingly or easily provide because they aren't, PayPal goes on the list of ID Theft criminals. Assuming you are a citizen of the US, you may call Social Security at 1 (877) IDTHEFT and report them.
To prove they are a banking institution submit to them a W-9 requiring them to give their TIN and related information, and look up on the Secretary of State for California and Delaware. If PayPal refuses to remit the form to you then you turn them into the IRS for tax fraud. It's quite simple to do for any business. They are required by law to remit it to you or penalties ensue.
PayPal is also required to give specific U.S.C. reference when they claim "It's Federal law". If they do not they are again in breach of Federal Code and you are not required to give it under any circumstances. I would always suggest this in Certified Registered US Mail and not a web link. Web web documents are routinely fluid and can be easily manipulated by any entity to feed the Corporate greed.
If PayPal does not provide the appropriate refund in a reasonable amount of time PayPal, is in fact, money laundering.
Spend some quality time looking up the legal information, visiting your local DOJ, SS office, and of course never give them information without full written signed disclosure, legal documents, and reporting entities when they breach even on a phone call to them. PayPal has a history of not complying with Federal Mandates which is why, as a US Citizen, I will limit my usage of the PayPal system. No Terms of Use or Terms of Service may contradict Federal Code including the Privacy Act, Executive Orders, and other applicable law. However they'll attempt to make you think they can. If they fail to report these requests on demand then report them to the Federal Trade Commission. The more complaints against an entity the more likely they are going to be investigated for fraud as well as applicable felonies.
Just a few tidbits working as an Advocate and in the Criminal Justice system. Do the research for that information yourself and always verify, verify, verify when someone asks you for a SSN. Don't take my word for it and definitely spend more time on quality sites not volunteer based forums. Get involved with real agencies instead of pseudo-want-to-be agencies. Attempt to milk whatever information out of you will always be in the Corporate handbook so it can be sold, stamped on a lunch box, etc. The word is unscrupulous I believe that I'm looking for.
