Withdrawing Kiva Credit Back To PayPal

[Guest]

.

[ej]

Joe:
Part of your original comment said:
"...Something else I found interesting was the page that asked for the PayPal e-mail address. Does any PayPal e-mail address really mean any e-mail address? So if I wanted to withdraw and send it to someone else, would entering their e-mail address instead of mine send my converted Kiva credit to their PayPal account? Or does Kiva compare the e-mail address on the account to the one the withdraw request is going to as part of this 1-3 week process? I'll probably find that out soon since I've got a different Kiva login e-mail address than the PayPal address I entered on the form."

I saw the reply from anushka, but she did not address the different e-mail address question.

Would you please let us know what actually happens with your withdrawal: Was the e-mail address any sort of problem & how long did it take to receive it?

Thanks!

[Joe]

Welcome to the forum, ej.

I received the withdrawal yesterday, along with an e-mail titled "Your Kiva Withdrawal" from PayPal informing me that Kiva just sent me money. There was a "custom note" portion, which contained a message from Liz saying the withdrawal has been processed, contact her if any further assistance is needed, etc. So it took 3 days.

I'm still interested in knowing how they verify that it's actually going to you, especially if you enter a different e-mail address. Maybe there's a way to compare names through PayPal when sending money, despite different e-mail addresses. If so, that poses more interesting questions. Like what if names don't match; does Kiva not process the withdrawal and/or confirm with the account holder that they want it to go to so and so?



I also still think there should be some sort of destination verification when you put in a request for a refund. No e-mail address comfirmation, especially if you're requesting a withdrawal to a different address than your Kiva login, seems like a problem waiting to happen. What if someone entered a different address incorrectly/made a typo and their withdrawal went to someone else (assuming the e-mail didn't bounce)? That wouldn't be good.

The current Kiva Withdrawal Confirmation e-mail (sent to your login email) looks like this:

Dear [Your Name],

This email confirms your withdrawal request of $??.00.  You can expect the funds to be deposited into your paypal account within 1-3 weeks.

We hope your experience loaning money to poor entrepreneurs has been a positive one.  If you have any feedback please don't hesitate to share it with us by replying to this email.  We read each and every email we get, and we'd love to hear from you!

Thank you,
Kiva Staff

I'd strongly consider changing that to something like:

Dear [Your Name],

This email confirms your withdrawal request of $??.00.  You can expect the funds to be deposited into your paypal account (withdrawalddress@goeshere.tld) within 1-3 weeks. If this email address is incorrect please contact us immediately.

We hope your experience loaning money to poor entrepreneurs has been a positive one.  If you have any feedback please don't hesitate to share it with us by replying to this email.  We read each and every email we get, and we'd love to hear from you!

Thank you,
Kiva Staff

And if Kiva allows you to send your withdrawals to a PayPal account belonging to someone else, then I'd change "your paypal account" to "the following paypal account".

Even better would be a different e-mail message before this one, with a confirmation link that you have to visit. You've seen them before. In fact this forum sends one automatically to verify your registration before you can post. If Kiva had a system like this, then basically, you'd initiate a withdrawal, an e-mail is sent to your Kiva login address with a special link that takes you back to the Kiva site and verifies it was you that initiated the withdrawal process and double checks with you about the PayPal account it's going to. If all is well, you hit OK and the withdrawal process begins from there with a confirmation e-mail like the one above. An effective extra measure of security and verification.

[ej]

Great thoughts, Joe.
Double checking destination e-mail addresses and extra security steps with money transfers is a good idea.

[Henry]

Joe and I did a test today, I withdrew a $25.00 credit for 'a loan cancellation' KIVA did, and when it came time to enter the pay pal email, I entered Joe's.  It went to Joe as far as we know!   No warning, this address isn't the account holder's or anything like that. 

Hopefully Joe will post the pics and end result of the transaction.

[Joe]

Thanks to Henry for offering to do this little test and grab the screen shots. Below are the screen shots he took in order. Click to enlarge.

1. Henry has $25 credit in his Kiva account.

2. Henry clicks the Withdrawal link and gets a page where he can enter an e-mail address (twice). Note the wording on there. "deposited into a PayPal account of your choice".

3. Henry enters my e-mail address instead of his.

4. Donate to Kiva. It costs money to process the transaction?

5. Are you sure? The confirmation here is nice with a visual check of the e-mail address where the withdrawal is going.

6. Thanks. You'll get your money in 1-3 weeks.

7. Henry has no more Kiva Credit because he just sent it to me (rubs hands).

8. Henry gets the confirmation e-mail from Kiva saying that he can expect the funds deposited into his account within 1-3 weeks. But wait, he didn't send it to his PayPal account....

At my e-mail address, which Henry entered instead of his, I get... nothing. Except probably an e-mail in 3-21 days saying I have money from Kiva and that my Kiva account withdrawal has been processed. This is assuming they don't have some sort of PayPal name/verification on their end that might raise a red flag. This post detailing what we did will probably raise one.

The main security problem I see here, is if someone has access to your Kiva account or can guess your e-mail/password (a common problem), they can, in theory, withdraw your money to themselves without you really knowing if there is no check and balance there. Also, the confirmation e-mail says your funds will be deposited into YOUR paypal account. An inexperienced user with a compromised account who gets a message like that might think it's their loan payback, since there is no mention in that e-mail what paypal account/address it went to.

So a confirmation message sent to the account holder asking a second time if they authorized the withdrawal to so and so, especially (perhaps only) if the e-mail address the withdrawal is being sent to doesn't match the one used for their Kiva login, would go a long way for security and piece of mind.

With large withdrawals, I'd hope someone at Kiva just calls you up and verifies your info and request that way. I can't imagine sending hundreds, maybe thousands of dollars to a PayPal account without making absolutely sure, and especially if the address entered on the withdrawal form doesn't match that persons Kiva login address.

Anyway, I hope this isn't seen as being hard on Kiva. I'm just a security freak, I suppose. Working in computers, I've seen too bad many things happen to good and unsuspecting people with their information and finances online. I'd hate to see any Kiva lender find out that their account has been compromised and/or money stolen/messed with. A great organization like Kiva also doesn't need that kind of negative publicity.

[Dottie b]

Is this riskier than someone getting the password to your PayPal account and sending your money to their email address? Of course in this case, you can look up your PayPal account and see where the money went. We need to know what was reflected on Henry's Kiva account page - did it say to what addresss the money was sent, or just withdrawn by him?

Dottie B

[Henry]

Here is that answer: