@4channel,
I've not seen evidence to support the conclusion you have drawn about PayPal accounts.
What I have noted follows on directly from your first post, though. You have quoted:
@4channel wrote:
AUSTRAC orders audit of PayPal Australia’s compliance with financial crime laws
AUSTRAC has ordered the appointment of an external auditor to examine ongoing concerns in regard to PayPal Australia’s compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (the AML/CTF Act).
These concerns relate to PayPal Australia’s compliance with its International Funds Transfer Instruction reporting obligations, which require regulated entities to report the transfer of funds or property to or from Australia.
https://www.austrac.gov.au/about-us/media-release/austrac-orders-audit-paypal-australias-compliance-...
[...] When speaking to a PayPal consultant, the reason given is that this is what Austrac is demanding of PayPal. PayPal seems to be targeted some account holders and not others from what is evident at his stage. The people targeted seem to be the folks that have a balance. A balance of a hundred dollars gets frozen. PayPal's asking for sensitive info DOB, home address and other. This is then sent to Equifax for confirmation. [...]
So in this (whatever you want to call it) the players are PayPal, Austrac and Equifax.
That is, as you yourself have stated, 4channel, AUSTRAC ordered the appointment of an external auditor for PayPal Australia. You might not have followed up with this, though, because in September of last year, an extension was granted for this appointment. I'll quote from AUSTRAC:
❝AUSTRAC grants extension for PayPal Australia audit
On 23 September 2019, AUSTRAC ordered the appointment of an external auditor to examine ongoing concerns regarding PayPal Australia’s compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (the AML/CTF Act).
These concerns relate to PayPal Australia’s compliance with its International Funds Transfer Instruction reporting obligations.
On 27 February 2020, AUSTRAC granted an extension to the appointment of the external auditor until 31 August 2020 following a request from PayPal.
AUSTRAC has granted the extension taking into consideration the scope of the audit, the size and complexity of PayPal Australia's business operations and the overlap with PayPal's international operations. The extension will allow PayPal Australia and the external auditor to fully examine their compliance with the AML/CTF Act.❞
– https://www.austrac.gov.au/about-us/our-recent-work/extension-paypal-australia-audit
(There was a modification declaration made on 29/9/2020.)
It follows that when PayPal account holders are being asked to provide ID, it is because of the requirement to be in compliance with the AML/CTF Act.
While I agree with you that there may well be a perception of risk specifically regarding identity theft when people are asked to provide ID online, the fact is that when it comes to money and the activities of such a complex and large business such as PayPal, verifiable ID is a requirement. Money laundering is rife; just think of the Crown Casino investigation recently announced.
❝The financial crimes regulator is investigating casino operator Crown for potential breaches of Australia's anti-money laundering and counterterrorism financing laws.
Crown said in a statement to the ASX that AUSTRAC had identified potential non-compliance with the laws including "concerns in relation to ongoing customer due diligence, and adopting, maintaining and complying with an anti-money laundering/counterterrorism financing program".
The matter has been referred to the agency's enforcement team, which has begun a formal investigation into Crown Melbourne.
Crown said the investigation was focused on Crown Melbourne's management of customers identified as "high risk and politically exposed persons", which is likely to include customers brought to the casino by junket operators in China.
The gambling giant said it would "respond to all information requests in support of the investigation and fully cooperate with AUSTRAC in relation to this process".
An AUSTRAC spokesperson confirmed the investigation into Crown Melbourne.
"The enforcement investigation is a result of an AUSTRAC compliance assessment that commenced in September 2019," the spokesperson said.❞
– Crown Casino to be investigated by AUSTRAC over potential money laundering breaches
In terms of a PayPal account holder who has been asked to provide ID, that person has a choice: to continue to be able to use PayPal, they must provide the requested ID, but if they do not wish to provide the requested ID, PayPal neither can nor will make an exception for that person, and the person will cease to be able to use PayPal.
If there are grounds for suspicion that the person may be involved in money-laundering (and the refusal to provide ID may be seen as such grounds), PayPal would be non-compliant with the AML/CTF Act if they simply allowed the individual in question to move money.
If the individual is not involved in anything dodgy, but simply has fears about his/her identity being secure, I'd suggest that that person contact PayPal requesting that they be allowed to remove their funds but that they do not wish to provide any additional ID due to their concerns about ID security. Assuming that this doesn't cut the mustard, that person can then contact the Australian Financial Complaints Authority and make a complaint.
I acknowledge the valid concern about one's personal details potentially being in the cloud or on an accessible drive. There have been data breaches. Unfortunately, refusal to provide ID to a business or organisation that is required to check ID to the standard and in the circumstances outlined in the AML/CTF Act is going to result in the person concerned being limited in how they can control their finances. Any body that requires ID to be provided online rather than in person will pose a problem for that individual... and even bodies that have a physical location will almost certainly be storing individuals' details in such a way that it is possible that those details could be accessed in a data breach.
There's no easy answer.
It must have been a great deal easier in the days when one was identified as "Og, the son of Ooga with the wide nose, yes, that one over there, the one wearing the tunic made from a Smilodon coat".
The worst danger is when one provides personal information to a non-valid body - i.e., a scammer. Providing that same information to an authorised body whose actions are prescribed by Acts that protect society and the consumer does not carry with it that same risk. That is worth considering.
