This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors).
Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good guy or a bad guy so it's easier to just ban guns.
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronomically lower than any Chinese spyware-infested phone.
If you run a rooted phone and download malware, that malware can gain root and do payments on your behalf.
Then PayPal has to deal with you revoking payments etc., they don't want to so they forbid you from using PayPal on a rooted phone.
Malwares can possibly do that even on non rooted phones if a privilege escalation attack is possible. And just yesterday, there was an article here about exactly one of those.
Also I highly doubt that there is any real statistics anywhere about whether this is a real threat or not. I guarantee that nobody did such statistics properly. The only known data is from companies which sell root prevention tools, so totally unreliable. And internally I guarantee, that no banks collect such info.
So no, banks lie about this only because they can sell this to judges as safety feature, when they fuck up, which happens continuously.
Which they would be anyway since PayPal isn’t a bank and isn’t FDIC insured.
They allow you to open PayPal.com on any web browser. Running Windows/macOS/Linux is basically identical to a rooted Android phone (you have local admin rights, you can modify and automate the browser, and can run unsigned code).
Fine by me. My example illustrates their incompetence if they are willing to let a user with an OS that hasn't received any updates in half a decade, then clearly, they don't give a single crap about security.
I see this happen from time to time. Lately, almost all of the apps work fine on GrapheneOS. The best strategy is to keep writing the business once every two or so weeks that you can’t log in to and use the app. Don’t go too technical at first, because most of the time, the moment they hear things like “rooted” or “unofficial,” they just say your phone is the issue. To date, I was able to convince, or at least contribute to, making three apps work on GOS.
I had the same experience. Asked in an email why an important government app won't work on GrapheneOS, first without any technical details. Got the response that it's "because security". I sent some technical details and argued that they're denying service to their most security-conscious users. 3 months later the app started to work!
Great job, man. We have to make ourselves get heard. It's a social problem after all. Technical workarounds are great and sometimes the only practical short term option, but we have to fix the social issue at the root.
Does this really have anything to do with GOS and more to do with apps not wanting to run on rooted phones? A rooted phone is more likely to be tampered with and have its sandbox rules relaxed. There's a big business of security companies selling tools to harden mobile apps and the bare minimum is not running on rooted phones.
Why would anyone still use PayPal after so many cases of accounts being banned and funds being frozen for no reason, and all the other terrible stuff they've done?
Easy to say when you are in a country where you have a lot of options.
There's some countries with very bad financial sector where your option is PayPal or Western Union as the local banks don't know how to do international transfers, Remitly doesn't support all countries and Wise also doesn't work. PayPal works, even if they charge fees.
I've had to use it when my bank's purchase limits did not allow for card (virtual or real), but the same purchase was allowed when going through PayPal. It was annoying AF, but was much faster than contacting my bank and getting permission to spend my money.
SEPA uses your IBAN (account number), and one can also enter this account number for payment, implicitly allowing the store to withdraw money from it...
You must be referring to SEPA Direct Debit, which would be very risky to use to siphon funds. There's an 8 week no-questions-asked refund policy, 13 months for unauthorized transactions, if the payment fails (eg due to insufficient balance), the payee is charged a non-refundable cancelation fee. [0] And that's all separate from any legal troubles for fraudulent charges. I don't know why Germans use PayPal over SEPA, but I'd be surprised if SEPA Direct Debit was the reason.
IBANs aren't secret, they have the same level of confidentiality as your address or birth date.
One-off SEPA Direct Debit is virtually unheard of, recurring payments are a bit more common but usually involve a €0,01 payment to prove ownership of the account. The transactions are also trivial to undo, and can only be initiated by companies.
So no, "IBAN fraud" isn't a thing in practice. You can safely share your IBAN with your friends for instant free wire transfers.
Well yes. But just in case this wasn't clear: this is a crime, and you will get your money back in most cases. It's on the merchant to ensure a Direct Debit Mandate is actually valid.
I do not think it is possible to withdraw money having only an IBAN.
It would need a SEPA direct debit mandate for my bank to accept the transfer request.
because global-ish exchange of goods and services for money is a deliberately convoluted experience that only a handful of well-connected entities are allowed to facilitate, which enables each and every one of them to put "we reserve the right to fuck you in the ass for any or no reason" in their ToS.
The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
"Ironic" means saying the opposite of what you mean in order to be funny or sarcastic. So that would mean you think I was both polite and not an idiot.
It is a useful tool, but is largely irrelevant to this issue.
To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
I'm on Debian Testing sometimes on amd64 and sometimes on m1. Paypal also doesn't like me. Than I have two options: I use a Windows VM to do the payment or I use another payment method. Most of the time I use the other payment method.
Confirmed on my phone too. I left a 1-star review on the play store saying it crashes on every launch, uninstalled and will use the website from now on. (Luckily, I dont use contactless payments, ai just send and receive money from friends from time to time)
I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick.
Edit: checked now, I have also disabled secure app spawning.
Interesting, just inferring from that it sounds like GrapheneOS's actual-security features might have been tripping up PayPal's root-detection "security" features.
(Rather than something fundamentally incompatible, like them using Play Integrity)
There are valid RASP techniques that involve dynamic code loading, so it actually makes a lot of sense. Source: I worked on RASP a long time ago :)
IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.
I also ran into the eBay application being blocked just recently. Other than that I've had no issues, but I imagine this is going to become more and more common as time goes on.
Wero is not a PayPal alternative. It doesn't even have buyer's protection and every bank must manually implement it which immediately makes it a failure. Some banks also connect it to your phone number so you can't link Wero to two different bank accounts with the same number when you have 2 bank accounts. Very messy.
You need to use your bank's app for Wero, and many EU banks' apps refuse to run on GrapheneOS for the same reasons as PayPal. This is sadly not a clear win for Wero.
wait for it... I can see a future were every wallet, payment etc. app will block devices which are on custom ROMs and do not pass strong hardware integrity with blessing from Google.
I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.
Hopefully these stupid companies that are refusing to allow their apps to run on GrapheneOS will have a change of heart when Motorola begins launching their new phones:
I'm starting to see these restrictions as a deterrent for using the products in question. My GOS handset is slowly fizzling away into a dumbphone with Firefox, organic maps and k9. And you know what, I am starting like it.
This is what really makes me question if I want to continue to use GOS, already some UK banks apps (which are app only) don't want to run. I'm considering switching back to stock as I can't be bothered to try to find hacks and workarounds for daily necessities.
I still remember when my bank wanted me to run Android 9 instead of my Android 15 rom (without root) on my Samsung S8 because "muh security!!"
Funnily enough, the only way to hide those detections was to Root my phone...
And i still remember when i had an appointment there, they wanted to see something in my Bank app, i opened it (and i assume it had an update since i then last used it) and a big "THIS DEVICE IS NOT SUPPORTED. ROOT IS NOT SUPPORTED" poped up
But was as simple as readding the bank app to my root hiders.
These days, root is mostly flagged via indirect indicators rather than detecting the root binary itself. For instance, detecting custom ROMs is a common clue. Does anyone remember the suhide days? ;)
That's the bizarre thing about this hn discussion... A lot of people referencing rooted phones, but to the best of my knowledge GrapheneOS is almost never rooted?
It can be rooted just fine without doing your own build. It's just that if you do, the GrapheneOS community will claim that it is no longer GrapheneOS and that it's separate.
Paypal doesn't work on LineageOS since a long time, even though the connections of that dubious Graphene distro with the US government are always in the horizon it is just natural that paypal doesn't work there now.
Otherwise it would just continue to raise suspicious that Graphene is favored by governments and big tech.
This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!
Generally I think the issue is that there's a tension between your security vs Paypal's security (deliberate, motivated bad actors).
Maybe an analogy could be about using metal detectors as a layer to reduce bank robberies. A gun in a good guy's hands is a good thing to prevent robberies. Guns in a bad guy's hands are a bad thing to prevent robberies. Paypal knows you have a gun but they don't know if you're a good guy or a bad guy so it's easier to just ban guns.
That's your argument? Mate, you can make explosives out of stuff you can buy in literally any supermarket and no one bats an eyelash. You don't have to legally be adult to buy any of the things you'd need and I say that as someone who only struggled with chemistry in school, that's now low the bar is. What's the solution then? Ban sea salt? If someone is using Graphene, the chances of them getting hacked are astronomically lower than any Chinese spyware-infested phone.
How does a rooted phone enable bank fraud? This smells like pointless policy checkboxing.
If you run a rooted phone and download malware, that malware can gain root and do payments on your behalf. Then PayPal has to deal with you revoking payments etc., they don't want to so they forbid you from using PayPal on a rooted phone.
Malwares can possibly do that even on non rooted phones if a privilege escalation attack is possible. And just yesterday, there was an article here about exactly one of those.
Also I highly doubt that there is any real statistics anywhere about whether this is a real threat or not. I guarantee that nobody did such statistics properly. The only known data is from companies which sell root prevention tools, so totally unreliable. And internally I guarantee, that no banks collect such info.
So no, banks lie about this only because they can sell this to judges as safety feature, when they fuck up, which happens continuously.
Graphene isn't rooted.
Not only is it not rooted, it runs real Google Play services. It’s not microG.
If this happens it's the device owners fault and they should be responsible for it.
Which they would be anyway since PayPal isn’t a bank and isn’t FDIC insured.
They allow you to open PayPal.com on any web browser. Running Windows/macOS/Linux is basically identical to a rooted Android phone (you have local admin rights, you can modify and automate the browser, and can run unsigned code).
No, no... In 2026, all footguns are banned. Even in programming, so if something allows a footgun, it's banned now.
Apparently the world can't adult and be responsible for their actions, or people believe in that.
"Safe way to make sure I will stop being your customer - also YES!"
I don't think they care at all about the size of graphene os market share
if its jeopardize entire userbase then its not worth it
Fine by me. My example illustrates their incompetence if they are willing to let a user with an OS that hasn't received any updates in half a decade, then clearly, they don't give a single crap about security.
Noo, it’s the other way around lmao.
A financial security audit is one of the most thorough security audits you can ask for in software.
GrapheneOS gets blocked because it doesn’t follow the secure system requirements (root).
I suggest you read up the graphene documentation.
What requirements does it not follow?
>(root)
GrapheneOS is not rooted.
I'm sure their automatic bans have happened to more people than the number of grapheneOS users
I see this happen from time to time. Lately, almost all of the apps work fine on GrapheneOS. The best strategy is to keep writing the business once every two or so weeks that you can’t log in to and use the app. Don’t go too technical at first, because most of the time, the moment they hear things like “rooted” or “unofficial,” they just say your phone is the issue. To date, I was able to convince, or at least contribute to, making three apps work on GOS.
I had the same experience. Asked in an email why an important government app won't work on GrapheneOS, first without any technical details. Got the response that it's "because security". I sent some technical details and argued that they're denying service to their most security-conscious users. 3 months later the app started to work!
Great job, man. We have to make ourselves get heard. It's a social problem after all. Technical workarounds are great and sometimes the only practical short term option, but we have to fix the social issue at the root.
Does this really have anything to do with GOS and more to do with apps not wanting to run on rooted phones? A rooted phone is more likely to be tampered with and have its sandbox rules relaxed. There's a big business of security companies selling tools to harden mobile apps and the bare minimum is not running on rooted phones.
Why would anyone still use PayPal after so many cases of accounts being banned and funds being frozen for no reason, and all the other terrible stuff they've done?
Easy to say when you are in a country where you have a lot of options.
There's some countries with very bad financial sector where your option is PayPal or Western Union as the local banks don't know how to do international transfers, Remitly doesn't support all countries and Wise also doesn't work. PayPal works, even if they charge fees.
I simply use it as an intermediary between my bank and any website I don't fully trust
I use "virtual card" for those needs. For me, it doesn't justify bringing out PayPal
I've had to use it when my bank's purchase limits did not allow for card (virtual or real), but the same purchase was allowed when going through PayPal. It was annoying AF, but was much faster than contacting my bank and getting permission to spend my money.
Critical mass? I had to start using it after moving to Germany, because everyone else expects you to use it.
One of the ladies at daycare is leaving? Here's a paypal link to chip in for a good-bye present.
Split a take-out order with a German friend, but he paid? Here's his paypal to send him your share.
It's just assumed that everyone has paypal over here...
Thought they use Sepa
SEPA uses your IBAN (account number), and one can also enter this account number for payment, implicitly allowing the store to withdraw money from it...
You must be referring to SEPA Direct Debit, which would be very risky to use to siphon funds. There's an 8 week no-questions-asked refund policy, 13 months for unauthorized transactions, if the payment fails (eg due to insufficient balance), the payee is charged a non-refundable cancelation fee. [0] And that's all separate from any legal troubles for fraudulent charges. I don't know why Germans use PayPal over SEPA, but I'd be surprised if SEPA Direct Debit was the reason.
[0] https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direc...
That sounds like the same info on a check, which people hand out freely. I'm probably misunderstanding.
IBANs aren't secret, they have the same level of confidentiality as your address or birth date.
One-off SEPA Direct Debit is virtually unheard of, recurring payments are a bit more common but usually involve a €0,01 payment to prove ownership of the account. The transactions are also trivial to undo, and can only be initiated by companies.
So no, "IBAN fraud" isn't a thing in practice. You can safely share your IBAN with your friends for instant free wire transfers.
Well yes. But just in case this wasn't clear: this is a crime, and you will get your money back in most cases. It's on the merchant to ensure a Direct Debit Mandate is actually valid.
I do not think it is possible to withdraw money having only an IBAN. It would need a SEPA direct debit mandate for my bank to accept the transfer request.
because global-ish exchange of goods and services for money is a deliberately convoluted experience that only a handful of well-connected entities are allowed to facilitate, which enables each and every one of them to put "we reserve the right to fuck you in the ass for any or no reason" in their ToS.
Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks?
Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor
Hanlon's razor is for people. Organizations do not operate like people and do not deserve the same deference.
The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
Ironically, I had to apply Hanlon’s Razor to the impolite tone of your post
"Ironic" means saying the opposite of what you mean in order to be funny or sarcastic. So that would mean you think I was both polite and not an idiot.
Jokes on you though, I'm neither of those things.
It is a useful tool, but is largely irrelevant to this issue. To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
You're a banking app.
I've been called worse.
> have they blocked every OS they're unable to verify
This is evil in itself.
They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
Graphene isn't rooted....
I'm on Debian Testing sometimes on amd64 and sometimes on m1. Paypal also doesn't like me. Than I have two options: I use a Windows VM to do the payment or I use another payment method. Most of the time I use the other payment method.
I've been using it in the browser with GOS no problem. Any reason why one would need the app besides a little more convenience?
They require the app for certain things like managing which PayPal debit card category gets 5% cash back
Confirmed on my phone too. I left a 1-star review on the play store saying it crashes on every launch, uninstalled and will use the website from now on. (Luckily, I dont use contactless payments, ai just send and receive money from friends from time to time)
Can it still run in browser like it would on a regular pc?
Still works fine for me. PayPal and GrapheneOS are both on the current release.
Still works for me.
I had to update exploit protection after their latest update — I think it was enabling dynamic code loading via both memory and storage that did the trick.
Edit: checked now, I have also disabled secure app spawning.
Interesting, just inferring from that it sounds like GrapheneOS's actual-security features might have been tripping up PayPal's root-detection "security" features.
(Rather than something fundamentally incompatible, like them using Play Integrity)
There are valid RASP techniques that involve dynamic code loading, so it actually makes a lot of sense. Source: I worked on RASP a long time ago :)
IMO headline is very misleading, and OP should have tried disabling all exploit protection options before jumping to any conclusions. PayPal isn't actively trying to block GrapheneOS as of now.
I also ran into the eBay application being blocked just recently. Other than that I've had no issues, but I imagine this is going to become more and more common as time goes on.
eBay has been enforcing Play Integrity for over a year now. Luckily you don't lose much by using it in a browser.
I also get why they'd be desperate to fight bots. It's a weak excuse for not doing it better, but at least it makes some sense.
Update: it seems to work when disabling "secure app spawning" (for now)
Great to know, thanks!
thank you!
So it's not PayPal blocking GrapheneOS?
Switched to Wero and haven't looked back.
https://wero-wallet.eu
Unfortunately peasants like us who don't live in the 5 countries where it's available still can't look back
I live where it's available and still can't use it to pay stuff, only to transfer money to friends.
Wero is not a PayPal alternative. It doesn't even have buyer's protection and every bank must manually implement it which immediately makes it a failure. Some banks also connect it to your phone number so you can't link Wero to two different bank accounts with the same number when you have 2 bank accounts. Very messy.
> Some banks also connect it to your phone number
What do you mean "some banks"? I thought the whole value proposition of Wero was instant bank transfers with SEPA but using phone numbers?
You need to use your bank's app for Wero, and many EU banks' apps refuse to run on GrapheneOS for the same reasons as PayPal. This is sadly not a clear win for Wero.
wait for it... I can see a future were every wallet, payment etc. app will block devices which are on custom ROMs and do not pass strong hardware integrity with blessing from Google.
I've read once that there are paid app testing labs which test if an app has root and custom ROM detection and when they don't have that it's a minus point on the report.
Does this work in the UK?
No. We left the EU, so we don't get such fun.
The website is pages and pages of blankness for me on Firefox mobile.
Hopefully these stupid companies that are refusing to allow their apps to run on GrapheneOS will have a change of heart when Motorola begins launching their new phones:
https://arstechnica.com/gadgets/2026/08/motorolas-grapheneos...
if there is enough money to be made they will consider it...
I'm starting to see these restrictions as a deterrent for using the products in question. My GOS handset is slowly fizzling away into a dumbphone with Firefox, organic maps and k9. And you know what, I am starting like it.
I was always suspicious of GrapheneOS, thought it was too good to be true. But this makes me reconsider and want to install GrapheneOS.
it is great and you know that because cops are pissy about it
I think if paypal not working on GOS makes you not use it, then GOS is definitely not for you...
They're saying the opposite, no?
They didn’t read it that closely, they just wanted to put someone down and move along.
It works for me after enabling exploit protection compatibility mode. Pixel 9a on latest versions of GOS and PayPal.
This is what really makes me question if I want to continue to use GOS, already some UK banks apps (which are app only) don't want to run. I'm considering switching back to stock as I can't be bothered to try to find hacks and workarounds for daily necessities.
I would never use a bank that is app only. Sounds like a horrible experience.
Looking at the description, the title should be changed to "Contactless PayPal card does not run on GrapheneOS"
I use latest Aurora Store PayPal version and it still works. I just dont use contactless payment.
I'm not using the contactless payment feature and get the same crash and error.
I still remember when my bank wanted me to run Android 9 instead of my Android 15 rom (without root) on my Samsung S8 because "muh security!!"
Funnily enough, the only way to hide those detections was to Root my phone... And i still remember when i had an appointment there, they wanted to see something in my Bank app, i opened it (and i assume it had an update since i then last used it) and a big "THIS DEVICE IS NOT SUPPORTED. ROOT IS NOT SUPPORTED" poped up
But was as simple as readding the bank app to my root hiders.
but still, i hate this security theater
"RootDetectionSecurityException" .. there's your answer ... it doesnt't want to run on "rooted" devices.
Well I haven't rooted my device. It's just normal grapheneos
These days, root is mostly flagged via indirect indicators rather than detecting the root binary itself. For instance, detecting custom ROMs is a common clue. Does anyone remember the suhide days? ;)
iirc grapheneos can't be rooted unless you do your own build
That's the bizarre thing about this hn discussion... A lot of people referencing rooted phones, but to the best of my knowledge GrapheneOS is almost never rooted?
It can be rooted just fine without doing your own build. It's just that if you do, the GrapheneOS community will claim that it is no longer GrapheneOS and that it's separate.
Isn't it more likely to be saying that the app is running with root privileges?
Still works on my up to date pixel 9 xl. I haven't enabled NFC payments though
P10F, 2026081301, Aurora Store, secondary profile, flawless. Try harder.
When threat comes knocking, the door gets bolted-shut.
did you re-lock the bootloader?
With or without Google Play Services running?
With. But disabling "Secure app spawning" seems to fix it for now.
Paypal doesn't work on LineageOS since a long time, even though the connections of that dubious Graphene distro with the US government are always in the horizon it is just natural that paypal doesn't work there now.
Otherwise it would just continue to raise suspicious that Graphene is favored by governments and big tech.
It does work for me on lineages for microg with an Xperia 5 II. Haven't tried to activate contactless though.