I received a curious email from PayPal the other day:
Now you can use Membership RewardsŪ Points with PayPal
Now when you shop online with PayPal, you can use points. You'll get a statement credit on your American Express for eligible purchases.
If you ever want to remove Membership RewardsŪ Points from your available payment options, just go to your Wallet and select your American Express XXXX. You can learn more about Pay with Rewards on our website.
There are several things odd about this. The first thing I noticed was "You'll get a statement credit on your American Express for eligible purchases." This doesn't seem to make any sense within the context of using MR points for PayPal purchases. Are they trying to say that you'll earn MR points for PayPal purchases, even if you use MR points to pay for it? Even if that's the case, those wouldn't come in the form of a statement credit.
Also, the wording around "select your American Express XXXX" seemed a bit awkward (XXXX was actually my real last 4 digits of my Amex linked to PayPal). So, this has several warning signs of a phishing attempt. But, looking at the mail headers, it appears to genuinely be from PayPal, and the links all go to paypal.com. They had my actual last 4 of my Amex card. And, when I log into my PayPal account, I now see my MR points balance, and there's an option to use them when making purchases. The online help explains how it works, except for the "statement credit" weirdness.
It seems like the content of such an email would have been better reviewed by PayPal and/or Amex.
What troubles me most about this is, like what's happened with Amazon, is that there's now a way to spend MR points at a third-party website. If someone broke into my PayPal account and charged things to my Amex as a purchase, I'd have the chargeback protections guaranteed by federal law. But, if they spent down my MR balance, and PayPal couldn't undo it, I'm not so sure what my position with Amex would be. It's possible I would have no legal recourse, and would be dependent on their good grace in making me whole.
I wish that these "spend your MR points on other websites" features couldn't be enabled without the cardholder taking explicit action on the Amex site itself.