Payment gateways enabled without consent
-
I received 10 separate emails earlier today, advising that multiple Payment Gateways have been enabled on my site. These gateways are:
Blik (via PayPal)
iDeal (via PayPal)
MyBank (via PayPal)
Bancontact (via PayPal)
Trustly (via PayPal)
EPS (via PayPal)
Multibanco (via PayPal)
Standard Card Button
Przelewy24 (via PayPal)At no time have any of these options ever been enabled on my website!
I’ve disabled them all now, but I would appreciate if you didn’t automatically enable payment options without authorisation, or make any changes whatsoever to the plugin configuration on the site.
The page I need help with: [log in to see the link]
-
Hello @ahortin
Most likely, those payment methods were already enabled before, but they were not visible in the same way as they are now.
In the legacy UI, alternative payment methods (APMs) were only effectively disabled if they were explicitly added to the “disabled APM” list. In practice, this was quite rare, and many merchants were simply not aware that these methods were active in the background. We could confirm this by temporarily reverting you to the legacy UI.
With the update from version 2.x or 3.x to 4.x, this behavior has changed. If APMs were previously enabled (which was the default, opt-out configuration), they are now exposed as separate WooCommerce payment gateways. As a result, you may see notifications such as: “Payment gateway ‘Przelewy24 (via PayPal)’ enabled”.
This is expected behavior. The key change is that legacy APM smart buttons are no longer supported in the new UI. Instead, they have been converted into individual WooCommerce gateways with their own settings and visibility controls.
No new payment methods are being activated. What has changed is their visibility and how they are managed.
Previously, APMs like iDEAL, Bancontact, or Przelewy24 were already available (depending on the merchant’s country and eligibility), but they were less visible and easier to overlook. The new UI simply makes them explicit and manageable at the WooCommerce level.
- APMs appeared as additional buttons inside the PayPal button stack
- Visibility was controlled by the buyer’s IP address (e.g. Dutch IP for iDEAL)
- Not always listed as separate gateways in WooCommerce settings
- APMs are individual WooCommerce payment gateways
- Visibility is determined by the buyer’s billing country
- Shown as separate entries in WooCommerce settings (more visible to merchants and eligible buyers)
If you have any doubts about this please let us know.
Kind regards,
KrystianThis seems like a huge issue with your plugin configuration then. Why are you explicitly opting people into payment gateways, and forcing them to “Opt-out”. I don’t even recall seeing any options in the previous UI about alternate payment gateways or being required to explicitly “Opt-Out” (instead of Opting-in).
If these were previously enabled, unknowingly, then why do all the emails that I received tell me that the above Gateways were just enabled? Surely, if these options were already enabled as you’re saying, then why would I get any emails to say that something has changed?
Hello @ahortin
I understand why this looks confusing, so let me clarify how this works.
In the previous (legacy) UI, alternative payment methods (APMs) were enabled by default. They were part of the PayPal configuration, but they were not exposed as separate WooCommerce payment gateways, which is why many merchants were not aware of them.
They would only be effectively disabled if they were explicitly added to the “disabled APM” list. If that never happened, they remained enabled in the background.
With the new UI (v4.x), these same APMs are now split into individual WooCommerce gateways with their own settings. During this migration, WooCommerce detects them as “newly enabled gateways” and sends email notifications like:
“Payment gateway ‘Przelewy24 (via PayPal)’ enabled”
So even though it looks like something new was activated, in reality:
- Nothing new was enabled by us
- The existing configuration was simply migrated
- The difference is that WooCommerce now treats them as separate gateways and triggers notifications accordingly
Previously, you wouldn’t receive any emails about this because APMs were handled internally within the PayPal integration and not as standalone gateways. So the key point is: this is a visibility and structure change, not a change in what was enabled.
Kind Regards
KrystianHi Krystian,
Thanks for the explanation. I think it’s still incredibly confusing for the end user though. These APMs should’ve been disabled by default, not enabled. This would’ve prevented all these unnecessary “Payment Gateway enabled” messages, that no doubt, a lot of people are going to be receiving as their plugin gets updated.
Hello @ahortin
I understand your point, and I agree it can be confusing from a user perspective.
The challenge here is that there isn’t really a perfect approach that satisfies everyone. If we had disabled all APMs by default during the update instead of migrating the existing configuration, we would likely receive reports from merchants asking why previously available payment methods suddenly stopped working. To avoid breaking existing setups, we chose to preserve the previous state and migrate the configuration as-is.
What’s makes it confusing here is that WooCommerce sends email notifications when they appear as “enabled”. This creates a lot of noise, even though nothing functionally changed on the PayPal side.
Kind Regards
KrystianI got the same emails. So just to be clear, Multibanco, Trusty, Przelewy24, MyBank, iDeal, EPS, Blik and Bancontact are all legitimate parts or gateways to the paypal payment method? What would constitute disabling them, or is that even advisable, so as not to mistakenly turn a customer away due to a payment issue?
Hello @naughtyandnicelingerie
Yes, that’s correct are all the local payment methods provided via PayPal. More details here: https://woocommerce.com/document/woocommerce-paypal-payments/local-payment-methods/
They are geo-based, so what shows up depends on the customer’s location. For example, I’ve had multiple cases where I screenshoted US store using my vanilla Polish IP, and then shared a screenshot with the user, who was surprised by the big red przelewy24 button on their checkout.
As for whether you should disable them, it really depends on your setup:
- If you sell worldwide (especially digital goods), it’s generally better to leave them enabled, as they improve conversion by offering familiar local methods
- If you want strict control over checkout or only sell locally, then you can limit them but it may reduce conversions for some users
So unless you have a specific reason to restrict payment methods, I would keep them enabled.
Kind regards,
KrystianThank you very much for the clear and thorough explanation
Hello @naughtyandnicelingerie
No worries, always happy to help.
If this helped and you’re happy with the support, feel free to leave a quick review on WordPress. It means a lot to us and shows that we are needed as support.
Kind regards,
Krystian
You must be logged in to reply to this topic.