What responsibility I have by letting customers take payments from their clients on my system I want to let users add their Stripe, Braintree or other payment processors API keys to my system and then let them send links to their clients where they can pay for services or whatever they are asking for. Question is how much responsibility/liability I have taking into account I will only provide a system to connect their payment processor's accounts. I will never receive money from end-users. But domain, where they will be making payments, is mine. Thank you for your help
You have two downvoted answers here. One of them is actually correct, one is nonsense. Question: Which one? Answer: Doesn't matter. If you provide this service without getting advice from a competent lawyer first, your risk is much too high. Making the wrong decision (either giving up on a good business idea without reason, or providing a banking service without license) will cost you much much more than paying a lawyer for advice.
It isn't necessarily "illegal" (in the sense you are committing a crime) but you may be in violation of a verbal contract (which would fall under tort law). Let's take this a bit further. Perhaps Joe Schmoe gave you his debit card information so that you could make deposits for him and he said you could take $5 out for yourself for the trouble. This is a contract between you and Joe for a service. You can't extend Joe's offer to Jane Doe by saying "here is some debit card information, take $2.50 out for yourself". You have no right to extend your contract with Joe to somebody else. Now specifically for passwords it basically boils down to the same thing. Unless Joe gives you explicit permission to give that to somebody else, you can't just decide to unilaterally give what Joe gave you to somebody else. This may be different if Joe said "here, I'm buying you a subscription to service XYZ because you are a nice guy", this may be construed as a gift which transfers ownership. At that point you have control over what is or isn't done with the account. As another example let's say Joe let you borrow his car. You can't turn around and say to Jane, "here's a car you can use", Joe did not extend the offer to Jane, nor did Joe give you the right to extend the offer to another person. It's a moot point though, in the original context of this question, Netflix does restrict you from sharing your passwords "outside your household". Almost every paid service has some restriction against sharing with others. In the end Netflix may shut off Joe's account and Joe may sue you for damages, but you aren't going to be thrown in jail for this. This would be a civil case (tort) which you may be liable for monetary damages.
This involves interaction between legal liability, the nature of online services, and copyright law. If a person does something that causes damage, they may be liable and required to pay for damage. Given the right protected by copyright law, damage results in making unauthorized copies of a work, and the copier can be made to pay. A person who contributes to bringing about damage can also be held responsible, depending on their exact relationship to the damage (copyright infringement in relevant cases), so in Gershwin Publishing v. Columbia Artists, Columbia organized a musical event where various artists did the infringing performances, knowing very well that there was no permission as required by law. The court held that "one who, with knowledge of the infringing activity, induces, causes or materially contributes to the infringing conduct of another, may be held liable as a 'contributory' infringer". There are various nuances regarding how a potential enabler might or might not be held liable. In MGM v. Grokster, Grokster knew that their software was primarily used to disseminate protected material, and encouraged infringement. Similarly (and earlier), Napster was found to be contributorily liable in A&amp;M v. Napster. On the other hand, in Sony v. Universal, it was found that Sony was not liable for selling VCRs which allowed people to infringe copyright, primarily because Sony did not sell the VCR with the intent of aiding copyright infringement. Such "codification" as exists regarding contributory infringement and liability is due to case law. Congress could, if it wanted to (it does not), pass a law saying that no online service can be held liable for copyright infringement. This would require changes in copyright law, since online services do copy content (taking it from a contributor involves copying, delivering it to a customer does to), and they obviously distribute the material (usually by automated means, but that is still distribution). Any use of digital content in fact involves making many copies, almost all of them automatic (copying from an input port to a data buffer; copying from the buffer to disk storage; copying from disk storage to RAM; from RAM to computer registers; etc. where derivatives are "copied" to the speaker or computer screen). This fact makes digital services particularly vulnerable, since virtually everything that they do involves "making a copy". Congress passed the Online Copyright Infringement Liability Limitation Act as part of the Digital Millennium Copyright Act, which provided a way for online providers to be protected from liability, as long as they have "clean hands" and follow certain rules. The essence of this law is that if you provide a means for copyright owners to inform you of violations, and you respond expeditiously to proper notices by taking down infringing material, you may be protected. Simply posting a notice that says "we do not condone breaking the law" does not eliminate liability. If one takes reasonable steps to prevent infringement, you would not be liable. Apart from copyright infringement, websites can also be engaged in distributing child pornography, which also is against the law (even more so). And once you go outside the US, and are in a country with limited free speech protection, making forbidden statements can get you shut down. Getting "shut down" can come in multiple forms: one, where the company goes out of business because the damages that they have to pay are substantial, and also because the government can directly order a web site shut down (as in the Napster case). If online services are more susceptible to being shut down compared to other businesses, it is probably due to the mistaken feeling of anonymity and failure to understand copyright law.
The linked Bloomberg story quotes the rule as: The recipient is allowed to keep the funds if they [the funds] discharge a valid debt, the recipient made no misrepresentations to induce the payment, and the recipient did not have notice of the mistake. If the recipient, or somone acting on behalf of the recipient, hacked the sender to induce the payment, that sounds like a form of misrepresentation to me. If the hacker is unconnected with the recipient there seems no way that the hacker benefits financially, although I suppose a hacker might simply want to cause an amusing disruption. As I understand it this rule only applies when the sender in fact owes a debt to the recipient that the transfer pays off. If the hacker were working for one of a large group of recipients, most of whom are innocent, and subsequent analysis establishes that there was a hacker, but not who the hacker was or which of the many recipients the hacker was working for, I suspect, but cannot prove, that the doctrine would not apply, because the transfer was not a valid but incorrect act by the sender, but was a fraudulent intervention in the sender's procedures.
Is that extortion? false advertising? or in any way illegal? Not at all. The owner of the site is simply exercising his right as outlined in the terms and conditions from when the user signed up. And giving users an option for continued use of the site (that is, for him not to exercise a right of which they were always aware) does not constitute extortion.
It is rather unclear what the facts are, and the legal answer would depend crucially on those facts. My understanding is that you bought a domain from a provider, and they allowed you to use a web server for some period. It also appears that you don't have a clear understanding of the contract, which may have been made online and you might not have retained a copy of the agreement (which would allow you to look at the terms). The assumption that failing to pay substitutes for explicitly cancelling a service is incorrect. If under the contract you agree to pay a certain amount per year, then you have been racking up charges for some time, and you would need to actually cancel. Ultimately, they could take you to court to force you to pay what you owe, although usually there are less drastic intermediate steps. In court, they would produce their documents to show that you owe money, and your attorney would somehow counter, perhaps by alleging that you had a good-faith belief that the contract had been terminated. It is possible that they simply messed up and failed to send you an invoice earlier, which could explain the lack of invoice. At any rate, the fact that you haven't gotten an invoice does not legally entitle you to avoid paying for the service, whether or not you use it. On the premise that they haven't taken back the domain (seems like they didn't), you can legally use it. However, if you do use it, then that would trash any claim that you believed the contract had been terminated (to argue "I thought it had been canceled" entails "and thus I didn't use the service").
Yep, you are. You still need to keep the LICENSE and NOTICE files in the repository, if there were any in your copy of the project. These files contain the terms and conditions for the project, and provide attribution to the original developers. If you're trying to attribute in the UI of your application, you probably should. It's considered courteous and in the spirit of open source as well. This is also related: Do I need to include the full text of the MIT license in the UI of my app?
I decided to rewrite this after the clarification in the comments. You can find the old version in the history. The question is not, actually, about a browser extension. It is about a web service that can be accessed by the browser extension. The way to access the service should make little difference, it could be clay tablets, homing pigeons, or this browser extension, what matters is the service. The service has two functions: Receive PII of the victim, sent by the customer, to calculate the probable email of the victim, and return this PII to the customer. The service operator could argue that the customer is really the data controller under GDPR rules, and that the service operator is only the data processor, but that is not a plausible use case. The customer would need to get and document the consent of the victim before the probable mail is calculated, so why would the customer pay the service operator for a service like this? There is already contact with the victim. Generate a database of specific company email patterns to enable 1. This would also use PII, from random employees of the company in question, and there is no customer to shield the service provider by pretending that consent was collected. The way around the first issue might be to sell the database and have all calculations on the customer's system, but that doesn't resolve the second issue, that of creating the database. This involves looking for patterns in PII of individuals, unless the target company is obliging enough to make the pattern public.