There are a few reasons that could cause paypal to send back:
FAIL ERROR: 4020
When you attempt to verify PDT transaction data by posting a _notify-synch command. However, in 9 times out of 10 the cause is due to the request containing an incorrect ‘at’ or authorisation token argument.
The ‘authorisation token’, or ‘Identity Token’ is a big long alphanumeric string, to find yours log into your paypal account, click on ‘Profile’, then click on ‘Website Payment Preferences’, scroll down to the ‘Payment Data Transfer’ section – you will see your ‘Identity Token’ at the end of this section.
This token must be included in your _notify-synch command as an argument named ‘at’.
Some more information on Paypal’s PTD can be found here: