Bitcoin Forum

I was surprised to see an established escrow provider say to ship items directly to the buyer after payment:

The follow-up was even worse. The buyer's account got hacked, and the hacker changed the deal after the buyer paid:
This resulted in a $50,000 scam.

Shouldn't it be the escrow's responsibility to make absolutely sure the trade can't go wrong in any possible way? The escrow provider is the experienced trader, who should assume one of the other parties could be a total n00b and the other one an experienced scammer.

I'd also say the deal should be completely clear before any payment is made, and once payment addresses have been exchanged, the deal should not be changed anymore. I think this scam could have been prevented by stricter escrow rules.

I'd like to see other escrow providers chip in on how they would handle this.

Totally fucked situation. I was reading the other thread. It was well organized and planned at least that's how it looked to me. The escrow did not have anything to do here. If you send me a message and then another message from your account then another message from the same account I will obviously think it's you. I would not have any idea that your account got hacked and someone else will send messages from your account.

May be we can always add a signed message using either PGP or known bitcoin address. This way you have one more option to verify a message even if this come from an expected source. Like in MJ's case if there was a signed message using bitcoin address for every PM the sent to each others then verification could be stronger.

The sender can give a fake tracking ID or used tracking ID and the escrow would think it's real. Or even worse, the sender can send something else, may be a piece of brick and get a tracking ID for it. Send the tracking ID to the escrow and escrow will think the item was delivered LOL

Agreed, someone saw an opportunity and took it with great skill.

But if I say something completely different it doesn't hurt to be extra careful. That's what I meant with "the deal should not be changed anymore".

Agreed again. That's what makes this scam so tricky, and I hope the community can learn from this and maybe prevent it in the future.

I find a Bitcoin signature much easier to verify than a PGP signature. In this case the victim didn't verify MJ's signature (even though it verified, so that wasn't the problem). But if the victim would have used signed messages too, hacking his account would no longer have been enough.

Exactly. What's the point of using an escrow with those terms?

No real use to be honest if someone really has intention to scam others. I always wondered about the way ebay deals. Someone can use the same idea and can fool ebay resolution. But I don't think there are many people who have intention to scam others. There are one or two in a million and they give the bad name.

On the other hand imagine everyone is sending an item to ebay warehouse and ebay has manpower to manually check all shipments. This will be a total mess. Obviously the senders are trusting ebay's logistics of course.

Bitcoin signed message is way too easier. I don't think majority here even have a PGP key and they know how to use it.

This is what I would have expected:

• Buyer and seller provide payment and shipping details to escrow.
• If all agree on all terms, buyer pays escrow and seller sends product to escrow.
• Escrow verifies product.
• Escrow releases product and payment only if everything is okay.

On eBay it's usually the seller who loses. If it's a small percentage, it's just the cost of doing business. I wouldn't dare sell (or buy) expensive items on eBay.

For cheap items I get it, but we're talking about $50k here with $500 for the escrow.

I tried, and even though it worked, it didn't make me feel I truely understood what I was doing. Bitcoin signed messages are much easier.

On eBay sellers are typically taking the bigger risk - the buyer can make false claims about the delivery or the item's condition, and most of the time eBay would side side with buyers, plus there are PayPal/CC disputes. However this risk exists everywhere in online sales and the sellers are basically expected to eat the loss as the cost of doing business. (edit: I did not plagiarize LoyceV, I promise LOL)

However most eBay items are nowhere near $50k. IMO items of such value should be reshipped by the escrow. On less valuable items that make no sense to be reshipped the escrow should make it very clear how they will adjudicate disputes, e.g. is tracking sufficient to prove delivery, etc. There is no way to eliminate the risk completely but all sides should have the correct expectations at the start of the deal.

I would say yes, and what is even more surprising is the fact that escrow had very chill attitude about all situation, he pretty much ignored his client, replied to him only once, and it took long time for him to post that timeline from his PMs.
Even if mistake was made by eseayan for using same password on multiple websites, it doesn't mean that escrow has no responsibility in this case.

I think that escrow should always check BPIP website for possible changes in accounts like password resets, and cancel/pause any trade if they notice anything suspicious.
It's not the first time accounts have been hacked in bitcointalk forum and using different account for deals like in this case is definitely something suspicious and worth checking out by escrow.

No point, except to give you some false sense of security.

https://i.imgur.com/gCAruUT.jpg
https://bpip.org/Profile?id=2874918

Minerjones has a history of playing fast and lose with what he is willing to do for his own (potential) profit. He is willing (https://bitcointalk.org/index.php?topic=2087580.0) to auction off items on behalf of third parties without being in possession of said items, and does not take responsibility when he cannot deliver the items (no disclaimer is made that he is not the seller, that the auction is subject to any additional terms, or that he is not the one actually shipping the items).

It is not unusual for an escrow provider to have the seller ship directly to the seller -- as an escrow provider, I engaged in this practice, and would give terms to this effect, I would say that in the event of a dispute the respective parties would need to provide evidence to support if they lived up to the terms of the agreement.

It is best to confirm all the terms of the trade before a funding address is provided, and that does not appear to have occurred in this case. MJ said it is safe to "ship" the physical coin once the escrow address is funded, but MJ later posted that he was told via PM that delivery would be done in person. IMO this should have set off red flags, and he should have either asked for additional verification from the buyer to confirm he is speaking to the correct person, or delayed releasing the funds to see if someone shows up claiming to be the buyer whose account was hacked.

Unless you experience something wired like this happened, you have no idea that there was a way. I am sure MJ would check with possible everything if he had slight confusion that things could go fish. There was a term change which was meeting in person and that information came from the same account. So in a regular practice it was nothing to get alarmed. I do not think MJ has anything to do here. He has done his job.

Strange. Why are you bringing all this BS now? The scammer was always a few steps ahead in this particular case. MJ did what he does.

I am not protecting anyone, but I am also not comfortable to blame a party for a scam where someone took control of the contact person.

What probability we have for this kind of situation?
You decide to make a trade
You send coin to escrow
Your account get hacked
Someone else takes control of your account
Trade goes wrong
You get back your account
Blame goes to escrow.
Cluster F**K

Well it is the escrow's job to ensure the trade goes smoothly, and if it doesn't to see that the scammer does not end up with the money. That is what they are getting paid to do. If the escrow is not willing to do basic due diligence before releasing the money, I don't see the point of using them.

The amount in question in this case is $50k. I don't think it is unreasonable to use a little bit of care when dealing with that much of other people's money.

How would you care more when the same person (here same account) is telling you to make a change in the deal? If there was no hack involved we would not see the scam. The situation was real tricky and anyone would have been victim of it. MJ did not keep the money after all.

I was surprised by that too. I know his reputation precedes him, but this is far less thorough than I expected.

Even worse: this false sense of security made the victim let his guard down:

That would not have helped in this case: the scammer changed the password only minutes after minerjones sent him the funds:
By not changng the password instantly, the scammer could stay under the radar for as long as he needed.

This sums it up nicely.

I'd say: "Rule One: Never change the deal." applies (quote taken from The Transporter movie (https://www.imdb.com/title/tt0293662/plotsummary)). If anything changes, a good default would be to delay the release of escrowed funds quite a bit.
Maybe a better solution would have been to refund the buyer if anything changes. If they agree to meet in person instead of shipping, that requires a new agreement in which buyer has to fund escrow again to a new address. But that requires strict rules from the escrow, known upfront, which wasn't the case here.

I disagree. It was MJ's responsibility to ensure a safe transaction and being a presumably experienced trader and escrow he should have been able to see the red flags. Granted we're looking at this with the benefit of hindsight but it's a lot of money to be so careless about.


If the delivery is in-person you don't need escrow.

Agree. We would not see these mess at the end.

True. But did not hit me until you stated it. Damn!

Man! It's over $50k worth of deal. Yeah MJ should have done more to ensure that the deal goes smooth. It really is messed up.

Let's get back to the topic.
I would agree with LoyceV in this

Other than this, it's always very risky to perform an escrow service.

Unless if you are afraid of might you going to meet/ see in your meeting point.

---

Or to use a multi-sig wallet...? So, in any case, you will need at least two parties involved for moving funds.


This will be safe enough if it was agreed from the start. Still, the buyer would have an objection to getting back his funds because something is changed. After all, he agree to this change right? :-\

You mean like getting robbed? Online escrow won't help with that.

Yes. Probably won't help but it depends on how anyone thinks of it. For some, it might sound like a safety measure while for others a useless action.
The thing is that here the scammer has the mine trap setup and ready to blow. I doubt that there is anyone who would be able to notice it or think that the account was compromised and freeze the deal. Unfortunately, it might happen to anybody.

I refuse to believe that, otherwise no trades can ever take place anymore. It is possible for an escrow to (learn from this and) impose escrow rules that can prevent this.

It's a fact brother, even if we choose not to believe it. :)
Trades will continue as they used to no matter how many scammers will try (and sometimes succeed) to scam. This trap was set in such a way that nobody (unless he was very lucky) could avoid it and not fall in. Perhaps if the escrow waits for both parties to confirm the changes or to have another way of communication like an extra layer of security measure. Eg. To proceed in any change/ major decision the escrow will ask for both parties to send a "message" to his WickrMe (since this app needs signature to verify the user) or some other. Perhaps some of you guys (since I'm not a techie/ dev guy) in your spare time can create something to use...
Exactly as you say it in your next sentence. We learn, even if it's the hard, painful, crappy way, and establish better ways for the safety of us all.

Maybe people who use new metaverse virtual thing would need to use some kind of special escrow approved by Mark Suckerberg, when they meet in virtual space.

That is fine and good option for Bitcoin, but I am not sure that multisig would be so easy in case of altcoins like monero.
I can only imagine explaining everyone how to use multisig, as I bet that most of the people never even tried it with testnet let alone mainnet.

When the terms are changed after money has been sent to the escrow address, the escrow agent needs to be sure that everyone is on the same page. MJ should have delayed releasing the money. This might be inconvenient for the parties involved, but it is the escrow agent's job to ensure a safe transaction.

No, using escrow for an in-person transaction will not protect you. There will still be the potential one party gets robbed. It will also be impossible for the escrow agent to determine which party should get the money in the event of a dispute. 

That's where all gone wrong. It was like the escrow was talking to the same person but it was not. The person behind the account was changed. This could happen to anybody.

Whoever gone through this experience (by watching or being in discussion or just a quick read) I am pretty much confirm that from now on they will check account logs. I will ask from a bitcoin signed address for sure in every conversation especially when the time to make the trade.

I think I already said, nothing was alarming as the instructions were coming from the same account.

It is very easy to do. Try it with Electrum from the same device to get the idea. You do not need multiple device to create a practice wallet.

Changing the deal is the alarming part! Even if they really met in person, the buyer could have been held at gunpoint and forced to send this message.

---

---

Let me rephrase the question. Let's assume a honest seller wants to sell collectible coins worth $50,000. Would a honest seller send them directly to the buyer after escrow gets paid, knowing he may not receive his payment if the buyer (who's relatively new to the forum) claims to have received an empty box? I didn't follow many trades in Collectibles, but has any honest seller ever taken this risk?

No.
The best practice considering the amount risked in the trade. Escrow receive the coins from the buyer, escrow receive the delivery from seller, escrow post the delivery to buyer, escrow release the funds to the seller. Using this process escrow knows that the item was delivered to the person.

I think this flow should be followed even if the item worth $50 or less. Without the touch escrow do not know if the item truly delivered to the buyer.

This is a common practice. I have both bought and sold physical coins, and bitcoin miners using escrow. In all cases, everyone involved wanted the shipment to be sent directly to the buyer by the seller. As an escrow agent, I had facilitated the sale of physical goods, and all parties had always wanted the goods to be sent directly from the seller to the buyer.

There are some cases when one party wants the goods to be sent to an escrow agent, for example when one party especially doesn’t trust the other party.

How does that protect the buyer if the seller sends a fake? Or how that it protect the seller if the buyer claims he received a fake?

The seller, ideally should have posted (or provided) pictures of what they are selling. So there should be a baseline amount of evidence that the item in question exists.

In the event of a dispute, it will be up to the buyer and seller to provide as much evidence as they can to prove they are in the "right" and that the other party is in the "wrong". This may include providing video evidence of packing the box the item is being shipped in (or in the case of the buyer, of opening the box the item was shipped in). Other evidence may include photos of the item that is claimed to have been received.

I have a special folder in my PM inbox for templates for escrow agreements that I used years ago when I would act as an escrow agent. Below is one template that I would use, and both parties would need to agree to these terms:

This won't work if one of them is a scammer. Seller can have a studio-quality single take video of packing a $5000 widget and then ship a brick off-camera. Buyer likewise can open the package on video and "find" a brick, after previously removing the actual item.

If you ever resolved any disputes based on this type of "evidence", chances are that you helped a scammer.

That doesn't prove anything if the scammer can get the real owner to post a picture with the scammer's name (https://bitcointalk.org/index.php?topic=5277761.msg58296194#msg58296194). But even if he has it, that doesn't prove sending it.

It's trivally easy to make changes to the content of the box after filming and before shipping. Or the buyer can reseal the box and then start filming.

That doesn't sound airtight, and it's not even a physical item.

---

---

I stand by this:

There is no way to *guarantee* there will be no risk of getting scammed in any transaction. Additional measures to reduce risk would result in additional costs and will probably not reduce the scope of people that will succeed in pulling off a successful scam. The procedures are clear to anyone involved, and those involved agree to the procedures before sending anything of value.

If there are unique markings on a box, underneath tape, and near the opening, it will not be trivial to reseal the box, as there will be evidence the box was previously opened.

I might point out that out of the dozens of transactions I have acted as an escrow agent for in the past, there was only on in which there was any kind of dispute, and in that case, the scammer did not even try to argue his point, nor provide any kind of evidence.

I have traded using at last a half-dozen different escrow agents, and all of them use a procedure similar to mine, and I have not seen any reports of a scammer successfully tricking an escrow agent into releasing funds in escrow to the wrong person as a result of sending an empty box, or anything similar. If it was trivial to scam this way, you would see the scam accusations page filled with reports of these types of scams.

What "unique markings"... they can open the bottom of the box or even show you a completely different box and you have no way of telling which one is the correct one unless you trust one person more than the other. Which is the opposite of what an impartial escrow should be.

Sure the little bit of effort required, plus the risk of getting doxed etc, may scare off some lazy scammers but it's disingenuous to present it as a real escrow because it isn't.