Bitcoin Forum

Hi guys,

It's been a while since I have posted on the forums.  But just to clarify, I have not lost faith or interest in bitcoin.  In fact I have spent the last month creating a new bitcoin-enabled website https://www.bitcoingateway.com  BitcoinGateway.com is open for business!

The purpose of BitcoinGateway is to allow normal credit-card bearing consumers to purchase bitcoins and automatically send them to an address under their control (eg, a character address at http://www.dragons.tl/  or an account at mtgox, etc).  Generally speaking these will be the non-sophisticated users of bitcoin (otherwise they would just access the markets directly).

Of course, when taking the plunge and accepting credit cards for bitcoins, there is inherent charge-back and identity theft risk.  For this reason I have implemented an extensive customer verification procedure.  Whenever a new credit card is registered with BitcoinGateway.com, the following steps are taken:

• Require all normal customer address/billing information
• Additionally, require customer's billing phone number
• Additionally, require 1-800 customer service number on back of credit-card (issuing bank for the credit card)
• Confirmation code is given/emailed to customer
• Performed by BitcoinGateway.com:  Call the credit card's issuing bank, and verify the billing phone number given by the customer.
• If the bank records match the number given by the customer, then call that billing number. (record this call)
• Request the confirmation number originally given to the customer (verifies that the actual bank customer made the BTC purchase)
• Process transaction

The above goes on behind the scenes, but it does delay the processing of initial transactions.  However, the hope here is that it will weed out the vast majority of charge-back and fraud risk (and therefore, keep prices low).

As always, feedback/comments are welcome and appreciated.  Either post here, or email me at chaord@bitcoingateway.com

Happy bitcoining!

--Chaord

Have you considered text message code that is sent to a phone?  It would be another step for security...

I did consider that (and may still implement it), however the important thing here is that I call the billing phone number for the credit card (whether it's a mobile phone or not).  Unfortunately such a long procedure isn't incredibly scalable, so if business/demand is good I have some automation techniques I can chase after as well (eg, a random pending charge between $1 and $3 and asking the customer to check their statement and put in the exact amount).  Unfortunately fully automated might draw people who have actually phished for full bank credentials and such.  For this reason I'm sticking with phone calls for now.   Thanks for the feedback!

chaord, good luck with it! it should really help attract more users into bitcoin community!

What about gift/prepaid credit cards?  Is there any way to use these in case people want anonymity?

Hmm, hadn't thought about that.  I'll have to look up gift/prepaid cards and see how the charge-back stuff works.  If it's not possible for customers to call the issuer of the gift/prepaid card and dispute a charge then I may be able to accept them without much verification at all.  However, if the charge-back risk is there I'm inclined to say no.

Of course, if you are a trusted member of the bitcoin community, you can contact me directly and we may be able to work something out :-)

Ok, if there was little or no charge back risk it would be great.  How many bitcoins do u have for sale?

I'd love to use your service, but I'm not from the USA. Although my credit card has a customer service phone number on the back, it's not toll-free, and I'm sure they won't discuss my phone number with people who call that number.

I would like to find a verification process that is workable and is acceptable to you (e.g. mailing an original copy of my credit card statement perhaps).

My goal is to be able to process transactions of up to 300 BTC at any given time (hopefully more later).


You can email me if you'd like to come up with some sort of alternative arrangement, although speaking with the bank directly is probably what I will prefer.

What is the minimum amount you will sell? Is there a fixed fee, %fee, or are you just going to run a spread?

If a person gets verified on the first purchase, is it much simpler for future purchases with the same card?

Not asking for myself, might refer some noobs. I've been reluctant to spread the word to friends when the best way to get coins would be for people to buy from me.

The default transaction amount when you click "buy" is 50 BTC, the minimum is less (closer to 10 currently).  Any fees are included in the quoted price (eg my prices are slightly higher than the spot rate on the markets).

Yes, that's precisely what BitcoinGateway is designed for, repeat customers.  Once a card is registered and verified it's as easy as clicking "buy", putting in the number of BTC.

Thanks for the referral!  Incidentally, I'm working on a referral system where you could get a BTC referal fee as a % of the BTC that they purchase.

That all sounds great.

It would be nice if the site actually worked (currently getting "server not responding")...

Hmm...everything seems to be working fine on my end.  Could you please email admin@bitcoingateway.com with details of the server-not-responding incident you received.  Sorry for the inconvenience if it was on my end.

It's working now, so maybe it was an internet glitch or something...

Have you thought about using 3D secure?

This forces the customer to enter a password for each purchase. The password is issued by his bank.

In combination with email verification it's probably secure enough.

Your present procedure is cumbersome. It will discourage a good percentage of potential customers.

I personally find the idea of someone calling me on my mobile phone over some $50 Bitcoin purchase very invasive.  If someone is going to interrupt me at work, it better be something important.  Maybe it's just cultural...

Better that than letting the scammers shut down another credit card exchanger.

Hi guys,
Just a heads up.  BitcoinGateway.com's Linode seems to be down right now.  I'm not sure if it's them or me (probably me), but I'm working to resolve the situation asap.  Sorry for any inconvenience this may have caused.
--Chaord

it's "them" - http://status.linode.com/2010/11/fremont-connectivity.html

Shiesh...well, long days journey into night, and the site is back up.  Sorry everyone.

4. What did you really tell your merchant number provider that you are selling?

Ok, so after processing a number of transactions, and finding a couple issues/bugs (nothing major), I have decided to bring the site down for the weekend.  My intention is to address some minor work-flow issues on my end and bring the site back up by Monday (Thanksgiving is in the way).

In the meantime, I want to thank those customers that tried out the service.  I hope everything met (or exceeded) your expectations.

I will update this thread when I bring the site back up.

--Chaord

I said that I sell "digital information tokens", then used a lot of big words. ;)

Okay, don't tell the truth then. :P

From my experience; if the merchant number provider doesn't understand what you are selling your application is denied, or you have to put up a large deposit. :(

Edit: I really do wish you the best. If you can keep your shirt on, and not get steamrolled by fraudsters, you will be running the single most important piece of 'Bitcoin machinery'. :)

Thank you for your kind words.  Incidentally, I checked out bitcoin2cc.com today...nice work! I'm wondering if there might be some synergies there with bitcoingateway, eg providing my customers the ability to "cash out." 

:)

Yeah, for sure. We should linkswap or something once you get your system up and running.

Definitely.  I'm spending the next couple days automating some things so that I can handle much more transactional volume.  Next week I'll throw a link up to bitcoin2cc.com on the SELL page.

Awesome. ;)

I suggest using automatic phone verification to the card number on file, and using www.iovation.com

I'll look into it.  Thanks for the suggestion!  I definitely imagine that something more sophisticated, similar to iovation will be necessary in the future.

In its current form, BitcoinGateway.com should be back up this weekend.  After that I'll focus on a completely new version that will be fully automated and incorporate things like iovation (and perhaps more) ;).

http://www.greenid.com.au/ (http://www.greenid.com.au/)


 :)

(for your aussie customers)   :P

Site is back up and accepting signups, however purchasing of bitcoins by credit card is still temporarily suspended (family time is eating into my bitcoin time ;)).  Everything will be up and running soon though.  Hang tight.

By soon I mean Tuesday.  Sorry its taking so long.

/me cheers chaord on. :)

I would live this over the US-centric calling system :)

We will work on new solutions soon...have to start somewhere :)

Hi, I'm interested in buying btc by visa, but I'm affraid to tell my card number etc to site without any real company behind and with unknown security policies. Do you plan to use some well known Visa processor to skip storing card details direcly on your backend? Currently I cannot use it or even tell my friends :(.

I don't speak on behalf of the site owner, of course, but you may want to consider the following, given that you seek a "company" with "policies".

A "company" is a limited liability structure, designed to internalise the profit but externalise the risk. And "policies" don't count for a lot. It's the actual "practice" that counts.

Got your point. But if somebody wanish my credit card I don't have any instance to appeal. I'm probably too much sceptical, but I simply use only 'trusted' providers like paypal (yes, paypal is evil, but mainly for sellers than buyers).

It is not anything personal against service itself. But where are credit cards stored? In Mysql on some cloud VPS together with many other PHP sites with SQL injections? Thanks, no...

FWIW, I've known Chaord for a while now, and he's a stand-up guy.

I've been directing people to BitCoinGateway.com when they need Bitcoins to play Dragon's Tale, and all have reported quick and hassle-free service.

I agree with you, teppy. Chaord is a great guy, I have talked to him via the phone already and worked on a joint project charter. I full trust him.

I heard THAT....

New people, hearing that the best/easiest way to buy Bitcoin is from ME....  are instantly like, "Huh?"  

It sounds totally fishy if I'm the only seller of Bitcoins.  :)    Makes it sound like I'm either a drug dealer or a ponzi schemer.

That's why I'm working so hard on growing the listings on BitcoinBuy.com - a directory of local Bitcoin-for-Cash (and vice versa) dealers.  ( If YOU are reading this right now, and YOU are not on that list on BitcoinBuy.com, email or PM me so I can add you! You only have to be willing to meet someone in person, locally, and sell them Bitcoin for cash and/or vice versa. )

BitcoinGateway.com and Bitcoin2cc.com just make it all that much easier...  and make it sound that much more respectable at the same time.   Bravo for both these services!   ::)

By the way, BOTH are linked from  BitcoinCard.com (http://BitcoinCard.com)  now...

BitcoinGateway.com is back OPEN for business!  Buy yourself some bitcoins and send your friends!

Just to clarify.  Unfortunately, we can only accept US orders right now.  It was pointed out to me that according to Alexa.com: 
Visitors by Country for Bitcoin.org
Country
Percent of Site Traffic
 Russia
25.4%
 United States
16.0%
 Switzerland
7.1%
 India
5.3%
 Australia
4.3%
 Canada
1.9%
 OTHER
40.0%
 Canada
1.9%
 OTHER
40.0%

Needless to say we will be working on an international solution as quick as possible ;)

Chaord, I appreciate your work and I'm looking forward payments from EU.

One question/idea. Do you plan to make integration API for services using Bitcoin? It would be cool to make automatic bridge between Visa(USD, EUR, ...) and bitcoins for 3rd party services.

Nowadays merchant/service provider have three possibilities (relevant to bitcoin economy):

a) Accept only bitcoins (ideal situation)
b) Accept bitcoins and Visa (thru paypal, etc).
c) Accept only Visa, not bitcoins (most common situation nowadays)

Many mechants see there is no real market in bitcoin at these days (it is true, we are on the beginning) so when they starts their business, it is fully rational to not support Bitcoins (costs for no real effect). I'm talking about real merchants, not fans of Bitcoins.

Imagine that you provide some API, which make payments from Visa to bitcoins fully transparent for merchants. They will make a request for bitcoins from you, you will ask for user details and card number, make a transaction and send bitcoins to MERCHANT. In this situation, merchant can accept only bitcoins and customer can pay only USD. Customer don't even need to know about Bitcoins (but during a transaction is the good time to show some interesting information about bitcoin, of course).

There are different 'merchant API' already (mybitcoin, mtgox), but they expect customer is already a bitcoin member.

You should do what I do: assume that the boneheads at the bank have already leaked the card information.

chaord's service is the least of our worries.

i trust chaord, but still, those are legitimate questions, and i think chaord would do well to detail his data treatment procedures, in order to foster trust from the community.

(and hopefully, those details include not storing cleartext cc numbers, as slush suggests :) ).

If he is motivated enough and intelligent enough to use a non-mainstream language like Scala, it's obvious that he has the technical expertise. But that's not really what you're asking, is it?

Anyway, don't fall for the attempt of corporations to try to make you accept the blame for abuse of your number. It's just a number. If a fraudulent purchase uses that number, you don't have to pay for it. That's the law. You're not responsible for auditing Visa and MC merchants' internal systems.

Wow, lots of activity here since I last posted!  I will attempt to address a number of issues:
1) BitcoinGateway.com is currently a one-man shop (me).  However, I am not interested in keeping something as incredible as bitcoin small.  I am looking into the possibilities seeking investment capital and going for a home run.

2) I'm also looking to start a bitcoin-auditing company that verifies the integrity and security procedures of bitcoin businesses.  BitcoinGateway.com would be only one of the member businesses.  I see this as a mechanism by which the underlying software of companies like bitcoingateway.com and others could actually open source it, subject it to scrutiny, etc, yet be a "verified implementer."  Eg, sure a fraudster could take the software and implement his own bitcoingateway, but his site would never be approved by the auditing company (and therefore not frequented by customers).  This way, however, we could all gain the additional advantage of open source software, transparency, etc.

3) About credit card number encryption.  If you are a current or prospective customer, I am happy to discuss the measures I am taking in private. (no need to open my playbook on this forum ;).  To nanotube and sharp's points, I will also work on a public statement of my security philosophy. Edit:  as soon as any credit cards are verified/denied they are moved to the Authorize.net CIM (PCI compliant) servers.

4) With regard to API.  The short answer is "yes."  I will be creating an API.  However, the timeline for the API is unknown at this point (probably depends on whether I can recruit some outside talent :).

Thank you all for your support.  Together we can change the world, one bitcoin at a time!

My feeling is you are getting a lot if russians who may be attempting to hack your site.

I'm not entirely convinced one way or the other, but yeah, that's why I'm being super cautious at this point.

BitcoinGateway.com now allows you to purchase MtGoxUSD via credit card.  Currently there is a 10% processing fee and amounts are limited 30 mtgoxUSD to 100 mtgoxUSD.

Nice addition!  Relieves some worries about exchange rate (though 10% with a maximum $100 is a bit tough).

Glad you like it! I will raise the maximum and lower the fee eventually.  Initially, and due to my current inventory, these numbers make the most sense.

Just an FYI, I take identity theft very seriously.  In fact, one thief has already attempted a number of fraudulent purchases on BitcoinGateway.com.  Luckily I was able to speak with the actual card holder and have since forwarded all communication I had with the thief to the cardholder.  Hopefully they find the bastard.  It's that type of sh*t that are going to make normal people (and governments) scared of bitcoin.

Incidentally, the cardholder had no idea what bitcoin even was (not surprising) but was impressed overall upon further review ;)

That's my rant.  Happy bitcoining everyone!

Wow, that's actually a really good advertisement to that guy about bitcoin imo. Bitcoin businessmen are careful and responsible etc.

Bitcoingateway.com will be closed for the holidays as we restructure and add new features...hopefully the crumbling non-bitcoin economy can hang on just a little longer :-)

i wish i had 2 months vacation /y

Thing are certainly taking longer then expected  :-\

I'll open the site back up eventually, but I have a bunch of things to get done first.  If you're a developer and would consider developing and improving Bitcoingateway, contact me privately.

yes, i'm developer and interested in help but more i'd be willing to test than write code (write test scripts, automate, run them & evaluate data). because testing can be planned and usually also finishes in finite time ;)

Ideally, I'm looking to have a motivated individual take over the coding and the testing.

I wish you to find someone reliable and up to your needs.
With a 2 months old child I can not commit to anything bigger or complex beyond automation and release mgmt.

What types of technologies are used for the site?

I wrote the prototype in Scala (http://www.scala-lang.org) and the Lift Web Framework (http://www.liftweb.net), persistence is any JDBC compliant DB.  Scala/Lift are awesome technologies and I thoroughly enjoy them.  However, I'm open to a rewrite in a more prevalent language/framework of your choosing.  If you're interested, contact me off-record and we can talk more chaord.btc@gmail.com .

Sent you a pm