Anybody there interested??

As most of you know, I operated CoinPal before it was closed in April 2011.  I had planned to reopen it, but plans have changed.  I still own, follow and advocate Bitcoin.  Nothing has changed there.  About once a month, I receive an email asking "How did you avoid scammers on CoinPal?"  I decided to post about it so the entire community can benefit (and give myself a URL to point to).

Background

CoinPal allowed one to purchase Bitcoins with PayPal funds.  PayPal payments can be reversed easily but Bitcoin payments are permanent.  This asymmetry made CoinPal a constant target for PayPal fraud.  After I experienced my first wave of fraud, from which I learned many lessons, CoinPal lost less than 0.9% of revenue to fraud losses.

Fraudulent buyers exhibit certain characteristics that distinguish them from legitimate customers.  Some of these characteristics could be easily abandoned if the scammers recognized them.  They appear not to.  This kind of obscurity makes poor security.  Nevertheless, recognizing these kinds of easily abandoned practices saved CoinPal lots of money.  I won't describe any of these patterns since the scammers will simply abandon them once they're published.  Instead, I'll describe characteristics which scammers are unable to change.  These ought to remain relatively helpful over time.

Stolen accounts as currency

The most important realization is that stolen PayPal accounts or credit card numbers are a digital currency (although a poor one).  If I write a virus or phishing attack, my wages are denominated in the currency of stolen accounts.  Alternatively, I can exchange fiat currency for stolen account currency, by trading on various black market forums.

As a digital currency, stolen PayPal accounts are subject to double spending attacks.  For example, the legitimate owner may change his account password thus spending stolen funds back to himself.  Or a vendor selling PayPal credentials can sell the same credentials to multiple buyers.  Without a blockchain to rescue them, those holding this digital currency must spend it quickly before someone beats them to it.

Scammers are in a nasty hurry and can't do anything about it.  I saw this over and over again at CoinPal.  I see it at other online retailers too.  This is why CoinPal and VirWox have tiered purchase limits based on an account's age. 

Conclusion: scammers have an unusually high discount rate.  With this discount rate, the present value of a payment 7 days in the future is less than his cost of acquiring stolen credentials.

Measure Everything

Collect data on everything you can possibly measure.  Record it in your database associated with each order.  When fraud happens, compare all the data you have against known legitimate orders.  Scammers operate under different conditions than legitimate buyers and it invenitably shines through.  When they try to hide it, it causes other tell tale signs.

In the short time that CoinPal operated, I collected a couple hundred metrics about each order placed on the site.  Perhaps a dozen of those metrics proved useless.  The rest were valuable and I incorporated them into automated fraud screening.  Unfortunately, these patterns are the easily abandoned ones I mentioned above, so I won't give specifics.

Conclusion: If you can measure something about your customers, do it.  Spend plenty of time analyzing what you measured.

Legitimate Customers

You can't stop all fraud.  Some will get through your defenses.  Currency exchange profit margins are too narrow to absorb much of it, so you need a healthy legitimate customer base across whom you can distribute those costs.  As chargebacks come in, it's tempting to focus entirely on eliminating fraud.  Unfortunately, that focus inconveniences legitimate customers so much that they go elsewhere.

Early in CoinPal's history, I manually contacted every customer that wanted to purchase coins.  I bought a bunch of long distance calling credit and spent hours on the phone asking customers questions about the name of their nearest grocery store or which direction Lake Something was from their house.  I never had a chargeback from these orders, but they hated it and I hated it.  I lost many legitimate customers as soon as I emailed them asking if I could call them on the phone.  I know they were legitimate because many of them bought coins after I eliminated this process and they never charged me back.

Conclusion: a healthy customer base is as important as fraud detection.  Profit from serving them will sustain you through the scammer attacks.

Fees Select Customers

This should be obvious, but it's repeatedly violated by new Bitcoin exchanges.  A legitimate customer is spending his own hard earned money, so he cares about fees.  A scammer is spending someone else's money, so he doesn't.  Increasing fees scares away profitable customers leaving you with only scammers.

A small price elasticity of demand and a high discount rate combine to explain a common fraud symptom in retail.  Fraudulent customers are far more likely to pay extra for overnight shipping.  They don't care about the money and need the goods quickly before their scam is detected.

Conclusion: High fees favor fraud.  Although scammers could avoid this characteristic by frugally spending their stolen funds, frugality demands patience which they can't afford.

Repeat Business

CoinPal averaged 1.6 orders per legitimate customer.  Many of those customers first purchased from me shortly before the site closed and never had a chance to return, so that figure is artificially low.  Many legitimate customers placed the maximum allowed order every single week until the site closed.

Scammers, however, manifest as one time buyers.  After the first purchase, their stolen funds are spent and they must switch identities.   This distinction means you can safely lower your defenses for repeat purchases.  As best I can find/remember, CoinPal never had a chargeback from a repeat customer.

This dichotomy gives vendors another means to distinguish between good and bad buyers.  For a legitimate buyer, one-time fees will be amortized over the life of his business.  A scammer, must recoup the entire fee on his first purchase.  If the fee exceeds his profit, he'll quit.

Late in CoinPal's life, I instituted automated phone verification for first time buyers.  These buyers paid an extra $0.50 to cover the cost of the service.  For legitimate customers that's $0.50 amortized over several future orders.  For scammers, it's $0.50 plus the cost and inconvenience of acquiring a working phone number per order.

Conclusion: One-time fees favor legitimate buyers.

Selling a 3D Gold & Silver Bitcoin scenery file built in blender
http://www.blender.org.

The file can be modified to suit your needs. Reflective textures and
a simple flipping animation included. Can be downloaded from CoinDL:
https://www.coindl.com/page/item/298.

Sample animation: http://youtu.be/0TlhfJZcmYI

i just had the a long ass day

my father in-law's truck broke down as we tried to leave after picking up a frige and stove

finaly we get back,

somke a joint drink a beer, OPEN  a bottle of wine

i take a cab back


my father in-lawl is now in 100$ in

and who knows about the cab driver

I gave him bitcoin 101 on drugs


and fuck 'en did it did it right,

its not the first time i talk to TAXI VS about bitcoin but this time i spelled it out and this guy is oing in 100$ at least!


bitcoin trutly is a beacon of hpe and thats why man ,..... thats why it works,

because we want it to


BTC BTC

8$ is NOTHING its nothing more then the top after the well deserved bubble we just had ,...

12$ Bitch! paY UP!!!

What exactly shall be the goal to be reached by legal action?
Please clarify!

• (1) we want to destroy Intersango exchange
• (2) we want to ruin Core credit finnancially
• (3) we want to destroy the reputation of Zhoutong, Tihan, Donald, Patrick and Amir and turn them into "persona non grata"
• (4) we want to destroy the economical existence of above mentioned people
• (5) we want to force those folks to collaborate with the police to chase the hacker(s) and put them in jail
• (6) we want to construct a case of precedence, so that in future no 17-year old entrepreneur without proper business education and governmental approvement can start a hightly profitable business.
• (7) we want to get our money back

Just decide on what the real goal should be.
Then decide what strategy could lead us to that goal,
and if it is feasible and likely to reach that goal.

Plesase, folks, really do that, instead of
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
guessing
...one hundred further pages in this forum....

Ack, crisis!  I knew this update wasn't going to go smoothly, but didn't expect this!

I forgot to mention there is now a "--debug" option that should increase the amount of logger output.  That will help with some of this, but not a ton... I'm still trying to figure out where best to put full-debug output without flooding the logfile unnecessary.



BadBitcoin, which version are you using?  The testing version or 0.81, or older?  Did you restart Armory since then?  Don't worry, your coins are safe, just something bizarre happened.  If you're using the latest, can you email me your log file?  There would have to be some error messages in there...


This is super weird... it looks like it froze for 5-7 minutes while checking for the new version update.  That doesn't seem right, because the timeout is set to 2 sec, and even so, it shouldn't freeze for that long.  Can you verify for me that is the problem?   Go to Help-->"Armory Versions...".  See how long it takes to open.  Then click on "Never agian". then restart Armory.  How long does it take?  Now do it again but click "OK" (which re-enables notifications), and restart it.

I definitely need to add more logging calls to this code!

want to give me some tips on how to play? I absolutely suck.

Exactly!


And the next scammers/hackers know it! And the ones that follow them. And then the ones that follow them. Ad infinitum.


The above being true, makes the below that much more not worth it.


Thus, once again, only the lawyers will prevail, whether they're paid in dollars, euros, bitcoins or alpaca socks.

~Bruno~

I lost nearly $150,000 one day. Pretty much everything. Nothing to do with Bitcoin. The guy went to jail but I was never completely sure if we had the whole truth. I took it on the chin.

Intersango has been a useful service and Amir has done a lot for me and us.

I do think action should go ahead as there is a case for it and it should change attitudes. But I also acknowledge it will be a shame to see the back of Intersango as they've:
- taken risks on my behalf by running the exchange in the grey area of is-it-forex (initially for no fee),
- developing the exchange software,
- working on the Bitcoin code and also
- campaigning in person at events like Occupy

I'm not defending them. I'm just saying it's a shame. These will be the next in a line of public figures with Bitcoin where the community has turned against. A sample size of 2 is a bit early for a worrying trend but divided we are and so easily.

It took a lot more work than this to turn me against the guy who was slated as spending my life savings. For a long time I felt there must have been mitigating circumstances because they were shutdown by an agency with active interests in doing so. I could see a conspiracy theory. To this day I'm not completely sure but I've decided not to break the guys legs even though he's been convicted and done his jail time. The hard thing is it's hard for me to know. 

What is suing going to achieve other than finally show people a precedent that this is a serious matter and things are real.

That was me saying it in a light fashion to save egos. Perhaps I should be blunt. I could say "Screw you. Get off these guys. Let me carry on using my favorite exchange. Let me continue to receive their contributions to the code base and exchange software. Let me enjoy their work at Occupy. Forgive them and shut the crap up just like I did with my life savings."

I feel very qualified to say so because I have gone through the experience and it has changed my entire life. If I hadn't lost that cash I wouldn't be in this damn job, I wouldn't be in the country and I'd be with my girlfriend! But I know burning down the guys house isn't going to change anything.

Now, if suing does change things and get people to take security more seriously then do it, you are doing it from a good place.
But if you look in your heart and you're doing it for vengeance then I suggest step back because that in my experience usually backfires. If necessarily, find a way to do it right.

I've gone out on a limb to say this for you, bear that in mind.

This is not a lawsuit. This is reporting the facts to the police and they will decide whether there is a criminal case against Bitcoin Consultancy. Completely separate from any civil litigation. I'm not sure there necessarily is a criminal case here (not a lawyer), but there certainly could be (fraud, theft, criminal negligence)

You wont get your BTC, but you may be able to get USD.... But I highly doubt it. These people are already broke... Patrick and others have already started this.... Once they go bankrupt, you aint getting shiiiiiit....

Remember tho, you wont get the value of btc today or in the future...You'll prolly get the same value of btc when it was hacked, which was around $4.30 if I remember correctly.

Good luck!