I entered the police station as a suspect. When I left the officer loved Bitcoin

[sunnankar]

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

Smart.

While I do not think talking to police is usually a very good idea; in this case, you may want to even go and talk with the same police officer, let him know of the change you implemented and ask if he has any other suggestions that would make your system less prone to fraud.

Then he will know you are attempting to act in good faith and you will likely get a helpful tip or two since it sounds like he investigates a lot of credit card fraud and has likely seen all types of schemes.

[payb.tc]

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

Smart.

one problem with this is that real customers who are actually buying bitcoins, might not want such an explicit record of that fact in their bank statement.

[Peter Todd]

While that is a nice touch from a UI / accessibility point of view, it's not quite what I meant. The problem is in the underlying protocol: transactions are considered valid when signed only by the payer. Under the proposed system, there is still nothing to prevent someone from uploading a transaction on their own without involving the merchant. The cases I had in mind are those like the political campaign which was accepting Bitcoin contributions a while back; they had specific rules regarding which kinds of contributions they could accept, but no way to block transactions which failed to meet those rules, and no reliable way to know whether it was safe to simply return the funds to the originating address--which may belong to a wallet or payment service or exchange rather than the contributor.

What I had in mind was essentially P2SH with two scripts, one to send from an address and another to endorse receipts. To receive funds you would take the incomplete transaction and add the address's receive script, a signature for the amount received, the memo field, and (optionally) the originating address(es), and then broadcast the updated transaction. For multiple payees, partial transactions could be merged until all the signatures are present, at which point the completed transaction can enter the blockchain. The private key for receipts could be different from the key for payments, so "cold storage" is not affected.

P2SH already works that way. The sender of the funds makes an incomplete transaction which says "these inputs can now be spent if someone provides a valid script with this hash" If you want to receive those funds and send them somewhere else you take that incomplete transaction (called the first transaction on Bitcoin) and complete it with a second transaction to send the funds where you want.

I mean, seriously though you're arguing semantics. Ultimately Bitcoin allows you to put money in electronic lockboxes that can be opened by anyone with the correct key. Sure it looks like you're "sending" money on blockchain.info because it shows things in terms of account balances, but an equally valid way of looking at it is "I happen to have the correct key(s) to open these lockboxes" You can come up with window dressing to hide that fact, but fundamentally that is how Bitcoin works. We're better off it courts understand this - it's not much different than me calling you up and leaving a message on your voicemail with the secret account numbers of a swiss bank account.

For instance, I'm going to tell you right now that there is a unspent transaction on the blockchain that can be spent with the private key 0000000000000000000000000000000000000000000000000000000000000001 - I just sent you money, and you can't refuse it!

[fimp]

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

... and will return/refuse to accept incoming payments that will not include this message?

how long does it take for your bank to process this metadata on bank transfer? ('my' bank credits the account on day 1 but full transaction info appears only on day 2)
and how easy is it for you to return a payment?

Yes, refuse incoming payments from new customers without the message.

The text message is available to us at the same time as the transfer is visible.

[Akka]

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

Smart.

one problem with this is that real customers who are actually buying bitcoins, might not want such an explicit record of that fact in their bank statement.

I concur,

why not show the amount as pending when you revive it and than make a transaction of a view random cents back to your customer with you website as message like 4K7ut3 or something. The exact amount of cents and the message are required to get the BTC.

Scammers would have a hard time explaining their victims why hey need that info. And no BTC history on the Bank account.

[fimp]

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

Smart.

While I do not think talking to police is usually a very good idea; in this case, you may want to even go and talk with the same police officer, let him know of the change you implemented and ask if he has any other suggestions that would make your system less prone to fraud.

Then he will know you are attempting to act in good faith and you will likely get a helpful tip or two since it sounds like he investigates a lot of credit card fraud and has likely seen all types of schemes.

I e-mailed him to inform him about our policy update along with general Bitcoin information.

[nybble41]

P2SH already works that way. The sender of the funds makes an incomplete transaction which says "these inputs can now be spent if someone provides a valid script with this hash" If you want to receive those funds and send them somewhere else you take that incomplete transaction (called the first transaction on Bitcoin) and complete it with a second transaction to send the funds where you want.

No, that is incorrect. The funds are transferred as soon as the transaction is signed by the payer and included in the block chain. At that point the first transaction is "complete" in that the payee controls the funds, not the payer. The payee can choose to ignore the transaction, of course, given a suitably modified client, but so far as Bitcoin is concerned, those Bitcoins belong to the payee whether the payee wants them or not.

In the latter case--for example, if the payee cannot legally accept the funds--there needs to be a way to either ensure the transfer does not take place, or to reliably and provably return the funds to the actual payer (which may not be the same as the originating address); otherwise the payee is left with more Bitcoins under their control than they can legitimately account for, which is sure to cause problems in the event of an audit.

We're better off it courts understand this - it's not much different than me calling you up and leaving a message on your voicemail with the secret account numbers of a swiss bank account.

I agree that the courts need to understand the issue, but involuntarily receiving the key to an account created by someone else is not really the same as being unable to prevent funds from being deposited into your own account. For one thing, importing and using a private key from an external source is a deliberate act, but users do not generally get to pick and choose which transactions to use as inputs among their existing accounts; all unspent outputs which the client has a key for are candidates when sending funds.

[pc]

For instance, I'm going to tell you right now that there is a unspent transaction on the blockchain that can be spent with the private key 0000000000000000000000000000000000000000000000000000000000000001 - I just sent you money, and you can't refuse it!

Even better, I just took that money (which was at 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH) and moved it to 3MaB7QVq3k4pQx3BhsvEADgzQonLSBwMdj, which is a P2SH address that can be redeemed by anybody using the script OP_TRUE. So I just sent everybody in the universe money, and they can't refuse it!

The existence of Bitcoin may change the way people think about how money is owned (since money can be jointly owned in interesting ways with multisig or even more exotic scripts), and it might take a while for law/courts/society to adapt. Interesting to see it slowly happen bit by bit, in ways like this story tells.

[nybble41]

For instance, I'm going to tell you right now that there is a unspent transaction on the blockchain that can be spent with the private key 0000000000000000000000000000000000000000000000000000000000000001 - I just sent you money, and you can't refuse it!

Even better, I just took that money (which was at 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH) and moved it to 3MaB7QVq3k4pQx3BhsvEADgzQonLSBwMdj, which is a P2SH address that can be redeemed by anybody using the script OP_TRUE. So I just sent everybody in the universe money, and they can't refuse it!

The problem with both of these examples is that there is nothing tying the funds to my organization. In the first case, even if the key was only shared between the two of us and hadn't been posted on a public forum, ownership is still joint--we both have the key. In the second case, everyone has access. I presumably have a list of accounts which belong to the organization, and neither of these is on it. They are indistinguishable from any other anonymous Bitcoin account. The issue is money suddenly and inexplicably showing up in an account known to be associated with the organization, and which the organization needs to account for. Unwanted access to accounts created by others is a separate matter.

If you ran a business, and someone made a sizable anonymous deposit into your business's general fund, don't you think that would result in a lot of extra paperwork? The lack of payee endorsement when funds are transferred between Bitcoin addresses makes that easy to pull off. And what about the idea of "tainted" coins? I don't approve of it myself, but others do, and there is currently no way to prevent "tained" coins from being mixed in with your "clean" ones. You could easily end up party to an investigation just because someone decided to lay a false trail by transferring funds to your addresses.

[Peter Todd]

I agree that the courts need to understand the issue, but involuntarily receiving the key to an account created by someone else is not really the same as being unable to prevent funds from being deposited into your own account. For one thing, importing and using a private key from an external source is a deliberate act, but users do not generally get to pick and choose which transactions to use as inputs among their existing accounts; all unspent outputs which the client has a key for are candidates when sending funds.

I do agree that is a problem with the software. But it's an easy fix: just maintain a list of transactions that you received knowingly and only consider those transactions as candidate tx inputs. Any other transaction is simply ignored and never spent, nor does it have to be shown in your internal accounts. If you use a unique address per payment, which you should, this is easy to do. If you really want you can return unwanted transactions as well by simply resending them to one of the input addresses, or want, ask for a request signed by one of those addresses.

I think the more fundamental issue is that Bitcoin makes it publicly known that you can spend the funds. A "counter-sign to accept" protocol still has that problem, because you could simply publish the first part of that counter-sign proposal somewhere, and again, just like the blockchain, the recipient would be able to access the funds. The advantage of course is that it is less obvious, the real issue legally speaking. What you'd need to really lock things down is define your transactions to have an additional two steps: receiver signs an intent to accept, then sender signs the intent. Now transactions are forced to be interactive. In any case, Bitcoin can't and never will be able to support this mode of usage because it will always support non-interactive transactions.

[caveden]

The police officer sounds like a cool guy, but you have NOT solved the problem.

You need to start verifying the identities of depositors and people withdrawing money from your exchange like Mt Gox and other operations do. Not only is this your protection against being an exit from the fiat system for criminals, but the law may sometimes require it too (depending on thresholds, etc).

Whilst the police officer was obviously nice to you, don't take it personally if they come back and charge you with something. You clearly know there's abuse of your service and you will be expected to stamp it out. ID verification is the way to do that, so get on it.

Come on. I haven't read the entire topic yet, but are you seriously implying that his service has any amount of guilt in this? That OP has something to "solve"?

People should simply learn not to send money to unknown types on the internet without escrow. Either you verify the other party reputation or you use a reputable third party, specially for meaningful amounts.

Financial privacy should not be thrown away simply because some are irresponsible with their money.

That said, I don't doubt at all that he might be required by law not to respect people's privacy, as you say. If that's the case he doesn't have much choice anyway.

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

Smart.

one problem with this is that real customers who are actually buying bitcoins, might not want such an explicit record of that fact in their bank statement.

They're already sending money to BitcoinNordic account anyway. Unless you're talking about owners of joint accounts who don't want the other owner to know where the money is going to (fishy), for everything else that matters it's already "written" in their statement what they used that money for.

[payb.tc]

I've implemented a new policy where we require bank transfers to include the message "For buying Bitcoins".

Smart.

one problem with this is that real customers who are actually buying bitcoins, might not want such an explicit record of that fact in their bank statement.

They're already sending money to BitcoinNordic account anyway. Unless you're talking about owners of joint accounts who don't want the other owner to know where the money is going to (fishy), for everything else that matters it's already "written" in their statement what they used that money for.

no, "BitcoinNordic" is vague

"for buying bitcoins" is explicit

[caveden]

no, "BitcoinNordic" is vague

"for buying bitcoins" is explicit

Seriously?
Sending money to a company whose sole purpose is to sell Bitcoins is already "proof beyond reasonable doubts" that you're buying bitcoins.

[payb.tc]

no, "BitcoinNordic" is vague

"for buying bitcoins" is explicit

Seriously?
Sending money to a company whose sole purpose is to sell Bitcoins is already "proof beyond reasonable doubts" that you're buying bitcoins.

very serious.

a complete lay person can read "for buying bitcoins" and go "okay this transaction must be for buying bitcoins".

on the other hand, anyone seeing "bitcoinnordic" might need to go to google and/or bitcoinnordic's website and find out what they're all about.

i for one had never heard of them until this thread.

[Herodes]

interestingly, some banks will block transactions with 'bitcoin' in the reference field.

the method of verifying a customer account by depositing a small amount to their account is something several e-wallet sites already implements.

[HBBZ]

this is what I call success story

Splendid! The power of fact with abundant details cannot be resisted.

[MPOE-PR]

I was called in by the police today. Someone is creating ads for iPhones online and gives potential buyers the account information for Bitcoin Nordic. I then send Bitcoins to the iPhone "seller" without knowing I'm taking part in a scam and that he will never send the iPhone.

I've heard of other Bitcoin sellers experiencing this sort of scam, and I've received stolen money from phished bank accounts earlier and had two accounts closed, but this was my first time with this kind of trick.

The police suspected me because the fiat trail ends on Bitcoin Nordic's bank account. But I explained Bitcoin and I explained my business and they now consider me a witness instead of a suspect.

The police officer told me he spends a lot of time dealing with cases of credit card chargeback fraud. After I told him that kind of scam is impossible to do with Bitcoin, he told me several times that Bitcoin sounded really neat.

"Bitcoin. Because the government says it's neat."

Cool story.

This is why we're doing the payment protocol work - the eventual end goal is to phase out the use of (end user visible) addresses, so most payments go to human-meaningful identities like amazon.com instead of 1AbCd.... - in combination with a second factor it solves the identity confusion attack by ensuring you always know who you're paying.

I think this is actually a very stupid idea. Let amazon get a vanity address the normal way if that actually makes any difference (it doesn't). Otherwise what, a dns system for Bitcoin? Get out. Literally get out. If you think Bitcoin should be changed into something less to be easier for Joe Blow you don't belong anywhere near it, please leave now. The only acceptable solution is for everything to change to accommodate Bitcoin, and that everything includes "clueless customers". Nothing less and nothing else.

[caveden]

This is why we're doing the payment protocol work...

Otherwise what, a dns system for Bitcoin?

Not exactly, it's more like a certificate-like protocol, similar to SSL, something that would allow strong authentication of addresses. This is an essential infrastructure brick if you want to have a decent level of security. If you don't understand why, please learn about it before opening your loud mouth.

[WishIStartedSooner]

I think you have to verify the identity of the users of your exchange or you can have lots of law isssues

[NewLiberty]

For instance, I'm going to tell you right now that there is a unspent transaction on the blockchain that can be spent with the private key 0000000000000000000000000000000000000000000000000000000000000001 - I just sent you money, and you can't refuse it!

Even better, I just took that money (which was at 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH) and moved it to 3MaB7QVq3k4pQx3BhsvEADgzQonLSBwMdj, which is a P2SH address that can be redeemed by anybody using the script OP_TRUE. So I just sent everybody in the universe money, and they can't refuse it!

The existence of Bitcoin may change the way people think about how money is owned (since money can be jointly owned in interesting ways with multisig or even more exotic scripts), and it might take a while for law/courts/society to adapt. Interesting to see it slowly happen bit by bit, in ways like this story tells.

In the case of politicians' requirements to not accept "dirty money", it may be that it is not considered theirs until it is put to use. or that it would be a lesser offense.

Perhaps in a similar way to that of the misdemeanor crime of "joy-riding" becomes "grand theft" when you switch the license plates or otherwise attempt to change the identity of the vehicle making it less identifiable as belonging to its rightful owner.