Recently I've been the victim of a number of man-in-the-middle attacks. Here is an explanation of how they work:
Imagine a scammer contacting me to buy Bitcoins. At the same time the scammer gets into contact with someone else, let's call him Bob. The Scammer sells Bob bitcoins, or something else, let's say a coat.
The scammer then gives Bob my bank account number. Bob pays, thinking he's paying for a coat. I get Bob's money, thinking I've been paid for Bitcoins. Naturally, I send the scammer the requested Bitcoins.
Later, Bob doesn't get his coat, and file charges against me, because I received Bob's money. Meanwhile, the scammer is nowhere to be found.
This happened twice to me, at roughly the same time. I inquired with local law, and it turns out I had to refund the scammee, Bob.
Note that exchanges typically solve this problem by requiring you to verify your bank account beforehand. That's not really something I can do.
Discarded solutions are:
Asking for ID. They can be faked, or the request can be just as easily forwarded by the scammer.
Calling the person. This might work, but just a bit. So you have their phone number. What then?
Starting with small amounts. This might be helpful, but it's slow, and not really ideal.
The best solution I've been able to come up with is this:
I require the buyer to put the link "www.is.gd/warning0" in the transaction message. The page behind the link explains that they should be talking to me, via my email, and explains the above scamming scenario. The scammer hopefully can't require Bob to put this in his transaction message, because Bob would wisen up when he reads the link.
I've not had any more MitM attacks since then, so so far it's been working. Suggestions are welcome.
