Canada: Interac EMTs are a problem

[jlcooke]

Some may already know this.  But I will share my experience any ways.

I started selling bitcoins on localbitcoins.com Friday afternoon.  A new buyer was interested dpwebb (https://localbitcoins.com/accounts/profile/dpwebb/).  Over the weekend we performed 4 sales:
 - 2.97390000BTC ==> 342.00CAD (verify code: wejia86)
 - 5.53910000BTC ==> 637.00CAD (verify code: iecil53)
 - 0.98760000BTC ==> 115.00CAD (verifycode: jeigiw36)
 - 1.08230000BTC ==> 125.00CAD (verify code: kifipod6)

Today my bank account was locked up because of a $1219.00 CAD dispute from closed interact email transfers.  Apparently dpwebb is either a scammer - or his bank account was taken over.  Either-way he's disputing the deal.

I've forwarded all pertinent information from localbitcoins.com to my bank's fraud department to clear my name and resolve this issue.

Anyone else with experience selling BTC in Canada?  Seems to me a new payment service is appearing all the time.  I don't trust any of them any more.

Update 2013-08-27: Email response from my bank:  After speaking with our security department, they are still investigating.  We have provided them with everything that you kind enough to forward to me.  Until the investigation is complete the hold will remain.  I will provide you with any information as I receive it.

[adamcol]

We've been accepting Interac Online for about a month now (https://QuickBT.com) and haven't run into issues because our max payment is 0.4. Not really worth the effort to steal someone's bank account for $40, and we can afford to take some hits if it ever happens.

Please let us know what the outcome of this is.

Jamie
QuickBT.com

[DeathAndTaxes]

EMT is reversible you likely are going to lose those funds.  The fact that someone online gave you an account number isn't going to be sufficient proof for the banks.   It almost certainly isn't but it "could" be a stolen bank account.  You have no proof the account holder authorized the transaction and the bank isn't going to investigate.

[Yogafan00000]

I've read on Interac website these are supposed to be non-reversible, which is why they are good for online sales.  I guess not.

I'm interested to know the outcome of this as well.

[DeathAndTaxes]

I've read on Interac website these are supposed to be non-reversible, which is why they are good for online sales.  I guess not.

I'm interested to know the outcome of this as well.

The marketing language they use is somewhat deceptive and they are intentionally vague thinking obscurity provides security.

Unlike a credit card you can't dispute a charge for any reason except that you didn't make it.  This there is no chargeback because you didn't receive the product, the merchant lied, the product arrived broken, etc. 

A thief however can still dispute they never made the charge.  "It wasn't me, I have no idea who this Bitcoin hacker guy is, or how he stole my money but I never made these transfers. Please Mr. Bank Customer support person they stole all my money I can't pay the rent unless I get this back".  It appears that is what happened to the OP.   It is also possible although unlikely the person on localbitcoins isn't the account holder and he just transfered funds using an actual stolen account (which is now being disputed by the real accountholder).

Summary
1) Dispute when there is a problem with the sale - NOT ALLOWED
2) Dispute when funds are sent by a hacker from a compromised bank account - ALLOWED.
3) Dispute when real account holder pretends #2 above happened - ALLOWED

[01BTC10]

Interac transfer not safe: https://bitcointalk.org/index.php?topic=135955.0

[jlcooke]

We've been accepting Interac Online for about a month now (https://QuickBT.com) and haven't run into issues because our max payment is 0.4. Not really worth the effort to steal someone's bank account for $40, and we can afford to take some hits if it ever happens.

Please let us know what the outcome of this is.

Jamie
QuickBT.com

This seems like the most social engineering proof way to do it.  Unfortunately I can't move that slowly.    I love your service btw Jamie.

Mentioned it to a few friends who want to pay for their VPN your way.

[bitcad4u]

EMTs are subject to supreme scammers - they will call the bank after they receive your coins and tell the bank their accounts were haxxed.  You will loose because the banks side with the scammers, you will loose again because the police wont do shit all to help you get your money back.  In the end you will loose - it sucks but its true.

[jlcooke]

I'm interested to know the outcome of this as well.

I've got into my account.  But still not able to receive EMTs

EMT Receive Error
We cannot process your request at this time. Please contact us at 1 800 xxx-xxxx to discuss and provide the following code number.
ER/J/EMT-R-CP-411

I have a customer right now ("b...n") who tried to send the funds but now I've asked him to back it out.

I'm going to send $1 CAD to his BTC pubkey for his trouble.

This BTC stuff really is "the wild west".

[Yogafan00000]

A thief however can still dispute they never made the charge.  "It wasn't me, I have no idea who this Bitcoin hacker guy is, or how he stole my money but I never made these transfers. Please Mr. Bank Customer support person they stole all my money I can't pay the rent unless I get this back".

I would imagine this scenario would only work once per bank account.  After that, the bank would be onto the scammer's MO.  The 2nd and subsequent claims by a person doing this scam from their own account would be treated with extreme suspicion by their bank.  It would have to be a decent amount of money to be worth burning one's own reputation with their bank to try this scam.

I also find it amazing that there are many legitimately 'hacked' bank accounts in Canada.  I've been using online banking for years in Canada with no problems. I would think their security would be heavy duty.  I know if someone hacked my account and tried to do an Interac e-Transfer out, I'd get a phone call from my bank.

[jlcooke]

Posting localbitcoins signature details for proof and safe keeping.  I don't expect my bank will ask for it, but since I'm now trying to defend myself as being an honest party in these transactions I may need to produce evidence that everything was on the up and up.

LocalBitCoins.com produces a signature with every transaction which can be verified offline with PKI or online for bank fraud department reps who don't know the diff between discrete logarithms and elliptic curve discrete logarithms.

https://localbitcoins.com/verify_signature/    ... and wouldn't you know it.  It's broken right now.  Fuck this day just doesn't get better.  I've submitted the bug to their support form.  I'll edit this post when it's fixed.

Code:

==== LocalBitcoins.com Receipt Contact #82112
Seller: jlcooke
Buyer: dpwebb
2.97390000 BTC sent to buyer on 2013-08-25 16:02:31+00:00
Localbitcoins.com fee BTC: 0.02973900
Payment details as shown to buyer: 
Method: 
Interac email address provided once contacted.
Amount: 342.00 CAD
Reference/message: L82112B1RCW
End ====

Localbitcoins.com bitcoin signature: IEpTrWdrMEi6LDlPCtHoJkRiJpr+KLYx/iE5EnKjnQwJXPV49+Z3dZvoHZ19+GqNkyl+qltsJdtX+2ocYW8rvvA=
Signing address: 1Q1wVsNNiUo68caU7BfyFFQ8fVBqxC2DSc

Code:

== LocalBitcoins.com Receipt Contact #82065
Seller: jlcooke
Buyer: dpwebb
5.53910000 BTC sent to buyer on 2013-08-25 15:26:27+00:00
Localbitcoins.com fee BTC: 0.05539100
Payment details as shown to buyer: 
Method: 
Interac email address provided once contacted.
Amount: 637.00 CAD
Reference/message: L82065B1RBL
End ====

Localbitcoins.com bitcoin signature: HxPJ7HqYuTh05lcGuGTgsDVW6hUnyk8EbZgH9dQLhWO+EtRiQXt7ApJ1IVlF0g/wlk4VffTVB8Rts5RF1HLuzAw=
Signing address: 1Q1wVsNNiUo68caU7BfyFFQ8fVBqxC2DSc

Code:

==== LocalBitcoins.com Receipt Contact #81129
Seller: jlcooke
Buyer: dpwebb
0.98760000 BTC sent to buyer on 2013-08-24 16:48:00+00:00
Localbitcoins.com fee BTC: 0.00987600
Payment details as shown to buyer: 
Method: 
Interac email address provided once contacted.
Amount: 115.00 CAD
Reference/message: L81129B1QLL
End ====

Localbitcoins.com bitcoin signature: ILcd3hOcxeYUw+wvc9F9caxeLUEe5cfEjubM76Jy8rQdEhhnZ3vtLGLPehEKgElrY5DRoYJGpCF/z4Nm0bc1kdQ=
Signing address: 1Q1wVsNNiUo68caU7BfyFFQ8fVBqxC2DSc

Code:

==== LocalBitcoins.com Receipt Contact #80977
Seller: jlcooke
Buyer: dpwebb
1.08230000 BTC sent to buyer on 2013-08-24 14:35:32+00:00
Localbitcoins.com fee BTC: 0.01082300
Payment details as shown to buyer: 
Method: 
Interac email address provided once contacted.
Amount: 125.00 CAD
Reference/message: L80977B1QHD
End ====

Localbitcoins.com bitcoin signature: IBuPHYqKqUYjkatFQUrj1pettbXV1pRZzuUQUip7LMDrrtwbrIk4BoV6yYBg1fh2RXD6Akd3W/PbnHJj+JWYwlg=
Signing address: 1Q1wVsNNiUo68caU7BfyFFQ8fVBqxC2DSc

[jlcooke]

A thief however can still dispute they never made the charge.  "It wasn't me, I have no idea who this Bitcoin hacker guy is, or how he stole my money but I never made these transfers. Please Mr. Bank Customer support person they stole all my money I can't pay the rent unless I get this back".

I would imagine this scenario would only work once per bank account.  After that, the bank would be onto the scammer's MO.  The 2nd and subsequent claims by a person doing this scam from their own account would be treated with extreme suspicion by their bank.  It would have to be a decent amount of money to be worth burning one's own reputation with their bank to try this scam.

I also find it amazing that there are many legitimately 'hacked' bank accounts in Canada.  I've been using online banking for years in Canada with no problems. I would think their security would be heavy duty.  I know if someone hacked my account and tried to do an Interac e-Transfer out, I'd get a phone call from my bank.

I'm not convinced he was hacked.  But maybe.  We exchanged emails (using reply-to the communication@localbitcoins.com alerts) and I saw the name of dpwebb's business and his title (CEO).  He claimed to be trying to do arbitrage against MtGox - an almost plausible angle for playing BTC.

I suspect he was going to gamble $1300 on bitcoin and see if he could get an "extra percentage" but claiming "hacker!".  That between him and his bank.  I will not take a loss on this ... other than my time today.  Already wiping out any profit I would have made.

Share and enjoy.

[DeathAndTaxes]

A thief however can still dispute they never made the charge.  "It wasn't me, I have no idea who this Bitcoin hacker guy is, or how he stole my money but I never made these transfers. Please Mr. Bank Customer support person they stole all my money I can't pay the rent unless I get this back".

I would imagine this scenario would only work once per bank account.  After that, the bank would be onto the scammer's MO.  The 2nd and subsequent claims by a person doing this scam from their own account would be treated with extreme suspicion by their bank.  It would have to be a decent amount of money to be worth burning one's own reputation with their bank to try this scam.

Not everything is a grand criminal enterprise.  Most crimes are just a crime of opportunity "Oh look I can get a $1200 in free money using a computer. Sweet."   I mean lets put this into perspective.  Not everyone is Bernie Madoff.  Plenty of people have died in muggings gone wrong for a LOT less than $1,200.  Think any criminal goes into an armed robbery saying "I am going to kill this guy but the chance of 25 to life is totally worth a iphone, a couple of credit cards and a couple bucks in cash".  Nobody is burning their rep with the bank, the bank gives two craps.  

I also find it amazing that there are many legitimately 'hacked' bank accounts in Canada.  I've been using online banking for years in Canada with no problems. I would think their security would be heavy duty.  I know if someone hacked my account and tried to do an Interac e-Transfer out, I'd get a phone call from my bank.

Do you get a phone call on every e-transfer?  The point of hacking is to impersonate the genuine user.  Any transfer the bank doesn't call you on could be a transfer by someone else using your account fraudulently and you wouldn't know until after the fact. What would you do?  Oh yeah call the bank and report that you didn't authorize that transaction.   Still you are right most of these types of transactions aren't genuinely compromised accounts, they are the account holder (or cardholder for CC) simply lying.  The bank doesn't really care though, it was never their money at risk.  Who cares if a merchant takes a hit?  You don't honestly think the bank does? They just want to resolve the dispute as quickly and more importantly cheaply as possible. 

[jlcooke]

bump - Update 2013-08-27: Email response from my bank in first post.

[Yogafan00000]

bump - Update 2013-08-27: Email response from my bank in first post.

Good luck.   I hope to see a favourable outcome for you in this.  It truly sickens me that there exists individuals with such a low regard for others property, time, and reputation.

[jlcooke]

bump - Update 2013-08-27: Email response from my bank in first post.

Good luck.   I hope to see a favourable outcome for you in this.  It truly sickens me that there exists individuals with such a low regard for others property, time, and reputation.

Thanks.

Question: I'm thinking of requiring higher number of localbitcoins.com trades plus account age of 3 months.  Any thoughts on using bitcointalk.org post counts, reputation and account age as verification?  PMing being enough to prove jdoe@localbitcoins == whatever@bitcointalk.org


The LocalBitcoins.com people have responded to support issue of signature verification issue:

I kicked the developer sitting next to me yesterday.

Now I kick harder.

No ETA yet, but he is yelling.

[bit_wizard]

To avoid fraud while doing business with people using EMT, have a secondary account at a different bank. Know your daily withdraw limit, and only do business under that amount. That way you can withdraw cash at an ATM before you release the btc from escrow for example.
This is my method of succesful practice.

[01BTC10]

You won't prevent fraud and if the bank get defrauded they will send the bill to a recovery agency.