TradeHill - Dwolla is being scammed and reversing transactions

[Bitcoin Swami]

I kindly requested that they fix this situation with tradehill on their facebook wall.  Surprised I was the first one. lol

[JoelKatz]

Maybe the scammers were buying on TradeHill with fraudulent Dwolla money, and selling on Mt. Gox. It would be kind of silly to try and sell BTC that you stole from an exchange on the same exchange.

It's worth talking to Mt. Gox to see if they can trace the coins to them. They may not be willing to freeze them (which would, IMO, be completely understandable), and it may already be too late, but it's worth pursuing.

[notme]

Maybe the scammers were buying on TradeHill with fraudulent Dwolla money, and selling on Mt. Gox. It would be kind of silly to try and sell BTC that you stole from an exchange on the same exchange.

It's worth talking to Mt. Gox to see if they can trace the coins to them. They may not be willing to freeze them (which would, IMO, be completely understandable), and it may already be too late, but it's worth pursuing.

Don't freeze them, watch where they go, then have Dwolla reverse the transaction .  Apparently it's possible, and you at least get another scammer account, if not a name and address.  However, if the coins were not transferred straight to mtgox from tradehill, it's much tougher to link.

[grod]

There are more exchanges than 2, you know.   Heck, just go bitcoins -> namecoins -> bitcoins and you're laundered.

I believe this was possible because in the US EFTs can be reversed in case of error for up to 60 days even though funds clear in 2-5.  This is how it would go down, with no risk to scammer:

Joe Smith: "Mr bank, please initiate EFT to account XYZ."
Bank: K.
Dwolla: Funds received to Mr. Bogus T. Fradulent's account.
Joe Smith aka Bogus T Fradulent: "Mr Dwolla, please send em to Trade Hill, account ABC "
Dwolla: K.
Trade Hill: "Funds received to Bogus T Fradulent's account."
Joe Smith aka Bogus T Fradulent: "BUY BUY BUY SEND SEND SEND"
Joe Smith: "Mr bank, I made an error.  I sent to account XYZ, I meant PDQ."
Bank: K.  EFT reversed, reason of Joe Smith's funds deposited to wrong account.  Dwolla, never mind that deposit to account XYZ.
Dwolla: K.  Um.  Wait, what?  This sucks, let's just pretend we never transfered those funds to Trade Hill.
Trade Hill: WHAT IN THE BUTT?!?!

Kids, don't try this at home.  Not being an expert in wire fraud and money laundering I'm sure I left some important details out.  You're more likely to win 15 years of prison rape for wire fraud as opposed to a few bitcoins following the above script yourself.

[Jered Kenna (TradeHill)]

There are more exchanges than 2, you know.   Heck, just go bitcoins -> namecoins -> bitcoins and you're laundered.

I believe this was possible because in the US EFTs can be reversed in case of error for up to 60 days even though funds clear in 2-5.  This is how it would go down, with no risk to scammer:

Joe Smith: "Mr bank, please initiate EFT to account XYZ."
Bank: K.
Dwolla: Funds received to Mr. Bogus T. Fradulent's account.
Joe Smith aka Bogus T Fradulent: "Mr Dwolla, please send em to Trade Hill, account ABC "
Dwolla: K.
Trade Hill: "Funds received to Bogus T Fradulent's account."
Joe Smith aka Bogus T Fradulent: "BUY BUY BUY SEND SEND SEND"
Joe Smith: "Mr bank, I made an error.  I sent to account XYZ, I meant PDQ."
Bank: K.  EFT reversed, reason of Joe Smith's funds deposited to wrong account.  Dwolla, never mind that deposit to account XYZ.
Dwolla: K.  Um.  Wait, what?  This sucks, let's just pretend we never transfered those funds to Trade Hill.
Trade Hill: WHAT IN THE BUTT?!?!

Kids, don't try this at home.  Not being an expert in wire fraud and money laundering I'm sure I left some important details out.  You're more likely to win 15 years of prison rape for wire fraud as opposed to a few bitcoins following the above script yourself.

Sounds pretty accurate, I think you nailed it.

[JoelKatz]

Joe Smith: "Mr bank, please initiate EFT to account XYZ."
Bank: K.
Dwolla: Funds received to Mr. Bogus T. Fradulent's account.
Joe Smith aka Bogus T Fradulent: "Mr Dwolla, please send em to Trade Hill, account ABC "
Dwolla: K.
Trade Hill: "Funds received to Bogus T Fradulent's account."
Joe Smith aka Bogus T Fradulent: "BUY BUY BUY SEND SEND SEND"
Joe Smith: "Mr bank, I made an error.  I sent to account XYZ, I meant PDQ."
Bank: K.  EFT reversed, reason of Joe Smith's funds deposited to wrong account.  Dwolla, never mind that deposit to account XYZ.

Which brings up the question -- What is Dwolla's business model? How can they do no chargebacks at only 25 cents per transaction? One fraudulent payment reversal in every 5,000 transactions would bankrupt them.

[Jered Kenna (TradeHill)]

Joe Smith: "Mr bank, please initiate EFT to account XYZ."
Bank: K.
Dwolla: Funds received to Mr. Bogus T. Fradulent's account.
Joe Smith aka Bogus T Fradulent: "Mr Dwolla, please send em to Trade Hill, account ABC "
Dwolla: K.
Trade Hill: "Funds received to Bogus T Fradulent's account."
Joe Smith aka Bogus T Fradulent: "BUY BUY BUY SEND SEND SEND"
Joe Smith: "Mr bank, I made an error.  I sent to account XYZ, I meant PDQ."
Bank: K.  EFT reversed, reason of Joe Smith's funds deposited to wrong account.  Dwolla, never mind that deposit to account XYZ.

Which brings up the question -- What is Dwolla's business model? How can they do no chargebacks at only 25 cents per transaction? One fraudulent payment reversal in every 5,000 transactions would bankrupt them.

They've clarified it today. They do chargebacks. Unfortunately they had told us that they don't.
It's 4:15, I'm going to get some sleep, I'll be available tomorrow.


Jered

[Romoku]

Joe Smith: "Mr bank, please initiate EFT to account XYZ."
Bank: K.
Dwolla: Funds received to Mr. Bogus T. Fradulent's account.
Joe Smith aka Bogus T Fradulent: "Mr Dwolla, please send em to Trade Hill, account ABC "
Dwolla: K.
Trade Hill: "Funds received to Bogus T Fradulent's account."
Joe Smith aka Bogus T Fradulent: "BUY BUY BUY SEND SEND SEND"
Joe Smith: "Mr bank, I made an error.  I sent to account XYZ, I meant PDQ."
Bank: K.  EFT reversed, reason of Joe Smith's funds deposited to wrong account.  Dwolla, never mind that deposit to account XYZ.

Which brings up the question -- What is Dwolla's business model? How can they do no chargebacks at only 25 cents per transaction? One fraudulent payment reversal in every 5,000 transactions would bankrupt them.

They've clarified it today. They do chargebacks. Unfortunately they had told us that they don't.
It's 4:15, I'm going to get some sleep, I'll be available tomorrow.


Jered

Well there goes Dwolla and Paypal. Too bad traditional banking institutions are the ones causing the currency fraud.

[JoelKatz]

They've clarified it today. They do chargebacks. Unfortunately they had told us that they don't.
It's 4:15, I'm going to get some sleep, I'll be available tomorrow.

They told everyone, and continue to tell everyone, that they don't. I presume they're going to reimburse you, change their terms of service, and notify their customers. If not, they cannot be trusted to honor their commitments.

"Remember, these are cash-based transactions! No credit card fees, chargeback concerns, or signing necessary!" -- Dwolla

I bet they were thinking something like, "this is so easy, why isn't everyone doing it?" Now they know. It's never easy.

If this goes to arbitration, you should win. Dwolla can't excuse their reneging on their agreement with you because a third party reneged on them. Otherwise, you could excuse any non-performance simply by laundering a contract through a third-party who you would rely on to perform your part of the contract.

[bitcoinBull]

Joe Smith: "Mr bank, please initiate EFT to account XYZ."
Bank: K.
Dwolla: Funds received to Mr. Bogus T. Fradulent's account.
Joe Smith aka Bogus T Fradulent: "Mr Dwolla, please send em to Trade Hill, account ABC "
Dwolla: K.
Trade Hill: "Funds received to Bogus T Fradulent's account."
Joe Smith aka Bogus T Fradulent: "BUY BUY BUY SEND SEND SEND"
Joe Smith: "Mr bank, I made an error.  I sent to account XYZ, I meant PDQ."
Bank: K.  EFT reversed, reason of Joe Smith's funds deposited to wrong account.  Dwolla, never mind that deposit to account XYZ.

Which brings up the question -- What is Dwolla's business model? How can they do no chargebacks at only 25 cents per transaction? One fraudulent payment reversal in every 5,000 transactions would bankrupt them.

They've clarified it today. They do chargebacks. Unfortunately they had told us that they don't.
It's 4:15, I'm going to get some sleep, I'll be available tomorrow.


Jered

Well there goes Dwolla and Paypal. Too bad traditional banking institutions are the ones causing the currency fraud.

For the time being Dwolla is still here, thankfully.  IMO, they helped boost the bitcoin economy as much as bitcoin did theirs.  They are still the cheapest and most convenient way for US customers to fund exchanges.

However, since it is clear that Dwolla transactions are in fact reversible (contrary to their claims), exchanges like TradeHill might need to change how they process Dwolla deposits.  To protect themselves, they may have to start withholding bitcoins purchased with dwolla deposits for a couple of weeks, until it is clear the deposit won't be reversed.

Reversing transactions is really the only way to protect themselves against (ACH) fraud, so this shouldn't be much of a surprise despite their claims about "no chargebacks".

Dwolla is still friendly to bitcoin, just not to fraud.  We are lucky that bitcoin makes up the bulk of their business.  Otherwise, they would probably choose to freeze MtGox and TradeHill's entire accounts (like PayPal would) rather than just reversing a few of their transactions.

[JoelKatz]

Reversing transactions is really the only way to protect themselves against (ACH) fraud, so this shouldn't be much of a surprise despite their claims about "no chargebacks".

How does it protect them against fraud? They've still been defrauded out of exactly the same amount of money. They've just additionally defrauded one of their customers. If Jack steals $10 from me, and I respond by stealing $10 from Joe, I haven't "protected myself" against Jack. I've just victimized Joe.

[arnoldrimmer]

Since the Dwolla Service is only for US Citizens Many of us really dont care I think...

[wareen]

However, since it is clear that Dwolla transactions are in fact reversible (contrary to their claims), exchanges like TradeHill might need to change how they process Dwolla deposits.  To protect themselves, they may have to start withholding bitcoins purchased with dwolla deposits for a couple of weeks, until it is clear the deposit won't be reversed.

Sounds like that won't be very practical:

...in the US EFTs can be reversed in case of error for up to 60 days

Having to wait for two months before you are actually allowed to use your deposited funds to buy Bitcoins is surely not an option.
Dwolla probably didn't have that many scamming issues they couldn't resolve or just eat the loss up until now. I'm not sure about the US, but EFT reversal is not a very common scamming-vector here in Europe.

I suspect that the only real way to handle this is for somebody to charge higher fees and use that money to pay for lawyers handling the dispute resolution / scamming cases.

Whether Dwolla, TradeHill or the bank does that is irrelevant but somebody will eventually have to price in that risk.

[Rob Lister]

Jered,

What Tradehill customers were impacted by this?  IOW, the scammer bought BTC and cashed out.  Did the BTC sellers get their cash? 

[makomk]

It's possible Mt. Gox had the same thing happen and didn't notice. As I understand what they're saying, Dwolla just changed the status back to unpaid and took the money without any notification. If you weren't looking for something like that, you might not notice until some time later when you tried to balance the books.

It's also possible Mt Gox has had the same thing happen and hasn't talked about it publicly. Based on the reasons they gave for their French bank cancelling their account, we know someone's tried this with Mt Gox SEPA transfers using stolen online banking information, and since SEPA transfers are definitely reversable it's very likely they lost some money from this happening, yet they haven't said anything.

It's not like Mt Gox are exactly the most honest and straightforward organisation; in the past they haven't admitted to anything that wasn't already obvious.

]How does it protect them against fraud? They've still been defrauded out of exactly the same amount of money. They've just additionally defrauded one of their customers. If Jack steals $10 from me, and I respond by stealing $10 from Joe, I haven't "protected myself" against Jack. I've just victimized Joe.

It protects them by fraud by transferring the risk to the party that actually has control of it. Remember that it was TradeHill that chose to offer the high fraud risk service of selling untraceable cryptocurrency rather than something lower risk. Also, your analogy is bad. Dwolla are effectively a middleman - the reversed transactions to TradeHill were carried out at the (fraudulent) request of the person who originally transferred in money that was reversed, using that money. It's more like if Jack gave you $10 of stolen money to give to Joe, and then the victim came and demanded it back.

However, since it is clear that Dwolla transactions are in fact reversible (contrary to their claims)

Did they actually claim this? I've seen them advertise "no chargebacks" as a benefit, but that's still technically true - chargebacks are considerably nastier than merely reversing the transaction. In fact, I'd always got the impression that Dwolla transactions were reversible based on their promotional material.

[JoelKatz]

Dwolla has added the following to their user agreement:

The receiving party of a transaction may be subject to chargebacks occurring within the account if claims are made by the sending party or by the financial institution. In the event fraud occurs, funds may be reversed and arbitration will begin with both parties.

I think Dwolla will soon discover that this doesn't do what they think it does. If Dwolla can't establish any fraud on the part of the receiving party, Dwolla will lose in arbitration. Dwolla cannot use the fact that they were defrauded to justify breaching their agreement with an innocent party. This clause just says that Dwolla can take the money back until an arbitrator decides who gets it. The receiving party will llikely prevail in their arbitration with Dwolla and Dwolla will have to reverse the chargeback, again assuming they can't show any fraud on the part of the receiving party.

The unusual rules for credit card chargebacks come from specific Federal laws. There are no analogous laws for ACH that Dwolla can take advantage of. Since Dwolla drafted these terms as a contract of adhesion, any ambiguities in it will be construed in the favor of the other party.

[hugolp]

However, since it is clear that Dwolla transactions are in fact reversible (contrary to their claims)

Did they actually claim this? I've seen them advertise "no chargebacks" as a benefit, but that's still technically true - chargebacks are considerably nastier than merely reversing the transaction. In fact, I'd always got the impression that Dwolla transactions were reversible based on their promotional material.

For the ones that hate all legal terminology, can you explain the difference between a chargeback and reversing a transaction.

[airdata]

I would think somebody would have to have proper credentials in order to goto their bank and claim a transaction is fraudulent.

In which case they would be using their real name and information.  Isn't this traceable back to their bank?  Hard to use TOR and proxies at a physical bank location.

I hope the cyber police do a full back trace and put somebody in jail.

[kokojie]

I think holding ACH/dwolla deposits for 60 days before allowed to use it MIGHT be the final solution here, there's no other way to prevent ACH fraud.

[hugolp]

I would think somebody would have to have proper credentials in order to goto their bank and claim a transaction is fraudulent.

In which case they would be using their real name and information.  Isn't this traceable back to their bank?  Hard to use TOR and proxies at a physical bank location.

I hope the cyber police do a full back trace and put somebody in jail.

Hes probably not using his own account. That would be stupid.