Insuring Bitcoin: An Inescapable Moral Hazard?

[Razick]

Most markets eventually develop some sort of insurance against loss, theft and damage. So far, however, Bitcoin has been different. This is because it presents a moral hazard to anyone buying insurance: It's easy to send the coins away to an address you control and claim they were stolen. Additionally, if Bitcoin balances could be insured, users would be less inclined to adequately protect them. Why encrypt your wallet when you can just get it replaced by your insurance company when it is stolen?

Most if not all insurance markets have some kind of moral hazard: Car insurance makes drivers less careful, home owner's insurance might make owners less likely to lock the doors, and health insurance encourages people to get more care than they really need, thus making it harder and more expensive for those who really need care to get it.

But most insurance markets have been able to partially address these problems. Car insurance companies raise rates and charge deductibles. Home owners insurance companies hold the homeowner responsible for loss and damage if they fail to lock doors and close windows. Health insurance companies use similar strategies as well.

The point is, most insurance companies are able to overcome moral hazards by making policy holders bear some of the risk and responsibility. But what about Bitcoin? If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen. Charging a deductible or raising rates would do no good. Sure, maybe you only reimburse Merchant XYZ for 50% of losses, but now they have 150% of what they did before. Raise their rates? They can always just drop insurance.

Eventually we will probably need some sort of insurance for businesses that hold large amounts of Bitcoin, but the very large moral hazards associated with such insurance will be difficult to overcome. How will insurance companies mitigate these hazards without making Bitcoin insurance useless to the honest merchant?

[DannyHamilton]

Most markets eventually develop some sort of insurance against loss, theft and damage. So far, however, Bitcoin has been different. This is because it presents a moral hazard to anyone buying insurance: It's easy to send the coins away to an address you control and claim they were stolen. Additionally, if Bitcoin balances could be insured, users would be less inclined to adequately protect them. Why encrypt your wallet when you can just get it replaced by your insurance company when it is stolen?

Most if not all insurance markets have some kind of moral hazard: Car insurance makes drivers less careful, home owner's insurance might make owners less likely to lock the doors, and health insurance encourages people to get more care than they really need, thus making it harder and more expensive for those who really need care to get it.

But most insurance markets have been able to partially address these problems. Car insurance companies raise rates and charge deductibles. Home owners insurance companies hold the homeowner responsible for loss and damage if they fail to lock doors and close windows. Health insurance companies use similar strategies as well.

The point is, most insurance companies are able to overcome moral hazards by making policy holders bear some of the risk and responsibility. But what about Bitcoin? If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen. Charging a deductible or raising rates would do no good. Sure, maybe you only reimburse Merchant XYZ for 50% of losses, but now they have 150% of what they did before. Raise their rates? They can always just drop insurance.

Eventually we will probably need some sort of insurance for businesses that hold large amounts of Bitcoin, but the very large moral hazards associated with such insurance will be difficult to overcome. How will insurance companies mitigate these hazards without making Bitcoin insurance useless to the honest merchant?

What you are describing is insurance fraud. They will handle it the same way they do for current forms of insurance fraud.  Prosecution.

If I have insurance on a building, what prevents me from moving all the equipment (or furniture, or whatever) out of the building and burning it to the ground.  They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the original inventory I now have more than 100% of what I had before.

If I have insurance on my house, what prevents me from hiding all my valuables and claiming theft? They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the "stolen" items, I now have more than 100% of what I had before.

It is the threat of investigation and prosecution that prevents dishonest people from getting away with such actions often enough to bankrupt the insurance company.

A bitcoin insurance policy would need to require certain security measures be in place, and then would need to investigate any loss and prosecute any attempt at fraud.

[Razick]

Most markets eventually develop some sort of insurance against loss, theft and damage. So far, however, Bitcoin has been different. This is because it presents a moral hazard to anyone buying insurance: It's easy to send the coins away to an address you control and claim they were stolen. Additionally, if Bitcoin balances could be insured, users would be less inclined to adequately protect them. Why encrypt your wallet when you can just get it replaced by your insurance company when it is stolen?

Most if not all insurance markets have some kind of moral hazard: Car insurance makes drivers less careful, home owner's insurance might make owners less likely to lock the doors, and health insurance encourages people to get more care than they really need, thus making it harder and more expensive for those who really need care to get it.

But most insurance markets have been able to partially address these problems. Car insurance companies raise rates and charge deductibles. Home owners insurance companies hold the homeowner responsible for loss and damage if they fail to lock doors and close windows. Health insurance companies use similar strategies as well.

The point is, most insurance companies are able to overcome moral hazards by making policy holders bear some of the risk and responsibility. But what about Bitcoin? If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen. Charging a deductible or raising rates would do no good. Sure, maybe you only reimburse Merchant XYZ for 50% of losses, but now they have 150% of what they did before. Raise their rates? They can always just drop insurance.

Eventually we will probably need some sort of insurance for businesses that hold large amounts of Bitcoin, but the very large moral hazards associated with such insurance will be difficult to overcome. How will insurance companies mitigate these hazards without making Bitcoin insurance useless to the honest merchant?

What you are describing is insurance fraud. They will handle it the same way they do for current forms of insurance fraud.  Prosecution.

If I have insurance on a building, what prevents me from moving all the equipment (or furniture, or whatever) out of the building and burning it to the ground.  They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the original inventory I now have more than 100% of what I had before.

If I have insurance on my house, what prevents me from hiding all my valuables and claiming theft? They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the "stolen" items, I now have more than 100% of what I had before.

It is the threat of investigation and prosecution that prevents dishonest people from getting away with such actions often enough to bankrupt the insurance company.

A bitcoin insurance policy would need to require certain security measures be in place, and then would need to investigate any loss and prosecute any attempt at fraud.

I agree with you and do think that is part of the solution, but it would be difficult to create a system that allows a company to retain control of their funds and also prevents them from having their coins "stolen" as opposed to stolen. Traditional forms of insurance fraud are easier to detect. Hiding Bitcoin is easy, any moron can do it, and it would be difficult to prove.

Now given it would also be difficult for the company to spend those coins, but not impossible especially if the coins were stolen for the benefit of its owners, who might already possess large amounts of Bitcoin making it hard to demonstrate that they are responsible for draining the insured wallet.

I'm sure the risk could be mitigated, but I'm not entirely sure how.

[Fray]

Most markets eventually develop some sort of insurance against loss, theft and damage. So far, however, Bitcoin has been different. This is because it presents a moral hazard to anyone buying insurance: It's easy to send the coins away to an address you control and claim they were stolen. Additionally, if Bitcoin balances could be insured, users would be less inclined to adequately protect them. Why encrypt your wallet when you can just get it replaced by your insurance company when it is stolen?

Most if not all insurance markets have some kind of moral hazard: Car insurance makes drivers less careful, home owner's insurance might make owners less likely to lock the doors, and health insurance encourages people to get more care than they really need, thus making it harder and more expensive for those who really need care to get it.

But most insurance markets have been able to partially address these problems. Car insurance companies raise rates and charge deductibles. Home owners insurance companies hold the homeowner responsible for loss and damage if they fail to lock doors and close windows. Health insurance companies use similar strategies as well.

The point is, most insurance companies are able to overcome moral hazards by making policy holders bear some of the risk and responsibility. But what about Bitcoin? If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen. Charging a deductible or raising rates would do no good. Sure, maybe you only reimburse Merchant XYZ for 50% of losses, but now they have 150% of what they did before. Raise their rates? They can always just drop insurance.

Eventually we will probably need some sort of insurance for businesses that hold large amounts of Bitcoin, but the very large moral hazards associated with such insurance will be difficult to overcome. How will insurance companies mitigate these hazards without making Bitcoin insurance useless to the honest merchant?

What you are describing is insurance fraud. They will handle it the same way they do for current forms of insurance fraud.  Prosecution.

If I have insurance on a building, what prevents me from moving all the equipment (or furniture, or whatever) out of the building and burning it to the ground.  They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the original inventory I now have more than 100% of what I had before.

If I have insurance on my house, what prevents me from hiding all my valuables and claiming theft? They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the "stolen" items, I now have more than 100% of what I had before.

It is the threat of investigation and prosecution that prevents dishonest people from getting away with such actions often enough to bankrupt the insurance company.

A bitcoin insurance policy would need to require certain security measures be in place, and then would need to investigate any loss and prosecute any attempt at fraud.

I would think that a potential insurance company would likely want to have possession of the coins themselves, keeping them safe. They would only release the coins to the insured after verifying his identity and upon release of insurance liability of the coins being stolen. It would be difficult to investigate/prove insurance fraud with bitcoin if it was done in any other way.

[Soros Shorts]

If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen.

The insurance company would likely require adequate monitoring and auditing systems to be in place before they would underwrite this kind of insurance. Computer systems running the wallet would need to be secured using industry standard best practices. Security procedures would need to be audited by a CPA. That way, when funds get illegally transferred out the merchant should be able to produce read-only access logs, network connection logs, video footage, etc., that would leave an audit trail as to what happened.

Think about cash in the bank vault. The insurance company would never insure a bank against loss from theft if anyone could just walk in and remove the cash completely undetected and without trace.

[Razick]

If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen.

The insurance company would likely require adequate monitoring and auditing systems to be in place before they would underwrite this kind of insurance. Computer systems running the wallet would need to be secured using industry standard best practices. Security procedures would need to be audited by a CPA. That way, when funds get illegally transferred out the merchant should be able to produce read-only access logs, network connection logs, video footage, etc., that would leave an audit trail as to what happened.

Think about cash in the bank vault. The insurance company would never insure a bank against loss from theft if anyone could just walk in and remove the cash completely undetected and without trace.

Very good point. It's not going to be as simple as signing a form and shaking hands, but it should be doable.

[Dabs]

In other words, you are entrusting your coins to a third party. Insurance then takes the role of escrow.

[Razick]

In other words, you are entrusting your coins to a third party. Insurance then takes the role of escrow.

I think for the purposes of this discussion we should assume that the policy holder maintains primary control of their funds. If you buy car insurance or home owner's insurance, the company doesn't make you park the car in their lot and ask for the keys any time you drive it.

If the company has to control the money, 1) who will insure them? 2) it becomes more hassle than it is worth to the policy holder.

[DannyHamilton]

In other words, you are entrusting your coins to a third party. Insurance then takes the role of escrow.

I think for the purposes of this discussion we should assume that the policy holder maintains primary control of their funds. If you buy car insurance or home owner's insurance, the company doesn't make you park the car in their lot and ask for the keys any time you drive it.

If the company has to control the money, 1) who will insure them? 2) it becomes more hassle than it is worth to the policy holder.

It is very difficult to get an insurance company to insure the cash you have sitting in your house.

It is much easier to get an insurance company to insure the account you have at a bank.

It will be the same with bitcoins.

It will be nearly impossible to get an insurance company to insure the bitcoins you have sitting in a wallet that is completely under your control.

It will be much easier to get an insurance company to insure the bitcoin account you have with some third party service that is subjected to regulations and regular security and financial audits.

[Ron~Popeil]

Most markets eventually develop some sort of insurance against loss, theft and damage. So far, however, Bitcoin has been different. This is because it presents a moral hazard to anyone buying insurance: It's easy to send the coins away to an address you control and claim they were stolen. Additionally, if Bitcoin balances could be insured, users would be less inclined to adequately protect them. Why encrypt your wallet when you can just get it replaced by your insurance company when it is stolen?

Most if not all insurance markets have some kind of moral hazard: Car insurance makes drivers less careful, home owner's insurance might make owners less likely to lock the doors, and health insurance encourages people to get more care than they really need, thus making it harder and more expensive for those who really need care to get it.

But most insurance markets have been able to partially address these problems. Car insurance companies raise rates and charge deductibles. Home owners insurance companies hold the homeowner responsible for loss and damage if they fail to lock doors and close windows. Health insurance companies use similar strategies as well.

The point is, most insurance companies are able to overcome moral hazards by making policy holders bear some of the risk and responsibility. But what about Bitcoin? If Merchant XYZ purchased insurance for their Bitcoin wallets, they could create a brain wallet, transfer funds to its address and claim they were stolen. Charging a deductible or raising rates would do no good. Sure, maybe you only reimburse Merchant XYZ for 50% of losses, but now they have 150% of what they did before. Raise their rates? They can always just drop insurance.

Eventually we will probably need some sort of insurance for businesses that hold large amounts of Bitcoin, but the very large moral hazards associated with such insurance will be difficult to overcome. How will insurance companies mitigate these hazards without making Bitcoin insurance useless to the honest merchant?

What you are describing is insurance fraud. They will handle it the same way they do for current forms of insurance fraud.  Prosecution.

If I have insurance on a building, what prevents me from moving all the equipment (or furniture, or whatever) out of the building and burning it to the ground.  They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the original inventory I now have more than 100% of what I had before.

If I have insurance on my house, what prevents me from hiding all my valuables and claiming theft? They can raise my rates, or only reimburse me for a portion of my losses, but since I still have all the "stolen" items, I now have more than 100% of what I had before.

It is the threat of investigation and prosecution that prevents dishonest people from getting away with such actions often enough to bankrupt the insurance company.

A bitcoin insurance policy would need to require certain security measures be in place, and then would need to investigate any loss and prosecute any attempt at fraud.

Agreed. A lot of things we think we need specifically for bit coin is all ready in place. There are consumer protection laws that all ready exist that are applicable to bit coin and as stated above there is all ready a process for detecting and prosecuting insurance fraud. Instead of creating whole new sets of regulations and processes most issues can be resolved or avoided simply by applying existing measures to the bit coin economy.    

[CIYAM]

I think the idea of a business whose role is to just do "cold storage" and offer insurance for said cold storage makes a lot of sense actually.

It can be quite stressful looking after large amounts of BTC (a bit like looking after a lot of jewelry or gold) and not something that most people or businesses may want to risk so I think that there will be a market for such services in the very near future.

[Cubic Earth]

Think about cash in the bank vault. The insurance company would never insure a bank against loss from theft if anyone could just walk in and remove the cash completely undetected and without trace.

Agreed.  I can't see any reason why an insurance company would be willing to insure bitcoins that were under a private individual's sole control, and I can't really see a reason why there is a need for that, considering how easy it is to transfer and share BTC ownership.

My idea for semi-distributed cold storage insurance would be along these lines:  Lets say you own a house worth $1,000,000 and you own all of it, no mortgage.  And lets say you are a cold storage ninja.  You could sign a contract with an insurance broker to store bitcoins worth up to 1/3 of the house value.  If you couldn't or wouldn't give back the coins according to the terms of the contract, the house would be liquidated and converted to BTC to repay the person who had paid for the bitcoins to be stored and insured.  The 1:3 btc to house value-ratio is just a guess on my part, I don't know what the optimum would be.

[franky1]

for private individuals, forget insurance.

but for businesses, it is feasible and manageable. and here is how:
insurance company draws up a contract that the business has to have regular audits of its clients balances and the cold store value (to ensure they match(zero fractional reserve)).
also the businesses clients have to register a withdrawal address, which funds of that client will only be withdrawn to (security precaution to prevent hacker theft sending funds elsewhere).
also the business would only utilize the insurance under bankruptcy conditions, this keeps the business legit and the clients happy because:
1. the business cant simply shout hacked 100 times a year to abuse the insurer.
2. if a business shouts bankrupt, then thats the business over and done with and that business cant make more income, so would do so only if truly bankrupt.
3. if the business is bankrupt, then clients instead of waiting 2 years+ for a possible ROI through liquidation, the insurer pays out alot sooner
4. the insurer will prosecute the business if fraud is detected.

relying on bankruptcy liquidation returns is not in 'clients' interests as the bankrupcy court is more interested in raiding the assets dry via large attourney fee's and multiple 'meeting'/hearings costs, yet an insurer is more on the side of clients. especially if a business wishes to attempt anything dodgy.

the insurer will put extra stipulations on how to cold store the funds and ensure its not being syphoned off, such as ID checks and locked in withdrawal addresses so they can prove that usernames are not just empty sockpuppet siphoning strategies. but it is possible for an exchange to be insured. just a pity that not really any of them are.

[phillipsjk]

Most if not all insurance markets have some kind of moral hazard: Car insurance makes drivers less careful, home owner's insurance might make owners less likely to lock the doors, and health insurance encourages people to get more care than they really need, thus making it harder and more expensive for those who really need care to get it.

I don't think car insurance makes drivers less careful. By the same token, health insurance does not really have a lot of room for abuse. You are talking about your life in those cases. It does not make sense to risk it because the car will be replaced.

For countries with universal Health insurance, triage is used to determine who gets care first. Queuing tends to discourage people with only minor problems. The risk with queuing is that most patients are not doctors: they may ignore seemingly minor symptoms if they perceive the wait-times to be too long.

The main problem with Bitcoin insurance as I see it, is that the Insurance company would not be holding the Bitcoins. They would only be compensating people for the market value of the Bitcoins in the event of loss. While there may be (business) cases where this is useful; the average person would rather properly secure their Bitcoins in the first place.

[keithers]

Insurance companies could also opt to only cover a certain percentage of the loss.   This would weed out a few (not all) of the people trying to make fraudulent claims...

[franky1]

Insurance companies could also opt to only cover a certain percentage of the loss.   This would weed out a few (not all) of the people trying to make fraudulent claims...

for scammers, even claiming 20% of something, is still 100% of profit. if payouts were allowed frquently during a businesses operations. so
insurance companies would work only as the fall back of consumer protection, basically the liability insurance in case of bankruptcy. that way businesses cant simply shout we got hacked and lost 1000 coins ($520k) every week and then just pay the sub $1k premium.

if your not that experienced in insurance for businesses then think about it as for instance life insurance that only pays out at death, and not health care insurance that pays out every time you go see a doctor

[aigeezer]

Insurers routinely use coinsurance and reinsurance to help mitigate their risks. I imagine that would be part of the BTC insurance model as it matures.

[keithers]

Insurance companies could also opt to only cover a certain percentage of the loss.   This would weed out a few (not all) of the people trying to make fraudulent claims...

for scammers, even claiming 20% of something, is still 100% of profit. if payouts were allowed frquently during a businesses operations. so
insurance companies would work only as the fall back of consumer protection, basically the liability insurance in case of bankruptcy. that way businesses cant simply shout we got hacked and lost 1000 coins ($520k) every week and then just pay the sub $1k premium.

if your not that experienced in insurance for businesses then think about it as for instance life insurance that only pays out at death, and not health care insurance that pays out every time you go see a doctor

You are right, I kind of realized that right after I submitted the post.   I don't know how insurance companies would gauge risk on an individual for their BTC holdings.   You can't exactly just run their credit...


There needs to be a new credit rating system implemented specifically for crypto currencies.   I have no idea how this would be started or implemented, but it would pave the way for the ability to insure BTC, and assist in creating a smoother lending process.

[elliptic]

Hi, Tom from Elliptic here. We already operate a service that some of you here have described - a fully insured cold storage service, see:

www.elliptic.co/vault

As has been mentioned, it is unlikely that an individuals' Bitcoin holdings could be insured (at a reasonable price) unless they are held by a trusted custodian. These custodians can obtain insurance because they have the controls, audit procedures etc in place, which can be verified by the insurer and meet the same standards as a traditional financial institution.

Let me know if you have any questions.

[Dabs]

Once upon a time, there was an idea for something along the lines of an offshore paper wallet service.

It wasn't insured, but you had to pay a small fee to essentially have that third party keep the private keys. (By offshore, I believe is meant that it is physically located away from the US.)

Dunno what happened to that, but I was (hopefully) going to be one of the "keepers". My requirement to release your coins was maybe a video chat, or an actual visit (come fly to my country), as well as providing as much information as possible that you are who you say you are: signed messages, gpg, 2 factor, ID...

I'd basically act as librarian. I'll keep your "book".