How Credit Card Fraud Sank One Bitcoin Exchange

rsz_shutterstock_836463
13 January 2015

One of the biggest problems for bitcoin exchanges and their customers is often making the exchange quick and easy. Exchanges like Canadian firm Virtex made the decision a long time ago not to accept credit cards. Their biggest concern? Fraud, in the form of chargebacks.

In a credit card chargeback, a credit-card paying customer asks the issuing bank (the bank that gave them the card) to reverse a transaction made with a merchant.

This can happen for a variety of legitimate reasons. A merchant may not have delivered the promised goods or service, or it may have been faulty. In some cases, a card may have been stolen and used without the owner’s consent.

Sometimes, however, the owner of the card perpetrates their own fraud, by trying to reverse a legitimate financial transaction. It’s effectively a pre-blockchain version of double spending. This can happen a lot on the Internet, where companies are dealing with large numbers of unknown customers half a world away.

Chargeback target

This happened to Joey Rich, who found himself at the wrong end of a steep learning curve in 2010.

Having purchased some coins, he began selling them at a profit. He lost his initial investment of $9,000, though, after his bitcoin exchange, BuyBitcoins.com, suffered a series of chargebacks from stolen credit cards.

He explained that a combination of lost credit card revenues and chargeback fees led to a loss of his funds.

Rich said:

“For chargebacks, credit card companies charge fees of $25 to $35 in addition to the reversal of the original payment as a deterrent. So I also got hit with a huge number of those $35 fees, which is especially painful on orders of $5 to $10. As my my bank account went into the red, I started getting hit with overdraft fees as well, so it was quite a fiasco.”

Aside from the lost revenues, one of the nasty side effects of chargebacks is that credit card processors keep score. Too many chargebacks raises flags against your account. Eventually, his account was terminated, and Rich was added to a blacklist.

“I didn’t really know anything about credit card processing back then, and didn’t understand how reversible those payments are,” he admitted.

To make matters worse, he explained that the credit card processor hadn’t deposited the original $9,000 into his account in the first place, due to an administrative error. That didn’t stop them withdrawing $7,000 in chargeback transactions and fees, though, putting him in deficit and incurring even more charges in the form of overdraft fees.

It took him a year to sort it out and limp away with some money. In the interim, he had closed the exchange down while he figured out a way to handle credit cards more effectively.

In 2012, Rich reopened the site, this time with identity verification features, including options for users to upload a scan of their driver’s license, to log in with their Facebook account, and to be geolocated using HTML5 in the browser (which he claimed is far better than geolocation by IP address).

Successful completion of all these tasks contributed to a trust score, which would help to decide whether a user’s order was processed or not.

At this point, Rich was using a different credit card processor.

He said:

“Those identity verification requirements helped me to do much better, and I reached about $45,000 in sales in the month of May 2013. However, about $4,500 of those were charged back, resulting in the termination of that account.”

The chargeback minefield

Clearly, credit card processing for merchants is harder than it looks. The rewards are ease and convenience, though, and depending on the customer demographic, are simply too tempting for some exchanges to resist.

CEX.io will happily take your credit card payments in exchange for bitcoin, confirms CIO Jeffrey Smith.

“Credit card transactions are the fastest and most popular mean of payment. In order to go mainstream, an exchange has to have a credit or debit card deposit/withdraw option, among other payment methods,” he said.

The processing fees for credit cards makes them financially suitable for transactions up to $1,000, Smith indicated. After that, other mechanisms may be preferable. Wire bank transfers are good for larger amounts, but the process may take up to 10 days, he said, making it less than ideal for shorter-term investments.

Smith claims that the firm has lost no money at all on chargebacks. “We avoid chargebacks by working only with the credit or debit card providers who use 3D Secure. This layer of security enables us to reduce risks of chargebacks,” he explained.

3D Secure, which readers may know as ‘Verified by Visa’ or MasterCard SecureCode, requires a form of identification by the issuer, in addition to the merchant.

Alternative methods

Others are less trusting. One exchange CEO, who preferred not to be named, said that his demographic made it acceptable not to accept credit cards.

“When you’re dealing solely with SWIFT wire transfers, as we do right now, one of the biggest benefits is that they’re irreversible. Fraud isn’t one of our worries. Something like that is more attractive to a more B2B business-focused exchange like us.”

Burned by his credit card experiences, Rich now has another method of taking payments for bitcoin: PayPal. Customers paying via that service are now sent ‘bitcoin gift cards’, which are effectively paper wallets that he sends out by mail.

He said:

“I left the identity verification features in, but made them less important, since security lies mainly in physical delivery of the cards. I have been accepting an average of around $3,000 in sales per month, and have not lost any money to chargebacks yet. However, I refund quite a few payments that either look suspicious or are delivered to an address where they are never redeemed.”

Rich delivers the service, started in August 2014, through his BitcoinGiftCard.org site. The PayPal service costs about 4% in fees, which is “irritating”, he said, as it’s higher than those asked by the credit card companies.

Passing on the risk

Another site, Brawker, has an ingenious solution for avoiding chargeback fraud: let conventional ecommerce players deal with it. Cyril Houri, who founded the site a few months ago, explained that it matches people wanting to buy bitcoin with those wanting to spend their bitcoin through non-bitcoin merchants online (see CoinDesk’s review of the service here).

If Bob wants to buy a $200 DVD player from Amazon, but wants to pay for it in bitcoin, then he can publish that fact on Brawker. If Alice wants to buy $200-worth of bitcoin, she can bid for that order. If her bid is accepted, she then buys the goods in fiat currency, giving Bob’s address. Bob then sends the bitcoin to Alice after she sends him proof of purchase.

It’s effectively an exchange order book built atop online sales of other products.

The upside of this model is that the ecommerce provider handles any chargeback issues. If Alice decides to declare a chargeback on the DVD player, that’ll be Amazon’s problem (or Best Buy’s, or John Lewis’s, or whichever merchant is being used).

Houri’s company doesn’t even have a credit card merchant account. It has a bank account to pay expenses, but that’s it.

“You have the benefit of using the ecommerce infrastructure,” he said, arguing that the delivery of physical goods via ecommerce is often faster online than sending money via traditional methods. “Being able to piggyback on that makes it as convenient as possible.”

There is some inconvenience, though. Alice can only buy bitcoins in the quantity that Bob – or anyone else on the other side of the order book – wants to spend them. That makes it hard to buy exactly the number of bitcoins that she wants.

Houri said:

“With traditional exchanges, the commodity at the other end is fungible. In our case the commodity is a physical good. It’s someone who wanted to buy a hat, and in the other end it’s someone that is prepared to buy that hat’s value in bitcoin.”

Even Brawker is exploring stronger client verification, though. After all, any form of taking Internet payments is an exercise in risk. The more than you can decrease the risk, the better.

Credit cards may have their advantages when it comes to bitcoin purchases, but they also have their drawbacks. What’s interesting is how entrepreneurs try to route their way around them. On the Internet, it’s innovation that abhors a vacuum.

Disclaimer: The views expressed in this article are those of the author and do not necessarily represent the views of, and should not be attributed to, CoinDesk.

Credit card image via Shutterstock