4 ms·

I've been hand-verifying the transactions so far to try to keep abreast of fraud. I've also taken some automated steps (that I'm improving now). I've been read

I've been hand-verifying the transactions so far to try to keep abreast of fraud. I've also taken some automated steps (that I'm improving now). I've been reading quite a bit about the money transmitter stuff, but I'd appreciate your take on why this would be categorized.

patio11 13y ago
You should know that being a money transmitter is an exceptionally risky and time-intensive business to be in even if one is not "categorized as" a money transmitter. Even if the government ignores you, criminals will not. You are currently betting that your fraud prevention expertise is better than every criminal's fraud execution expertise. You will likely not win that bet. Do you understand that your adversary here has twenty people who are smarter than you and have years of experience on his payroll? I am not exaggerating in the slightest. Breaking your system wide open will not be his side project. It is his core line of business. You will just be a juicy target of opportunity, to the extent that you have worthwhile volumes. Note that four figures is already worthwhile. As for the regulatory side of things, I'll pull you the exact citations when I get back from (ironically) a coffee run.
- mhluongo 13y ago
  Ha, thanks, I'm looking forward to the docs. Re: fraud I've definitely been disillusioned that I can handle the tide myself, but OTOH I imagine fraud prevention is a lot like security- make sure the wall is higher than the water. I'll just have to figure out how to do that in a way that's safe, economical, and keeps the core idea behind the service working. It will almost certainly involve hiring people, or cutting off the influx of business down to- say- 5 cards a day.
  - patio11 13y ago
    Here you go: http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&sid=d5570d7646c5fc13fe1fa42a61d1dcf1&rgn=div5&view=text&node=31:3.1.6.1.2&idno=31#31:3.1.6.1.2.1.3.1 http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&sid=d5570d7646c5... [(5) Money transmitter (i) In general. (A) A person that provides money transmission services. The term “money transmission services” means the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means. “Any means” includes, but is not limited to, through a financial agency or institution; a Federal Reserve Bank or other facility of one or more Federal Reserve Banks, the Board of Governors of the Federal Reserve System, or both; an electronic funds transfer network; or an informal value transfer system; or (B) Any other person engaged in the transfer of funds.] You unambiguously accept other value which substitutes for currency from one person. You equally unambiguously transfer value to another location or person, under multiple legal theories: a) the Starbucks card is one location, the Bitcoin account is another, b) the person holding the card and the bitcoin account may be different parties, c) your business operates as a transport layer between your customers and the company which you are unloading thousands of dollars of Starbucks cards on, and as those are different persons, that means you are transmitting that value. You might think "But wait, FinCEN narrowed the regulations a bit for 'sellers of prepaid access' specifically to avoid overburdening them." Great news for Starbucks, bad news for you. You are not a seller of prepaid access, which you can verify by reading pg 45403 on of the Federal Register. http://www.gpo.gov/fdsys/pkg/FR-2011-07-29/pdf/2011-19116.pdf http://www.gpo.gov/fdsys/pkg/FR-2011-07-29/pdf/2011-19116.pd... You are, instead, using Starbucks cards and Bitcoins as a transport layer for value. The government is astoundingly non-neutral about that choice of business.
    - 0xdeadbeefbabe 13y ago
      But this is so general that lots of business would fit. A bitcoin pool ambiguously, perhaps, transfers value too. Why are they so non-neutral about this, and does it help us that they are?
      - domdip 13y ago
        It's not about transferring value - it's about substituting currency-equivalent value. What's the substitution going on in a mining pool? (And don't say electricity for coin, electricity is not valued similarly to a currency. Similarly 'claim on mining output'.)
        0xdeadbeefbabe 13y ago
        Well it's a step up from electricity at least. The currency equivalent value is securing the chain of BTC transactions and discovering new blocks, making the system work at all. New blocks have a currency equivalent value and doing transactions has a currency equivalent value too.
      - dreamdu5t 13y ago
        Lots of businesses fit, but only ones with cash to take or political points to score will be targeted.
        gamblor956 13y ago
        Politics and money has nothing to do with it. Patio11 only posted an excerpt of the rules. Most businesses which fit this excerpt are excluded by portions of the rules not posted here but which are contained in the link. For example, those exceptions are why retailers who sell gift cards are not treated as money transmitters.
        0xdeadbeefbabe 13y ago
        It reassuring to hear the rules make sense when you put them all together, but I still wonder if they are good rules. What is your take on it?
JumpCrisscross 13y ago
Your adversaries have experience making illicit transactions appear benign to trained eyes. Assume money laundering will happen on your platform. Your priorities are (1) being in compliance with all applicable money transfer laws, e.g. registration and (2) working, within the confines of those laws and industry best practice, to minimise its frequency. Today, if your service were to be used to launder money I believe you would be looking at asset forfeiture and jail time. That said, I think this business can be run profitably in a compliant way - it just takes planning and some expertise.
gamblor956 13y ago
You need to talk to a lawyer ASAP. Patio11's cites can help you with the background, but if your business is taking off, you need to square it with the legal side of things before the feds come knocking.
- mhluongo 13y ago
  I'm definitely just wanting background- I don't think I'm a lawyer.
Pyramids 13y ago
I can't give you any input on the legal side of things, however I commented on a thread about 6 months ago regarding gift card fraud[1] and the assumption that it's a new phenomenon. With gift cards, especially Starbucks gift cards, it's almost (if not literally) impossible to verify legitimacy. Generally, almost anyone attempting this type of fraud, even at the lower levels will: - Mask the fact that funds are loaded with credit cards in the transaction log by purchasing gift cards with gift cards. - Use services[2] which sell residential IP's by location (infected systems) as proxies Unfortunately for the service your offering, Starbucks has an internal chain-disable feature which deactivates any gift cards "downline" of a fraudulently loaded card, hence it's entirely possible that after conducting a card transfer, even one fraudulent transfer could put the entire balance of your legitimate holding account at jeopardy, and the average Starbucks call center representative will be unable to help you. Services like Cardpool (also offered in-store at Safeway locations) verify individuals identities prior to cash-in, however even with that the amount of fraud they experience is staggering. To give you an idea, the rate of successful, fraudulent transactions experienced by Cardpool in Safeway stores for 2012 was over 20%, compare to the average chargeback rate on an adult site, which is between 0.5 and 2% I think you've made a smart move to put your project on hold until you have a better grasp of the entire situation. [1] https://news.ycombinator.com/item?id=6175294 https://news.ycombinator.com/item?id=6175294 [2] http://5socks.net/ http://5socks.net/

patio11 13y ago

You should know that being a money transmitter is an exceptionally risky and time-intensive business to be in even if one is not "categorized as" a money transmitter. Even if the government ignores you, criminals will not. You are currently betting that your fraud prevention expertise is better than every criminal's fraud execution expertise. You will likely not win that bet. Do you understand that your adversary here has twenty people who are smarter than you and have years of experience on his payroll? I am not exaggerating in the slightest. Breaking your system wide open will not be his side project. It is his core line of business. You will just be a juicy target of opportunity, to the extent that you have worthwhile volumes. Note that four figures is already worthwhile. As for the regulatory side of things, I'll pull you the exact citations when I get back from (ironically) a coffee run.

mhluongo 13y ago
Ha, thanks, I'm looking forward to the docs. Re: fraud I've definitely been disillusioned that I can handle the tide myself, but OTOH I imagine fraud prevention is a lot like security- make sure the wall is higher than the water. I'll just have to figure out how to do that in a way that's safe, economical, and keeps the core idea behind the service working. It will almost certainly involve hiring people, or cutting off the influx of business down to- say- 5 cards a day.
- patio11 13y ago
  Here you go: http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&sid=d5570d7646c5fc13fe1fa42a61d1dcf1&rgn=div5&view=text&node=31:3.1.6.1.2&idno=31#31:3.1.6.1.2.1.3.1 http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&sid=d5570d7646c5... [(5) Money transmitter (i) In general. (A) A person that provides money transmission services. The term “money transmission services” means the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means. “Any means” includes, but is not limited to, through a financial agency or institution; a Federal Reserve Bank or other facility of one or more Federal Reserve Banks, the Board of Governors of the Federal Reserve System, or both; an electronic funds transfer network; or an informal value transfer system; or (B) Any other person engaged in the transfer of funds.] You unambiguously accept other value which substitutes for currency from one person. You equally unambiguously transfer value to another location or person, under multiple legal theories: a) the Starbucks card is one location, the Bitcoin account is another, b) the person holding the card and the bitcoin account may be different parties, c) your business operates as a transport layer between your customers and the company which you are unloading thousands of dollars of Starbucks cards on, and as those are different persons, that means you are transmitting that value. You might think "But wait, FinCEN narrowed the regulations a bit for 'sellers of prepaid access' specifically to avoid overburdening them." Great news for Starbucks, bad news for you. You are not a seller of prepaid access, which you can verify by reading pg 45403 on of the Federal Register. http://www.gpo.gov/fdsys/pkg/FR-2011-07-29/pdf/2011-19116.pdf http://www.gpo.gov/fdsys/pkg/FR-2011-07-29/pdf/2011-19116.pd... You are, instead, using Starbucks cards and Bitcoins as a transport layer for value. The government is astoundingly non-neutral about that choice of business.
  - 0xdeadbeefbabe 13y ago
    But this is so general that lots of business would fit. A bitcoin pool ambiguously, perhaps, transfers value too. Why are they so non-neutral about this, and does it help us that they are?
    - domdip 13y ago
      It's not about transferring value - it's about substituting currency-equivalent value. What's the substitution going on in a mining pool? (And don't say electricity for coin, electricity is not valued similarly to a currency. Similarly 'claim on mining output'.)
      - 0xdeadbeefbabe 13y ago
        Well it's a step up from electricity at least. The currency equivalent value is securing the chain of BTC transactions and discovering new blocks, making the system work at all. New blocks have a currency equivalent value and doing transactions has a currency equivalent value too.
    - dreamdu5t 13y ago
      Lots of businesses fit, but only ones with cash to take or political points to score will be targeted.
      - gamblor956 13y ago
        Politics and money has nothing to do with it. Patio11 only posted an excerpt of the rules. Most businesses which fit this excerpt are excluded by portions of the rules not posted here but which are contained in the link. For example, those exceptions are why retailers who sell gift cards are not treated as money transmitters.
        0xdeadbeefbabe 13y ago
        It reassuring to hear the rules make sense when you put them all together, but I still wonder if they are good rules. What is your take on it?

JumpCrisscross 13y ago

Your adversaries have experience making illicit transactions appear benign to trained eyes. Assume money laundering will happen on your platform. Your priorities are (1) being in compliance with all applicable money transfer laws, e.g. registration and (2) working, within the confines of those laws and industry best practice, to minimise its frequency. Today, if your service were to be used to launder money I believe you would be looking at asset forfeiture and jail time. That said, I think this business can be run profitably in a compliant way - it just takes planning and some expertise.

gamblor956 13y ago

You need to talk to a lawyer ASAP. Patio11's cites can help you with the background, but if your business is taking off, you need to square it with the legal side of things before the feds come knocking.

mhluongo 13y ago
I'm definitely just wanting background- I don't think I'm a lawyer.

Pyramids 13y ago

I can't give you any input on the legal side of things, however I commented on a thread about 6 months ago regarding gift card fraud[1] and the assumption that it's a new phenomenon. With gift cards, especially Starbucks gift cards, it's almost (if not literally) impossible to verify legitimacy. Generally, almost anyone attempting this type of fraud, even at the lower levels will: - Mask the fact that funds are loaded with credit cards in the transaction log by purchasing gift cards with gift cards. - Use services[2] which sell residential IP's by location (infected systems) as proxies Unfortunately for the service your offering, Starbucks has an internal chain-disable feature which deactivates any gift cards "downline" of a fraudulently loaded card, hence it's entirely possible that after conducting a card transfer, even one fraudulent transfer could put the entire balance of your legitimate holding account at jeopardy, and the average Starbucks call center representative will be unable to help you. Services like Cardpool (also offered in-store at Safeway locations) verify individuals identities prior to cash-in, however even with that the amount of fraud they experience is staggering. To give you an idea, the rate of successful, fraudulent transactions experienced by Cardpool in Safeway stores for 2012 was over 20%, compare to the average chargeback rate on an adult site, which is between 0.5 and 2% I think you've made a smart move to put your project on hold until you have a better grasp of the entire situation. [1] https://news.ycombinator.com/item?id=6175294 https://news.ycombinator.com/item?id=6175294 [2] http://5socks.net/ http://5socks.net/