Topic: Beware, MtGox arbitrarily freezing verified accounts (Read 40385 times)

Getting GOXXXED 101.

Step 1.  Start by using MTGOX

Step 2.  Wait...

Congrats!  The predictable has come true!  You've been GOXXXED!

There is a wealth of negative stories about Gox.  Meanwhile there are plenty of other services without problems.  Soooooo...

Hmmmm...kind of confusing that people STILL use Gox and STILL complain about it.

How could anyone think it is possible to "steal" a domain name by registering a trade mark ?
This is both defamatory and insulting.
By the way, mt gox registered the trademark first. Our registration in some classes is to prevent troll registration and trolls in general to use the bitcoin name. It's also to go against the stronghold that mt gox is building on bitcoin.

Yes the bitcoin.fr is wasted by the current owner who is describing bitcoin on the home page as follows:

"On reproche à juste raison à cette monnaie d'être une aubaine pour les mafias : pas de trace, pas de contrôle. "

Translation:
"This currency has been criticized rightly to be a boon for the mafia : no trace, no control."
I am not talking about the wbesite design that would make any mt gox website design look good.

Yes this is problematic for the adoption of bitcoin in France because anyone googling bitcoin in France will get this page FIRST.

So I confirm: we (Paymium) would like to convince the current owner to sell it or otherwise hand over the control to the Foundation.


Mr Karpeles, your unjustified, reiterated accusation does not bode well for your tenure of the board seat you purchased at the bitcoinfoundation.
In my view you do not belong in the Bitcoin Foundation because your dominant market share among exchanges is a threat to the decentralization of bitcoin.
You intend to take over the bitcoin.fr domain like a white knight to further your own interests: that's why you do not hesitate to denigrate your competitors with false accusations.

Let's simply say that they do not have my goods.

I've taken the liberty of boldfacing and underlining the part where your problem is.  By complying with these intrusive instruments of state coercion you feed the beast, and thus lose any sympathy I otherwise naturally would have had for a fellow bitcoin user.

Boycott these jackboot licking business, or you deserve all the negative consequences resulting from your embrace of the Money Nazi regime!

Sounds like you 'accepted' and 'put up with' what Mt. Gox coerced you into and it doesn't matter what you do now; they got your goods.  Unless you managed to pass them fake info I guess.

The interesting thing is that Mt. Gox has shown no interest in defending or explaining their practice especially in contrast with PayPal who seem to not need to hold funds hostage.  I guess it makes some sense in that they tower over all other exchanges and are likely to indefinitely. If Mt. Gox is generous with the info they gather, the whole Bitcoin system is potentially perhaps the biggest honey-pot on the net for marking up people with 'interesting' things going on.  Actually, it may be second to tor...but that's just a suspicion of mine...time will tell.

To all the people who have been burnt in this manner, thanks for the heads up.  Really!  Not sure if I would have found the fine print on Mt. Gox's site before attempting to get some fiat out of my BTC speculation through them or not since I have not dug around to date.  Doubt it.

Goxxxed.

Again and again and again.

Yet they yearn for more goxxxing.

GOXXX on GOXXX on GOXXX.   

For what it's worth... MtGox froze my funds a while back and demanded scanned ID and utility bill. I obtained a scanned ID and utility bill, uploaded them, got my funds out and have never logged in there again.

On another topic, not entirely unrelated: If you want to use Gox etc. and want a hard to trace IP address, a cheapo prepay mobile phone jacked into a laptop would seem to be the way to go. No need to mess with proxies, just throw the sim chip away and buy a fresh one every time the credit expires. Pay cash at a market stall rather than buying in a supermarket full of CCTV...

Back to Gox: I don't mind if someone, individual or company, decides not to do business with me. That choice is theirs to make, but I'll be damned if I will put up with anyone taking my cash (whether USD BTC GBP EUR or any other) then refusing to return it until I jump through hoops. I would accept them closing my account and returning funds. I will not accept them holding funds to ransom.

When I want to trade BTC to/from fiat these days I use localbitcoins.com. Maybe I don't get quite the same rate, but I'm willing to cope with that in return for the simplicity of a cash transaction, and have as a bonus some occasional fun moments (like when the other party chose to wear a mask while meeting to trade - awesome! I bought Bitcoins from a guy wearing a Guy Fawkes mask)

You mean the information MtGox *claims* is AML/KYC information. I've asked MtGox a few times to provide any evidence that they actually require this information for AML/KYC purposes and have never gotten a reply. Bluntly, I don't believe it. I think it's much more likely that they want this information for anti-fraud purposes.

There was a reason I left Mt. Gox soon after I joined. Now I keep my funds in my own wallet. I have no wants to cash out right now, so it works for me.

This says it best. If you wish to use MtGox get verified and provide the AML/KYC information. Otherwise there may be problems. Personally I went through the verification process first before depositing any funds there, and have had no problems.

My discussion with mtGoxx support is approximately the same.

When i saw that the account was empty i checked the withdraws and noted the time of the withdrawal.

Asked mtGoxx for information about logins (because i knew i didnt log in at the time of the withdraw).

Got a list with login's (no IP's) and the list showed that no user was logged on at the time of the withdrawal.

Asked mtGoxx how this could happen and for IP's of the logins.

And all of a sudden i start to get the same answer on every question.
- We only talk to the police.
- Upload your scanned ID and the police report.

If someone "lost" 380 of my bitcoins and refuse to tell me how it happened i sure as hell wont give them my ID.

They claim they cant reimburse me coz i it might attract scammers, and they cant be sure i didnt transfer them out.

LOOK AT YOUR OWN LOGS YOU SENT ME.

I WAS NOT LOGGED ON. and noone else was logged on either....

Sorry for the caps, still get irritated about this.
I think i will scan the police report on monday when i get back to work.

see here for another example of the same shit :


[Mtgox sux - chat logs pasted] - https://bitcointalksearch.org/topic/mtgox-sux-chat-logs-pasted-109391

tux,

just out of curiosity, do you have any actual, legal responsibility to tax authorities outside of japan?

Mtgox, is not to be trusted, my account got emptied by "someone".

MtGox logs says that noone was logged in at the time of the Withdrawal (their logs).


https://bitcointalksearch.org/topic/mtgox-account-hacked-lost-2k-usd-mtgox-will-not-explain-how-89142

The only answer i get is "we only talk to the police".


If noone logged on, they got hacked or stole my cash.

I shouldnt be blamed if my usename/pass wasnt used.

For all the carrying on about how convenient Bitcoin is and how illiquid gold is, I was able to use Krugerrands to solve a cash flow issue with a little planning and part of a day of visiting a couple of institutions.  I also did not need to provide someone who individually and as a group has a severely hampered record of data security with all of the info a hacker could dream of wanting in order to steal my identity.  I think I let my coin dealer transcribe some info from my DL was all it took.

I'm hanging onto my BTC until such a day as it is commonplace to do Bitcoin transactions face to face, though they are useful today for charitable giving and for purchasing certain services.  The exchanges are for buying BTC...until such time as they require more info than I want to entrust with them for doing so.

In order for me to get verified, I had to send in my photo id and a utility bill. This was after I already had the yubikey...

Sounds like all you have to do is send in the dox that they want and everything will be fine. Just sucks that this happened right at the time you needed to cash money out.. That happened to me when I had to get authenticated, I was mad too..

Certain of us are looking forward to an official description of the rules so as to lend strength to various interpretations, and understand more precisely which requirements are likely mandatory to solve what problems, and which seem to be more along the lines of general information harvesting from a user-base who's balls are in an opportune orientation for squeezing.

Of course Mt. Gox (or any other service provider) does not have any requirement to be open with this information and/or their interpretation of it.  But, OTOH, customers are under no obligation to be customers...or customers fitting into a particular service category...either.  As I mentioned earlier, simply attempting to stop being a customer of Paypal brought the requirements down from 'onerous and extensive' to 'trivial'.

EDIT: addition:  I might add that Paypal allowed me to withdraw all of my funds to my linked bank account.  I simply could not add money until our issues were worked out.  I thought this fair as it allowed me to remain whole financially without divulging information which I preferred reamin secure (to my standards.)  Whether I would have had to provide the scanned photo-ID before terminating my zero-balance account I don't know since we didn't get that far.  Locking all of the funds would have been an entirely different matter.  I would consider it theft and would have taken whatever action I thought appropriate.  I don't know what pressures Tradehill was experiencing near the end, but I do know that they mailed me a check for the balance in my account (around $1500 iirc) without any requirement on my part to provide additional information over and above what I had needed when I built the balance in the first place (which I did exclusively through wire transfers.)

Having something sent mailed to an address is not = 'proof of residence'. That requires a bill or other such 'official' material mailed to that address with your name on it.

I know the whole thing sucks, but it is what it is. Your interpretation of the rules does not change them unfortunately.

Ok, got it

I don't think they tell you this, but you have to e-mail them for a limit increase - specifying what you want your limits to be.

Strange things happening at mtgox lately. My account is verified with different withdrawal limits

http://imgur.com/a/FhfF9

Not that I don't believe you, but is there any evidence or proof you can provide of this claim? I suspect, and I think a lot of other people suspect this too, that it's actually an anti-fraud requirement and not an AML requirement. And the difference is very significant.

That's normal MT edited his post afterwards to add this, maybe because he felt like somehow diverting the thread from the actual issue at hand was necessary.

Right now bitcoin.fr hosts an ad-ridden crappy blog with the last post being months old, see for yourself.
We felt that the French public deserved a better introduction to Bitcoin than a placeholder site waiting for the domain value to go up.

And so yes, we wanted bitcoin.fr to redirect to a french version of bitcoin.org.

The full e-mail exchange is here, judge for yourself.

A couple of highlights :


Either way this is way off-topic, if there are any questions about this please make another thread, I'll happily comment there.

We take full responsibility and stand by our actions. It would be nice to see a bit less mudslinging and a bit more responsibility from a commercial company handling my passport scans. (Read: acknowledge a sub-optimal data migration and unfreeze my account after digging in the AML archive for thirty seconds, if necessary reduce the withdrawal limits to those of an unverified account).

I had missed this.
Is this serious, davout? You people from Paymium tried to take over the bitcoin.fr domain by registering a trademark?

Good advice on the preference for p2p.  Person-2-Persons is what I prefer when it can be arranged, and that's probably the way I'll try to liquidate much of my Bitcoin, again if/when I choose to do so.

The photo-ID thing is pretty weird and I don't like it.  Next it will be DNA samples I suspect.  That the US state department was instructing their personal to obtain DNA samples of foreign dignitaries is actually pretty interesting.  A risky move which I suspect would not be undertaken without significant expectation of a specific use for the data.

  http://www.wired.com/dangerroom/2010/11/u-s-chases-foreign-leaders-dna-wikileaks-shows/

But back to Paypal, in spite of their spiel about the government is requiring blah, blah, blah, in the end they let me pass by speaking 13 numbers into a phone.  So it seems to me that Paypal, at least, is going above and beyond the minimum requirements on the part of the US government.  The extra data they are collecting must be of some value I guess, or maybe they are just being proactive.  One wonders exactly what the minimum requirements Mt. Gox needs to meet are and if they are gathering extra data as a target of opportunity.

and she entered it into the same DB you refused to put in in the first place. Only difference is you now comminucated it to some $7/hour slave. Yah, you're definitely better off now  . Mtgox is cancer, paypal is slightly better but still shit. Do everything you can to p2p transfer.

As a person who trusts more funds with you through Instawallet than is normally my nature, I have a keen interest in how you handle the various affairs that you are involved in.  I was hoping for a more detailed response on this one.

Separately, I'm sorry to see the Mt. Gox is fucking with you.  It's not crystal clear if 'not legit' is defined as something which Mt. Gox can use as an excuse to take your money or what, but I am interested on an academic level.  I had already planned on exploring alternates if/when I decide to cash out (of Bitcoin) in a significant way, but this goes some distance toward solidifying my plans.

As a vague aside, I got my issues worked out with Paypal so I'm probably going to go back to using them as usual...the memory of what they did to Wikilieaks becoming dim and easier to palate...  Paypal wanted my SSN card, proof of residence, and a photo ID.  The latter is a no-go since I don't trust them not to sell it to the highest bidder (esp, the NSA) or have if ripped by hackers..and to trust Paypal's security engineering significantly more than Mt. Gox's.  Anyway, as usual, Paypal's site would not let me do what I wanted to do so I called.  The lady took my DOB and SSN over the phone and said that everything is now cool.

Will do next time.

Oh sorry then, I guess my withdraw limits magically went to those of a verified account, see previous screenshot. Or your very own DB if you don't trust me.

This must be some kind of joke. When I trade on your platform I don't find it practical to pay fees, can I skip that ?
We all pay to use mtgox, in exchange we all expect some level of service, part of that would be that when you migrate a system, you migrate the data that goes with it even if it's "not practical".

Fine, I have no problem with that. Just don't lock down my account, give it unverified withdrawal limits if there are documents missing.

Again, my limits say otherwise, and I didn't get notified of anything related to having to submit additional documentation.

Pathetic.

I'm just quoting the most interesting part to be able to find it faster in the future.

Well, I guess it might be enough to say you've tried your best using all technology available. MtGox does try to ban anonymous proxies, for example. There's that casino which makes lots of effort in trying to forbid USA players, by blocking IPs of proxies too. But of course, both may eventually let something pass. Even the GFW of China has its holes.

If such restrictions are enough to get MtGox labeled as "cooperative" by IRS/FBI/whatever, then they're good.

It must be tough running a service that everyone wants a piece of. :-)

-p

Found the IRC message in the log, but could have been better by email.

Anyway your account shows no trace of ever being verified. This said if you "verified" using the very old method of sending docs by email to myself, it actually has no effect for two reasons:

• We created the new process because sending documents by email is only secure if all relaying MX servers are trusted and support SSL, and because of the large volume of emails we received. However when creating the new system is was not practical to manually go through all those emails and transfer the data to the secure storage.
• Because of AML requirements, we need an utility bill or any other proof of home address (having received a yubikey is not acceptable).

.
Also should be noted that the old MtGox system did not track users' verification status, causing all verified status to vanish when the switch was done in June 2011. Users were invited to re-verify at that time. If you didn't, then it means your account was not verified, and as such can end needing to be verified if specific conditions are met.

It should also be noted that we are actually required to require AML data from all customers, but allow use of the service anyway as long as we don't see anything that could be suspicious (in case of fraud we end paying if we don't have any aml data). "Suspicious" is defined as anything that has been known to be done by hackers. This includes accessing multiple accounts, using proxies, etc...


Also an extra note:

Paymium, I remember seeing that in my mailbox... Yep, the guys who registered a "bitcoin" trademark in France to steal the bitcoin.fr domain. Hope now they know that no, it's not "legit" to register a trademark for the purpose of taking over a domain name.

09:38 < phungus> damn, fail... https://bitcointalksearch.org/topic/beware-mtgox-arbitrarily-freezing-verified-accounts-105638
09:38 < Title> [ Beware, MtGox arbitrarily freezing verified accounts ]
09:39 <@MagicalTux> phungus: just checked, his account is not verified, and was never verified


Davout, looks like they don't think you are verified.

-p

Last response from the support :

My answer :
 - My account is verified
 - You have a copy of my passport
 - You sent a Yubikey to my home address
 - My account didn't go to an "Unverified" state, it went to "Fully locked". Right now I can not withdraw even a single bitcent.

If you want to somehow unverify my account because the documenation I submitted isn't enough anymore then fine, but take me to "Unverified", not "Locked down".

Additionnaly if there are additional verification requirements since September 2011 you should have notified me in advance, let me decide whether I wanted to comply or take my business elsewhere. But CERTAINLY NOT freeze my account and lock my funds without any kind of police report or accountability.

I do not think it is bad to have stringent AML requirements, it's even necessary. But the way they are implemented in my particular case is not acceptable. I refuse to see my money frozen arbitrarily and instantly.

The minute my account becomes unlocked I will repost my documentation because I'm willing to comply with the AML requirements. What I do not accept is the "locked funds" way of bullying people.

See my withdrawal limits to check that my account was indeed verified :

If multiple accounts access from different IPs, they also can't know whether it's the same individual or not. So detecting account accesses from the same IP seems kind of pointless.

I still think this is pretty boneheaded, but not as boneheaded as what they actually do. There are still many small ISPs whose clients *all* share a single public IP.

Still getting the third party thing down...

It's funny how often the expression "for your own security" is used as a justification for actually screwing you somehow. Even MtGox guys can't avoid using the rhetoric. (nothing personal, MtGox folks... but you could be more direct and frank about stuff, people here would understand )

This has nothing to do with security.
They have to be sure a given individual does not trade more than a small threshold, in order to catch tax evaders. It's not there to protect you or to catch actual criminals.
If multiples accounts access from the same IP, they can't know whether it's the same individual trying to trade more than the threshold, or if they're multiple individuals.

They could, though, sum the amounts transfered by all unverified accounts using the same IP and only block them when the total unverified amount passes the threshold. Verified accounts, as davout's, should not be frozen because an unverified account used the same IP.

Is this for the security of users? Or is it required by any regulations (directly or indirectly)?

If neither is true, Mtgox should consider removing this feature. Just my opinion 

+1
I can see very little justification for keeping this 'security feature'. If somebody was hacking accounts I doubt they would do it from one IP anyway. Unless the real reason for this feature is to prevent users from setting up multiple accounts?

I think a few moments reflection will show that freezing a verified account because an unverified account connected from the same IP address is a massive security fail. In my fantasy world where you always do the right thing, you'll audit all your security practices once you realize that you let one this boneheaded slip through.

If anything it is the unverified account that should be made to verify. Accounts that are already verified should not be frozen just because the same IP address is used by another account.

Having said that, using the IP address as a sole criteria for this trigger is pretty stupid. I hope MtGox is using other criteria as well, such as type of IP address (residental, corporate) as well as browser/OS finger printing.

I even know of entire companies that share one IP for several thousand employees. At the same time it's pretty easy to avoid using that IP if you want to, so this security feature will probably only stop the people that are doing nothing wrong.

I suspect the only reason that this 'security feature' is even remotely practical at the moment is the sheer isolation of most bitcoin users.

Many offices/households share an IP and quite a few even share a particular machine for browsing.
I can see this being a major pain when I  get colleagues/family more interested in this thing.

Does that mean I'll have to get through this each time someone in my office building creates a mtgox account? That sounds like a really useful security feature :|

What is definitely is arbitrary is the bullying. Just because you can freeze my account doesn't mean it's ok to do so as an answer to everything that can happen. Especially when the account is verified, and is protected by a yubikey that you sent to my home address.

I haven't had issues with a different person in my house also using MtGox on the same IP. He hasn't even had to verify his identity with them to trade, while I have had to. Our accounts were registered on different IP's, though.

Hi

Sorry to hear about your problem and while I cannot comment on it at this time we will check this matter and hope to get a solution to your problem one way or another.

[EDIT]Oh and not, this is not "arbitrarily" at all, havind different account with one not being verified sharing the same IP will trigger such verification. This is simply a basic security feature.

Regards

I think the customer service itself is ok they're nice and, in my experience, quite responsive.

It's the rule that's being applied that just doesn't make any sense.

Let's even say it's ok to auto-freeze accounts when you detect that the same IP connects to them. In this case the support should simply unlock the accounts when they get the full story : "Oh, you actually have accesses to multiple legitimately verified accounts from the same IP, one is the corporate account, the one is your personal one ? I understand, I'll unlock them for you right now. Have a beautiful day fine sir!"

Mtgox costumer service at it's finest

so if two different accounts are accessed via the same IP, it is a reason to freeze them? 

So here's what happened :
 - was minding my own business, playing around MtGox's API's
 - tried to withdraw some USD as an MtGox code,
 - failed and got answer "Your account is pending verification"

So apparently it's because Paymium and I both have MtGox accounts, and we're connecting from the same IP (wow, surprise surprise)

So because of that my account is now frozen and I'm required to get "verified" (even though they do have a scan of my passport and they do have a proof of address in the form of a Yubikey sent to my home)

And apparently MT has too much on his plate to even acknowledge an IRC message.

So beware, MtGox won't hesitate to arbitrarily prevent you from accessing your very own money, and a verified account won't help.

You already have those my friend.

If you migrate your system it is your responsibility to migrate customer data. Freezing accounts until people re-upload what they already have is not a professional way of doing things.

I'm quite pissed-off right now. Just because you guys hold my money doesn't mean you get to freeze it at will.