Email from Dwolla Regarding Reversals - page 4.

moocow1452

sr. member

Activity: 240

Merit: 250

Don't mind me.

Quote from: evoorhees on April 16, 2012, 04:44:32 PM

Ironically, this will make Bitcoin world MORE anonymous, as more US people will now use the anonymous cash deposits at banks via BitInstant instead of Dwolla (it was already much faster... now it's more far more private as well).

That's not ironic. Dwolla is covering it's own ass and doesn't give a rip about how Bitcoin will run with or without it. I would give them my life story if it meant that I could get stuff from here to there faster, but the 30 day thing kills it for me.

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Quote from: triplehelix on April 16, 2012, 08:10:02 PM

so you have to wait 30 days from first depositing money into dwolla before you can send it to mtgox now?

That's what it sounds like.

triplehelix

member

Activity: 84

Merit: 10

so you have to wait 30 days from first depositing money into dwolla before you can send it to mtgox now?

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Ya, denying service because you won't link your Facebook account is probably something the EFF needs to jump onto before it becomes accepted practice.

- http://www.betabeat.com/2011/12/13/as-banks-start-nosing-around-facebook-and-twitter-the-wrong-friends-might-just-sink-your-credit
- http://www.movenbank.com

zer0

sr. member

Activity: 350

Merit: 250

Quote from: Stephen Gornick on April 16, 2012, 06:27:42 PM

Quote from: zer0 on April 16, 2012, 06:20:30 PM

Any money transfer system based on online banking is doomed to fraud unfortunately.

In the U.S. they've yet to allow retail banking (consumer banking) customers do ACH push. Add in a Yubikey requirement to allow ACH push (only with the key) and most of the problem with unauthorized transactions is solved. The problem is banks see that switch as being too expensive, in financial terms and consumer education and support. It is still cheaper to pass on the cost of fraud to either the customers or the merchant, and when forced to, eat a little themselves.

There's a gold and currency exchange office where I live where you can walk in, lay down cash and they will send risky electronic transactions for a small fee, so the receiver is guaranteed clean funds.

Yubikey and other requirements for online banking would be great but seems to me banks and credit card companies are willing to just eat the fraud if it's easy for their customers to use. Push a button send money.

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Quote from: zer0 on April 16, 2012, 06:20:30 PM

Any money transfer system based on online banking is doomed to fraud unfortunately.

In the U.S. they've yet to allow retail banking (consumer banking) customers do ACH push. Add in a Yubikey requirement to allow ACH push (only with the key) and most of the problem with unauthorized transactions is solved. The problem is banks see that switch as being too expensive, in financial terms and consumer education and support. It is still cheaper to pass on the cost of fraud to either the customers or the merchant, and when forced to, eat a little themselves.

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Quote from: DeathAndTaxes on April 16, 2012, 05:43:28 PM

If most of the attacks are from creating new accounts using stolen non-Dwolla enrolled bank accounts then the attackers will simply shift to stealing existing dwolla accounts.

Which reduces the size of Dwolla's risk exposure by several orders of magnitude, for now. I'm guessing at $0.25 per transaction they simply cannot afford even to deal with the administrative hassle coming from the fraud transactions -- either attempted or successful, so this change is one way to automate away much of it.

zer0

sr. member

Activity: 350

Merit: 250

Quote from: Stephen Gornick on April 16, 2012, 05:33:25 PM

Quote from: zer0 on April 16, 2012, 05:13:13 PM

30 day wait won't really prevent fraud.

There is logic for the 30-day wait. It states that you must have used Dwolla to transfer funds from your bank account at least 30 days prior. Thus if a scammer did a bank transfer without the bank account holder realizing it right away, the passing of one statement cycle increases the chances the transaction would be discovered.

This will help Dwolla with Dwolla Instant as well, as if the scammer were to have created the account and applied for the line of credit, at least the chances are that the legitimate account holder will likely learn that this account and/or credit line was created before any funds were transferred to a bitcoin exchange.

True this does prevent simple new signup fraud, but still doesn't combat identity theft. Can open bank accounts remotely using somebody's stolen identity, launder other stolen funds through it to Dwolla, then apply for credit after the 30 days. Some scammers are in it for the long haul if they can pull it off.

Any money transfer system based on online banking is doomed to fraud unfortunately. Trustcash wins again

hongus

full member

Activity: 736

Merit: 100

Adoption Blockchain e-Commerce to World

I'm pulling all my money out ASAP and contacting support to delete my account as soon as the money reaches my bank account.

DeathAndTaxes

donator

Activity: 1218

Merit: 1079

Gerald Davis

Quote from: Stephen Gornick on April 16, 2012, 05:33:25 PM

Quote from: zer0 on April 16, 2012, 05:13:13 PM

30 day wait won't really prevent fraud.

There is logic for the 30-day wait. It states that you must have used Dwolla to transfer funds from your bank account at least 30 days prior. Thus if a scammer did a bank transfer without the bank account holder realizing it right away, the passing of one statement cycle increases the chances the transaction would be discovered.

This will help Dwolla with Dwolla Instant as well, as if the scammer were to have created the account and applied for the line of credit, at least the chances are that the legitimate account holder will likely learn that this account and/or credit line was created before any funds were transferred to a bitcoin exchange.

It prevents a scammer from using a non-Dwolla bank account and signup up for Dwolla service but it does nothing to protect against keylogger and using a victims already established account (one w/ facebook links, and 30 day of account history).

It is feel good security. If most of the attacks are from creating new accounts using stolen non-Dwolla enrolled bank accounts then the attackers will simply shift to stealing existing dwolla accounts.

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Quote from: zer0 on April 16, 2012, 05:13:13 PM

30 day wait won't really prevent fraud.

There is logic for the 30-day wait. It states that you must have used Dwolla to transfer funds from your bank account at least 30 days prior. Thus if a scammer did a bank transfer without the bank account holder realizing it right away, the passing of one statement cycle increases the chances the transaction would be discovered.

This will help Dwolla with Dwolla Instant as well, as if the scammer were to have created the account and applied for the line of credit, at least the chances are that the legitimate account holder will likely learn that this account and/or credit line was created before any funds were transferred to a bitcoin exchange.

zer0

sr. member

Activity: 350

Merit: 250

Facebook thing and 30 day wait won't really prevent fraud. Afterall most crimebots record every keystroke and login so the potential fraudster would already have all Dwolla/FB/everything and can just buy the SSN# from a lookup service.

Bitinstant should crowdsource trusted people to do cash in hand trades in every city and pay an affiliate fee or something

No more banks or dwolla middlemen. Sort of a giant hawalla network

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Quote from: RaggedMonk on April 16, 2012, 04:35:51 PM

I just confirmed with Dwolla support that all 4 steps are now a requirement before sending money to MtGox.
- The 30 bank transfer history I have no problem with.

There was use of Dwolla by some that never set up a bank account. If one doesn't trust the exchanges, funds could be moved out of the exchange into Dwolla without giving them anything other than a name e-mail address (for small amounts, of course -- for larger amounts they've wanted ID for quite some time now.)

Many people were able to use Dwolla as an FDIC insured temporary holding spot after cashing out of some bitcoins. But now, they must register with a bank and wait 30 days in order to get that money back into bitcoins. Some of them don't even have a bank account. (Fortunately, some reloadable debit cards will function as direct deposit for transferring cash out sooner than 30 days).

Quote from: RaggedMonk on April 16, 2012, 04:35:51 PM

- Accessing my Facebook and Social Security number is an unnecessary invasion of my privacy that I will not tolerate, and is the main reason I am cancelling my account.

Yup -- the Facebook part is unacceptable. The SS# I can understand, though I would think existing accounts should get grandfathered in as far as the balance that existed when this change occurred.

Quote from: RaggedMonk on April 16, 2012, 04:35:51 PM

- The fact that they are up-selling their new Hub Pages product is repugnant, particularly that it is a requirement before you can send money to certain people.

Isn't that bizarre? To send money to you I need to set up a hub page so that I too can receive money from others? Why?

I wouldn't bet that was a misunderstanding by the person editing the announcement or something to that effect.

notme

legendary

Activity: 1904

Merit: 1002

Quote from: DeathAndTaxes on April 16, 2012, 04:52:49 PM

Quote from: notme on April 16, 2012, 03:55:20 PM

Quote from: Littleshop on April 16, 2012, 03:51:31 PM

Quote from: Yankee (BitInstant) on April 16, 2012, 09:27:37 AM

1) Connect a social network

Steps like this only hurt Dwolla. The fraudsters have dummy social network accounts set up. I guess they may catch a dummy who starts honest then goes rouge and tries to charge back a Dwolla transaction because they would have more information on them. Probably not though, the bank is most often going to side with the customer.

Dwolla NEEDS two factor now. Just fishing for REAL Dwolla accounts and using them to buy BTC is going to be a problem. Each hack Dwolla account will be worth something so long as Dwolla is accepted by bitcoin exchanges. Hackers are going to keep pushing Dwolla as long as they sit still. Paypal has the advantage because they can usually take a payment back in the end.

Dwolla has two factor, but one is a password, and one is a short, numerical pin. SMS or Google Authentication would be a step in the right direction.

BTW that isn't two factor.

a) Something you know
b) Something you have
c) Something you are

One factor uses one of the factors, two factor uses two, and three factor uses three. Adding more elements from the same factor doesn't significantly increase security.

Thank you, you are correct.
http://en.wikipedia.org/wiki/Two-factor_authentication

JusticeForYou

vip

Activity: 490

Merit: 271

Cash deposits at banks seems to be the way to go to maintain privacy.

This AML KYC stuff is just because LE has become lazy. If they truly suspect someone of a crime then they can goto the bank and get the video. This 'everyone' is a suspect so lets violate their privacy, needs to fail. So, every time they come up with a system, we need to come up with a 'legal' way of circumventing it.

DeathAndTaxes

donator

Activity: 1218

Merit: 1079

Gerald Davis

Quote from: notme on April 16, 2012, 03:55:20 PM

Quote from: Littleshop on April 16, 2012, 03:51:31 PM

Quote from: Yankee (BitInstant) on April 16, 2012, 09:27:37 AM

1) Connect a social network

Steps like this only hurt Dwolla. The fraudsters have dummy social network accounts set up. I guess they may catch a dummy who starts honest then goes rouge and tries to charge back a Dwolla transaction because they would have more information on them. Probably not though, the bank is most often going to side with the customer.

Dwolla NEEDS two factor now. Just fishing for REAL Dwolla accounts and using them to buy BTC is going to be a problem. Each hack Dwolla account will be worth something so long as Dwolla is accepted by bitcoin exchanges. Hackers are going to keep pushing Dwolla as long as they sit still. Paypal has the advantage because they can usually take a payment back in the end.

Dwolla has two factor, but one is a password, and one is a short, numerical pin. SMS or Google Authentication would be a step in the right direction.

BTW that isn't two factor.

a) Something you know
b) Something you have
c) Something you are

One factor uses one of the factors, two factor uses two, and three factor uses three. Adding more elements from the same factor doesn't significantly increase security.

evoorhees

legendary

Activity: 1008

Merit: 1023

Democracy is the original 51% attack

Ironically, this will make Bitcoin world MORE anonymous, as more US people will now use the anonymous cash deposits at banks via BitInstant instead of Dwolla (it was already much faster... now it's more far more private as well).

RaggedMonk

sr. member

Activity: 308

Merit: 250

Quote from: Etlase2 on April 16, 2012, 04:38:04 PM

Quote from: RaggedMonk on April 16, 2012, 04:35:51 PM

If you have an account and don't want to comply with their bullshit verification, contact support and ask for it to be deleted. They should feel some pain from this new policy.

except that, IIRC, your account won't actually be deleted for a very long time.

They offered to suspend my account, I told them to permanently delete all data that they are not required by law to retain. They still haven't responded.

Etlase2

hero member

Activity: 798

Merit: 1000

Quote from: RaggedMonk on April 16, 2012, 04:35:51 PM

If you have an account and don't want to comply with their bullshit verification, contact support and ask for it to be deleted. They should feel some pain from this new policy.

except that, IIRC, your account won't actually be deleted for a very long time.

wogaut

donator

Activity: 448

Merit: 250

Is that true for Dwolla/Intersango too?

Topic: Email from Dwolla Regarding Reversals - page 4. (Read 10464 times)