'50% of transactions were fraudulent' when Steam accepted Bitcoin for payments • Hacker News Board

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#171

Post by michaelmrose » Sat, Feb 26, 2022, 6:51 PM UTC

m348e912 wrote: post #126

rosndo wrote: post #88

Earlier quoted context omitted.

The basic misunderstanding is on your part. “Money laundering” wasn’t mentioned by anyone but you. Stop inventing things. This is about valve getting fucked because they were accepting bitcoin payments with zero confirmations.

I'd like to know what Gabe meant by fraudulent too. The whole idea of crypto is that if you send it and it's confirmed you can't get it back, which makes fraud (on the payers side) nearly impossible. You brought up the point about zero confirmations. Zero-conf itself is fairly reliable, it certainly doesn't account for 50% transactions being fraudulent. Bitcoin introduced replace by fee in 2016. In 2017, bitcoin tran…

Couldn't steam use longevity to decide whether to accept crypto transactions and cancel entire accounts for fraudulent activity?

Don't let bob create a new account with zero games and double spend his way to a free game because he has nothing to lose.

If Sam who has 100 games in his account with 10 year longevity cheats you insist he make good on his transaction or ban his account and don't ever let him create a new one with the same name and billing address. Sam is highly unlikely to value playing a singular game more than his account.

This seems absolutely trivial to avoid problems with.

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#172

Post by doomroot » Sat, Feb 26, 2022, 6:51 PM UTC

philsquared_ wrote: post #167

sidewndr46 wrote: post #162

Earlier quoted context omitted.

> Steam back in the day used to accept 0 confirmation bitcoin spends. This means that the transaction has been gossiped on the bitcoin p2p network but had not yet been mined into a block and thus had minimal finality guarantees. Why? Why would anyone ever accept this?

Because I am pretty sure it isn't true. I am one of the few people who used bitcoin on steam during this time and I don't remember it ever being instant. I would like to see clarification to the top point because I don't think it is true... In my opinion when he says "fraudulent" he is probably talking about how people would use it to avoid bans. Steam would track banned users that remake accounts by checking their C…

I used bitcoin all the time on steam and there was a time when they were using 1 conf but the majority of the time they used 0 conf with bitpay. Couldn't find anything official with a quick goog but here is a reddit comment from 5years ago corroborating 0 confs on steam: https://www.reddit.com/r/Bitcoin/comments/6arpvq/comment/dhg...

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#173

Post by lawn » Sat, Feb 26, 2022, 6:53 PM UTC

paulgb wrote: post #8

janandonly wrote: post #2

Unfortunately no details were given about what makes 50% of all bitcoin transactions “fraudulent” ? What does that even mean? * did someone try to send something other then bitcoin to a ₿ address? * did a client claim he payed and did the payment seem to fail on his end? * did a client not realise that you as payee also pay for the network fee? Nowadays these kind of problems would be easily prevented by using bitcoi…

I remember a period somewhere in the 2010s where it wasn't uncommon to see a business experiment with accepting Bitcoin (as Steam did), before transaction fees made it impractical. Given the way people talk about LN, and the (quite understandable!) desire to avoid credit card transaction fees, why don't we see more businesses accepting it? (Asking this in good faith; I am admittedly ignorant about LN and have not tri…

Simply because LN isn't practical:

- You still need to open (and close) a channel, paying BTC fees.

- To accept a payment, you need to first lock up balance.

- You need to always be online, otherwise your channel is closed.

- Sometimes your payment can fail, if you cannot find a route. This risk increases with the payment amount.

- Sometimes, you cannot even find a payment route, so you need to open another channel.

- Sometimes, the other person on the other side of your channel might close your channel.

- Despite all this, payments might still have a relatively expensive fee (in addition to the BTC fees).

People are trying to create solutions for these problems, but they're often either quite complex, introduce third-party dependency or both.

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#174

Post by philsquared_ » Sat, Feb 26, 2022, 6:55 PM UTC

doomroot wrote: post #172

philsquared_ wrote: post #167

Earlier quoted context omitted.

Because I am pretty sure it isn't true. I am one of the few people who used bitcoin on steam during this time and I don't remember it ever being instant. I would like to see clarification to the top point because I don't think it is true... In my opinion when he says "fraudulent" he is probably talking about how people would use it to avoid bans. Steam would track banned users that remake accounts by checking their C…

I used bitcoin all the time on steam and there was a time when they were using 1 conf but the majority of the time they used 0 conf with bitpay. Couldn't find anything official with a quick goog but here is a reddit comment from 5years ago corroborating 0 confs on steam: https://www.reddit.com/r/Bitcoin/comments/6arpvq/comment/dhg...

It is possible I am incorrect then. I remember it always taking 5 - 10 minutes before any funds hit my account. I never actually counted the confirmations so it is very possible I am just wrong and they were doing 0 conf. At the same time I am surprised BitPay would have been structured this way and not experience a major attack...

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#175

Post by toast0 » Sat, Feb 26, 2022, 7:04 PM UTC

giaour wrote: post #137

SilasX wrote: post #46

Earlier quoted context omitted.

Sorry, I went to the article and it wasn't any more specific on what a fraudulent transaction means in this context, and I don't know what that would mean here (for the context of a purchase via Bitcoin on a user's Steam account). All I can imagine is a case where the user claims they didn't make the purchase, "please refund", but that would be easy to disprove.

I assumed they meant spending stolen bitcoin on steam. It's common to call purchases made with a stolen credit card "fraudulent," even if there's nothing untoward about the purchase itself other than the payment instrument.

> even if there's nothing untoward about the purchase itself other than the payment instrument.

When you make a purchase with a credit card, you claim that you are an authorized user of the card, and that you will pay the bill in accordance with the account agreement.

If that's not true, it's fraud. You've knowingly made an untrue claim in order to receive something of value.

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#176

Post by CyberDildonics » Sat, Feb 26, 2022, 7:04 PM UTC

sidewndr46 wrote: post #162

doomroot wrote: post #143

Context on what I believe they mean by "fraudulent". Steam back in the day used to accept 0 confirmation bitcoin spends. This means that the transaction has been gossiped on the bitcoin p2p network but had not yet been mined into a block and thus had minimal finality guarantees. Steam could see that they were going to receive a bitcoin payment (when the transaction was mined into a block) and would credit the users a…

> Steam back in the day used to accept 0 confirmation bitcoin spends. This means that the transaction has been gossiped on the bitcoin p2p network but had not yet been mined into a block and thus had minimal finality guarantees. Why? Why would anyone ever accept this?

Because they can revoke your game from your steam account if the transaction doesn't get picked up.

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#177

Post by giaour » Sat, Feb 26, 2022, 7:08 PM UTC

toast0 wrote: post #175

giaour wrote: post #137

Earlier quoted context omitted.

I assumed they meant spending stolen bitcoin on steam. It's common to call purchases made with a stolen credit card "fraudulent," even if there's nothing untoward about the purchase itself other than the payment instrument.

> even if there's nothing untoward about the purchase itself other than the payment instrument. When you make a purchase with a credit card, you claim that you are an authorized user of the card, and that you will pay the bill in accordance with the account agreement. If that's not true, it's fraud. You've knowingly made an untrue claim in order to receive something of value.

From the other comments on this thread, it seems like Steam was using a zero-confirmation payment validator of some kind. That makes bitcoin payments Steam accepted effectively a form of check, and if customers exploited this to double-spend bitcoin, then they paid steam with a hot check. Hence, fraud.

Should Steam used a different form of validation? Yeah, that would have let them reject some (most? all?) of these fraudulent transactions. But anyone exploiting that situation to double-spend coins was committing fraud just as much as if they had written a worthless check, used a stolen credit card, or tried to pass off a counterfeit $100 bill.

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#178

Post by egberts1 » Sat, Feb 26, 2022, 7:19 PM UTC

alickz wrote: post #161

marcus_cemes wrote: post #155

Earlier quoted context omitted.

> There are many context where a 0conf tx makes sense, mostly IRL. I'm curious, like what? To me this is more like "someone wrote a cheque but there's no guarantee that they'll give it to you".

I only have a layman understanding of bitcoin, and I've never used a cheque in my life, but would it not be more like "someone wrote you a cheque and there's no guarantee it won't bounce when you try to cash it in"? Which, again maybe showing my complete lack of knowledge of cheques, is how I thought they worked in the first place.

Personal check is a quasi-promissory note binded whose legal-teeth for recovery through law enforcement. “0-conf bitcoin” has no legal teeth for recovery … yet so there is no enforcement (except for the merchant to chase after the scofflaw). “Money is forthcoming”.

Bank cheque is a bank-guarantee binded by banker self-verification (almost always good) with no takeback (voiding) mechanism. “block-chain confirmed” is always a good transaction with no clawback mechanism so you must wait until it’s confirmed before receiving your merchandise.

“Cash is king.”

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#179

Post by Lochleg » Sat, Feb 26, 2022, 7:24 PM UTC

In my estimation, most of the activity done with people's inventory on Steam, especially skins in major games, involve one illicit scheme or another. I guess you can't or shouldn't stop people from using their skins on gambling sites. However, it doesn't seem like many of the metafeatures that the company started to build around Steam actually serve regular gamers just looking to enjoy themselves.

Re: '50% of transactions were fraudulent' when Steam accepted Bitcoin for payments

#180

Post by jayd16 » Sat, Feb 26, 2022, 7:24 PM UTC

gruez wrote: post #166

jayd16 wrote: post #147

Earlier quoted context omitted.

First off, why not? Why would you doubt that when they're a massive storefront and deal with fraud of all kinds? But also, wouldn't it be fairly easy and beneficial to have this information? Exchanges know what wallets are charged back and fraudulent. Is it not in their interest to work with Steam? Or even, is it not in the exchange's interest to do this analysis and demand the coin from Steam?

> First off, why not? Why would you doubt that when they're a massive storefront and deal with fraud of all kinds? 1. The anti-fraud tech used for credit card fraud (ie. stolen credit cards used for unauthorized transactions) don't really translate well to the fraud described here (ie. stolen cryptocurrency). 2. it makes sense for ecommerence merchants to do anti-fraud stuff, because they're on the hook for fraud. th…

>blacklists

They wouldn't be blacklists. You only learn after the fact so its more about the analytics.

>I'd tell them to fuck off.

Well that's nice but if you get paid with stolen money, you don't just get to keep the money and tell them to fuck off. Steam would be liable to return the funds.