PayPal washes its hands of bitcoin scam
An eBayer has lost £5,300 after he was conned out of his bitcoins. Now he is being chased for money he is said to owe
Will Phillips is £5,300 out of pocket after falling victim to a very 21st-century financial scam involving hacked PayPal accounts and the digital currency bitcoin.
For the uninitiated, bitcoin is a "virtual currency" that, depending on who you believe, is going to change the world by turning e-commerce on its head, or end very messily like a modern-day version of the "tulip mania" that gripped the Netherlands in the 17th century.
In recent months it has become a magnet for speculators and, last autumn, 32-year-old Phillips, who freely admits he is a "a bit of a geek," decided to grab a slice of the action.
At the start of 2013, one bitcoin was worth around £7. At the end of November the price hit £750 while on Wednesday this week it was around £350.
Within weeks, the bitcoins Phillips had bought for around £800 were worth many times that, so he decided to sell them on eBay. But now he has lost the lot, and says PayPal is threatening to send in debt collectors.
What seems to have happened is, in the space of one night, fraudsters hacked into legitimate PayPal accounts and, posing as these people, bought his bitcoins on eBay and made off with them. This type of scam is not new, and usually PayPal comes down in favour of the individuals whose accounts were hacked. In this case, the account holders have had their money refunded. However, Phillips is now being pursued for more than £1,300 that PayPal says he owes them.
His case emerged just hours before bitcoin was plunged into chaos by the news this week that one of its best-known "exchanges," the MtGox website, had disappeared from the internet amid rumours that almost 750,000 bitcoins, worth more than £200m, may have been stolen.
Bitcoin has been around for about five years, but it was in 2013 that it started to move from the tech chatrooms into the public consciousness – helped by a high-profile news story in November about a man who realised that the computer hard drive he had chucked out contained bitcoins worth £4m, and was in a landfill site in south Wales.
A virtual currency (AKA "cryptocurrency") can be bought on an exchange using conventional money and then transferred to your personal digital "wallet". You can then use this "money" to pay for goods and services – mainly drugs and porn, some claim – or convert it back into pounds, dollars or whatever. The "coin" doesn't exist physically – it exists only as a computer file.
Last year, Phillips, a London-based visual effects artist, could see that bitcoin was starting to become a phenomenon. "The price was increasing and increasing, and a lot of articles were being written. I didn't want to miss out, so I started buying a few. Then I started trading with smaller cryptocurrencies, and had some success." At one point he owned 4.8 bitcoins.
By November, bitcoin's value had soared, fallen, then it rose again. Concerned about this volatility, Phillips decided, as he had "done quite well", now was the time to sell. So he listed his bitcoins on eBay and had no problems finding buyers. A man in Hounslow, Middlesex, bought half a coin for £520. Phillips waited until the money was in his PayPal account, then sent the currency to the wallet address provided. Hours later, the man reversed the payment.
However, the way bitcoin works means that while you can't see who owns a wallet, anyone can view bitcoin transactions via websites such as Blockchain.info – so it was easy to establish his bitcoins had gone into the man's wallet.
It was a similar story with other eBay buyers that night. One bought two bitcoins (4 x 0.5) for just over £2,000. Phillips was reassured by the fact she had a decent eBay rating. As soon as the money hit his account, he transferred the bitcoins to the wallet address, and she emailed back saying she would be interested in buying more.
But in the morning all the money from her in his PayPal account had been put "on hold". PayPal, he was told, suspected her account had been hacked. It said it needed more information about the woman before it could release the funds, and suggested Phillips email her to speed things up. She pinged back a pithy two-word response: "Fuck off!"
By this point Phillips was "panicking a bit – something was very wrong and I realised I may have lost my bitcoins and the money". He told Guardian Money: "These people quickly had their money refunded by PayPal, and I lost all mine. Neither eBay nor PayPal has provided me with any sort of explanation or even leniency, instead focusing on chasing me for money I now owe them."
After doing some detective work, he believes all the bitcoin buyers were fraudsters who hacked into legitimate accounts, and that every fraudulent transaction made against him that night can be linked. "It looks like it is just one person, or one group," he says, adding: "I'm not looking for sympathy or a sob story but some accountability from PayPal, and also for this to serve as a warning to others. PayPal's only response was that they don't cover selling digital goods, since they can't prove the goods were sent/delivered. I can prove this, have told them and have sent them the proof, but they will not accept it."
He adds: "Why should I be liable for eBay and PayPal accounts being hacked to fraudulently buy from me? Under their terms and conditions I am not offered any seller protection – I was unaware of this at the time – but as a consumer, surely I must have some rights?"
Phillips says he has also been told the Financial Ombudsman Service won't be able to help, while the police "don't seem interested".
Money tracked down the man who supposedly bought £520-worth of bitcoin from Phillips. He told us: "Someone hacked into my eBay and PayPal accounts – I didn't buy anything from Mr Phillips." He says the money went out of his PayPal account but was later paid back. He adds: "I was more concerned with my PayPal account. I thought this was the safest on the planet but obviously not."
Last month, eBay's UK arm banned sales of bitcoin and other virtual currencies from its auction and "buy it now" formats. As a result, people can only sell via its classified advertising.
PayPal clearly isn't keen on the word "hacking", which it believes suggests someone has broken into its systems. Instead, it talks about accounts being "taken over by a third party," perhaps as a result of someone falling victim to a phishing email – though most people would probably regard that as pretty much a dictionary definition of hacking.
A PayPal spokesman told us he could not comment on individual cases but said: "Bitcoin transactions aren't covered by our seller protection programme because they are regarded as intangible goods." He added: "PayPal systems have not been hacked, but we always investigate cases where a customer's account may have been taken over by a third party. We take security incredibly seriously – it's our highest priority."
• Bitcoin is the best-known of a wave of virtual currencies, or "cryptocurrencies" – others include litecoin and dogecoin. In essence, it's digital cash.
• Bitcoins come into existence as a result of being "mined" by computers solving fiendishly hard mathematical problems.
• If you want to join the bitcoin revolution, you'll have to set up a digital "wallet" via a website such as Blockchain.info. Then you'll be able to buy from one of the exchange platforms or marketplaces (good luck with trying to mine your own bitcoins). You can then use them to pay for goods and services – provided you can find someone who'll accept them.
• In January, the UK's Financial Services Compensation Scheme (FSCS) warned that virtual currencies are not regulated. That means the FSCS will not step in if a consumer suffers a loss as a result of a website that exchanges or holds bitcoins goes out of business.
• This followed a similar warning in December from the European Banking Authority (EBA), which said consumers needed to be aware of the various risks. It added that the digital wallets used to store virtual currencies "are not impervious to hackers". And consumers are not protected by any refund rights under EU law when using bitcoins and the like to pay for items. Just for good measure, the EBA added the virtual currencies "may be misused for criminal activities," and that there can also be tax implications for people.
guardian.co.uk © Guardian News and Media 2014