make sure "delpan" is not stealing money :-)

[chadwhitacre]

We have a new person in the top ten, @delpan, and I don't know who they are ... which is awesome! It means Gittip is growing! That said, the day will come when Gittip is used for fraud, and we need to be watchful for that. We need to balance welcoming new users and communities with watchfulness for abuse. This ticket is to track the process of satisfying ourselves that @delpan is legit.

Edit: Changed to refer to talk about fraud and stolen money instead of laundering money, per this hn thread.

[chadwhitacre]

@colindean points out that there is a well-known Counter-Strike player who goes by delpan. The @delpan account on GitHub was registered 11 days ago, which is when delpan registered with Gittip as well. That's fine, since one wouldn't necessarily expect a gamer to be on GitHub or Twitter. This person received $12 last week and is set to receive $60 tomorrow. As @cmbeelby points out, their Gittip statement is "ambiguous at best":

I am making the world better by listening from young people and give them advices in many situations such as love, family, friends affairs.....

What further information would we need in order to decide whether delpan's use of Gittip is illegitimate? What are the right questions to ask?

That said, @delpan is innocent until proven guilty, as far as I'm concerned. If you're listening, @delpan, welcome to Gittip. :-)

[coolbreezechloe]

Interesting thought. Do you really want to get into the business of deciding what is or is not legitimate use of the site? Not sure if you have any terms of service or acceptable usage policies. If you do and you suspect he is not following them then certainly investigation is warranted. I also assume you could do a little analysis of the source of this persons tips--and you seem to indicate you have added that feature for admins--to see if they are statistically abnormal.

Perhaps could ask this person for more information on the work they are doing. Do they have another website or background information?

Can't say I find the idea all that bad though. I'd love to start my own gittip account with a goal of something like "I make the world a better place by..." and have people give me money to pursue that end.

[coolbreezechloe]

Also, I just have to say that the Gittip statement quoted above seems to me to smell of a bad translation (i.e. using a automated service rather than natural speaker) from some other language into English. "Listening from young people" should probably be "Listening to young people" and "give them advices in many situations" perhaps "giving them advice on many topics". So if you are legit @delpan, I'd update your statement. :-)

[chadwhitacre]

The only thing I'm really worried about at this point is people using stolen credit cards to send money through Gittip to themselves. If the cards aren't stolen, I don't really care who or why someone sends money through Gittip. Should I?

[coolbreezechloe]

No I don't think you should. If the cards are stolen (and have been reported as such to the cc agency) does your payment gateway system detect this and reject them? I know I've lost a cc or two in my time (and even had some fraud on one) and in all cases the cards are cancelled right away so they shouldn't work as a form of payment.

[colindean]

I don't think Gittip should be in the business of deciding if someone is worthy of receiving money or qualified to receive it, beyond the minimum measures necessary to comply with applicable laws.

That said, is is reasonable to establish a minimum requirement to open a Gittip account? to give money? to receive money?

Some examples:

• Minimum age of linked accounts (Github, Twitter, etc.)
• Minimum level of contribution to those linked accounts (# repos + # commits, # posts)
• Link to another service showing contributions (e.g. BitBucket, Launchpad, etc.)

Maybe it's appropriate to analyze the contributors to a certain account and ask for some kind of verification if it's found that a user is suddenly receiving a lot of money from brand new Gittip accounts backed by brand new linked accounts.

I think it's going to be difficult to establish some kind of flagging criteria, but it may be necessary in order to identify potential laundering schemes.

But, all of this seems like a lot of work that may not be necessary.

If the cards aren't stolen, I don't really care who or why someone sends money through Gittip. Should I?

To me, something neat about Gittip is its focus on developers. A purist would expend a lot of energy to prohibit unintended uses. If the mission of Gittip is to provide a way to tip developers, then that's one thing. If it's to provide a way for people to tip other people regardless of the reason, perhaps there's an opportunity for Gittip to grow into a service with a wider audience once some of the initial problems (such as this one we're discussing!) are identified and resolved.

To be direct, at this stage, it's perhaps worth monitoring lightly, but there are likely other more pressing issues to address. If the merchant/payment gateway can handle misuse of credit cards, let them and implement whatever's necessary to protect yourself (and Gittip) from the consequences of someone's misuse.

[jkwade]

Fascinating thread. I work at @balanced, Gittip's credit card processing backend, so I thought I'd chime in.

@colindean is right on with his suggestion to look at data from linked services as a signal of legitimacy, but he nailed it when he said:

Maybe it's appropriate to analyze the contributors to a certain account and ask for some kind of verification if it's found that a user is suddenly receiving a lot of money from brand new Gittip accounts backed by brand new linked accounts.

The main thing to look at with any double-sided payment scheme are signals that have meaning when examined across both parties. For example, if the tiper and tipee have linked accounts (github or twitter) or Gittip accounts that have similar created_at timestamps, then the chances of collusion are high.

@cmbeelby Is also right in pointing out that @balanced will be notified of a stolen credit card if it has been reported and will decline the transaction outright.

But there are obviously times when CC info has been compromised, and the card has not been cancelled yet. In those cases there are some characteristics of Gittip that make it unattractive to credit card thieves looking to liquidate value on a stolen card they have access to:

• Latency - Gittip works on a weekly disbursement model. If I were a fraudster working with only a few days to extract value from a stolen credit card, I woud't go to a time-delayed service like Gittip.
• Low average transaction values - doing some simple math, one can figure out that the average transaction value on Gittip is fairly low. If I were a fraudster, I wouldn't waste my time on a service where a single transaction over $50 is going to get noticed pretty easily.
• Many to one - Gittip is a many to one platform. For a fraudster's transaction profile to resemble "normal" behavior, he/she would have to use many stolen credit cards. Too much trouble, so they won't even try.

Finally, by using Balanced, each Gittipee must go through an underwriting process. While this process is not a fraud prevention step, but rather used for compliance, a nice side effect of it is that the recipient cannot receive their funds unless they provide real identity information. @gvenkataraman can tell you more about this.

[colindean]

Finally, by using Balanced, each Gittipee must go through an underwriting process. While this process is not a fraud prevention step, but rather used for compliance, a nice side effect of it is that the recipient cannot receive their funds unless they provide real identity information.

Do I correctly assume that this step is for AML compliance? I'm gaining an understanding of AML laws hanging around Bitcoin circles - the AML paperwork is necessary to deposit or withdraw cash at an exchange, and I assume it works the same for Gittip!

With the AML paperwork requirement in place to deter laundering on the receiver's part, and some kind of automated way to detect if a bunch of new accounts with new linked accounts raising flags for givers who may be malicious, it seems that the remaining factor is simply purpose.

Should Gittip allow non-developers/designers/documentarians, etc.?

I don't see the harm, except that people not in the target audience end up signing up for Github accounts that they'll likely never use :-p

[ironchefpython]

Should Gittip allow non-developers/designers/documentarians, etc.? I don't see the harm, except that people not in the target audience end up signing up for Github accounts that they'll likely never use :-p

In the short term, they could sign up via Twitter. In the long term, gittip could implement a wider variety of sign-up mechanisms, from bitbucket or unfuddle to facebook/google+ to app.net, or even anyone with a webpage or an oauth-compatible email provider.

[chadwhitacre]

This is getting worse. Four of the five anonymous on the givers leaderboard are linked to empty Twitter accounts.

[chadwhitacre]

And it looks like anon 1 and 2 ($108 and $90) had bad credit cards. They're off the leaderboard now that Gittip 21 has actually run (#341).

[chadwhitacre]

One thing that hampers investigation is that we don't have a timestamp for credit card failures. Reticketed that as #342.