"We will need you to send us a high quality scan of a government ID or passport in order to verify your account. Please send the picture, or a link of the picture, to:"
Unfortunately we deal with a large amount of abusive and fraudulent signups which leads to a bunch of abuse on the network such as mining, port scanning, and flooding. We do everything we can to filter out abuse automatically and then determine whether or not a customer is legitimate outside of that but unfortunately that information isn't always available or conclusive.
We'd love to hear suggestion on how we can improve that without resorting to requesting an ID because obviously that isn't something that's ideal.
I am a current DigitalOcean client and I was recommending DO to my friends and professional contacts.
New policy of requiring scanned documents is unacceptable in the environment of pervasive nation-state level monitoring and destruction of privacy. If this is a permanent change, I won't recommend DO any longer.
The solution is extremely simple: accept bitcoins for payments and/or fair use verification for free tiers. Also there is a market for forged document scans, just read krebsonsecurity.
Same here. DigitalOcean can't verify if a document is real (vs photoshopped) so the requirement might as well be sending a letter head. I'm glad I got access to all levels of VMs early by asking nice (for legitimate adhoc large data processing that required lots of RAM).
I don't understand why a scan of a passport or ID of someone signing up is required when it cannot be verified.
The reasons are this:
Banks are legally required to conduct some kind of Know Your Customer where an individual has to physically present themselves so their provided ID is matched against their physical person. So KYC is done by a bank. And I'm paying with a bank / credit card.
In the case of someone opening an account by using a fraudulent card, it is trivial to attach what looks like a mediocre scan of a passport or divers licence.
Notarised IDs are not requested, so there is no way to verify with a lawyer. And Notarisation is expensive, so it will turn almost all customers away.
Closing circle: If the name on the card matches the ID provided and it is not a case of a fraudulent transaction, the individual can be pursued via their bank. This is probably not worth it at a time vs reward level, unless the abuse of the network is such law enforcement should be involved, but is not something for you to do, but for your bank, as correspondent bank, to do.
While obviously a liability in terms of information security and the risk of a breach, requiring such personal information is a precedent: If all companies did so for low value transactions, then this information would end up in thousands of online repositories (and therefore of large scale, opposed to, say, a hostel seeing a handful of customers per day keeping paper records) which would surely have leaks. The risk becomes systematic. Which increases fraud.
Let the banks do KYC. Let the hosting company ensure the network is monitored in the way they desire.
Edit: Having worked in a couple of banks at a middle management level, and covering regulatory, compliance and information security roles, what really helps when regulators or general law enforcement audit or inspect a function, what really matters is showing both internal policies showing banking regulations are drilled into employees, and anticipative policies where regulations are not yet set in stone are also followed. If you don't have internal policy documents on how your network is monitored and a kind of minimum standards dashboard, make one and keep records, as it can be invaluable as defense against accusations nonfeasance, misfeasance or even malfeasance.
I've requested scan of ID in the past for suspicious sign-ups, the reasoning is that almost all malicious people would just move on at that point to another target.
Barring that, detect mining and terminate it with system monitoring tools, and prevent port scanning/flooding at your network border (your netops team is active on NANOG and seem to know what they're doing).
I assume they look for name on ID that matches name on payment method. That's what I used to do when I worked in a hosting company ~10 years ago.
This way, if someone has a stolen credit card, there's a very good chance, they won't have a matching government ID with same name. Hence obvious fraud.
Does a prepaid card name verification occur during an auth? Also, does Digital Ocean disallow prepaid cards from being used to pay for service?
Their pricing/billing page indicates they'll accept these cards if the payment is made through Paypal, which will shield them from payment fraud, but not if the card is prepaid but the users actions on the instance are malicious.
Here you see the complexity of the process in that anything that is added or used can be circumvented, including IDs and so forth.
In regards to pre-paid and debit cards we saw a very high incidence of abuse related to those cards specifically so we've had to put certain restrictions on them as well.
We're going to look for other layered approaches that can be created programmatically to increase the authenticity of a user and need to get that implemented asap because I'm in agreement that this ID request is a horrible workflow and also it still isn't fool proof so its just doubly bad.
Running the product prioritization meeting today so we'll bring up a couple of solutions and begin to prioritize and implement.
I've founded a startup that might be able to provide some help in this space. It's basically a mix of being an OpenID Connect provider that does authenticity checks on any information that users provide and makes the results of those verifications available to third-party-sites, all while protecting the actual information itself.
The first market we were planning on targeting was for Bitcoin related services that require KYC verification, but we also are planning on targeting any other services that need to know that their users are not bots and that if they ban a user they stay banned.
We just got some Series A funding and we're doing a crowdfunding from people who want to operate their own Identity Registrar. We should be launching our basic services in a month, and the franchise partners that are planning to participate will be able to do so in about two months.
If your problem can wait until summer is over, we'll be able to have a solution that would be free so anyone with a BlockAuth account can log in with a standards-compliant OpenID login form and you can be assured that they've been verified as being a real and unique person and all of the details they've submitted have been put under a microscope.
An idea to automate part of the verification process is to have a "fill as much as you can or want" form asking for public accounts (facebook, G+, twitter, github, personal web site, non-free email accounts etc) and then generating a confidence score used for a pass/no pass/id required. A service (API) for this is one of the multiple ideas I haven't acted on.
Ah, if it's indeed related to fraud that's a fine reason generally.
I'm worried about a company restricting usage to resources which you have been allocated, as I thought we were well past the problems of shared hosts with the rise of virtual machines / linux containers.
> Aren't you allocating a set amount of CPU to a paying customer?
I doubt they are. While DO boxes aren't bad, in terms of the "bad neighbor effect", I think they very much are oversold. Also, the virtualization tech is a continuum between complete and proper isolation of resources and time slicing of the CPU cycles on the one end, and Linux container style resource sharing on the other. Basically, the more isolated your VM is, the slower it will run. I don't believe DO is using any type of really strong isolation. Because of this, if you start mining BTC on your droplet, you will suck the CPU cycles from all the neighbors.
The biggest thing that should be celebrated about this announcement is the availability of IPv6 addresses. Hopefully the rest of the regions will be enabled soon too!
We are in the process of opening up in datacenters in NYC and AMS which will also feature IPv6 and then we'll be retrofitting the remaining datacenters for that.
So a small number of customers had IPv6 access in one of seven data centers for just over two months. Sorry, but I don't see this as a big redeeming correction (though it is factual).
Just did a quick test from London, comparing lon1 to ams2. Pleasant increase in speeds (25 MB/s up, 20 MB/s down vs. 15 MB/s each way for ams2, though these fluctuate) and a nice decrease in ping (3.5 ms vs 8 ms). Nice to see.
Not sure what the legal/regulatory differences are for hosting in London compared to elsewhere?
On the other hand, one of the nice things with using US services that bill in USD (apart from the current exchange rate benefit) is there's no VAT to pay. So, UK retail customers at least, get a 20% discount compared to using home grown offerings.
Personally, I love being able to spin up Linode (and now DO) vms in London but pay USD prices.
Whether or not VAT is payable is independent of what currency is used to bill in. If you're using a VPS in the UK then there's almost certainly VAT payable by the vendor.
If they are in another EU country, and you're VAT registered, and they have your VAT number they can zero-rate the transaction.
That doc is dated 2003 so I guess the regs have changed (and there have been some pretty major changes recently like CA2006 and FA2011). I certainly don't get VAT invoices from the US suppliers I use (linode and digital ocean for example).
How is there a benefit at the 'current' exchange rate? If the price isn't set in GBP, what have you got to compare against, regardless of the rate right now?
If you were never in that situation, my experience is in paying less over time as both GBP/EUR have been getting stronger than USD.
Plus, pricing in the home currency is usually larger than the exchange rate (i.e. $10 = £5.83, so pricing would probably be something like $10, £6. Or even more - if not $10/£10 - you know who does that!...)
I'm working on the assumption that if they suddenly started offering services in GBP, they'd price at £5 rather than $5 (like virtually all companies do). Meaning the same service would end up costing £2/month more than it does atm with the current exchange rate.
At the moment all of our billing across all of our geographies is done in US dollars, which given the exchange rate of the UK and EU is usually within your favor.
Is there a conversion charge that your credit card company levies on you for paying in US$?
I'm not sure how the dollar price would be in my favour, if you've not specified what the GBP price would be? Sure, once you've set the price it could go either way.
Anyway, as others have said, there are charges and spreads on foreign currency banking. It also adds complications to my otherwise very simple accounting needs.
I'm not speaking for Marco, but another issue with dollars is tax accounts (and especially VAT accounts) for British companies have to be in pounds, so there's overhead in doing the conversions, tracking the exchange losses/gains, etc. We also have to reverse charge the VAT on those transactions as well (though I'd be surprised if the majority of business owners know they have to do that).
About 90% of my company's expenses are in dollars, so I've had to become proficient at dealing with it, but I imagine it's more annoying for companies who only make the occasional USD transaction, especially as they may have smalltime accountants unfamiliar with or unwilling to deal with the exchange rate stuff properly.
Can't you just use the monthly tables published by HMRC for the exchange rate (IIRC, packages like Xero do this automatically for you?). For the reverse charge, wouldn't that always just balance out i.e. input and output tax are always the same?
Its not in our favour unless our exchange rate appreciates every month more than our fees. And yes we get charged just like you would if I charged euros to your card.
This is not true. All Mastercard and Visa cards charge a rate that is specified my Mastercard and Visa on a daily basis. I've been tracking this rate for a few months now, and it's consistently been awfully close to the rate I find on xe.com.
The CARD Act of 2009 mandated that credit card issuing companies clearly describe the fees associated with foreign transactions.
Visa/Mastercard charge a cross border origination fee of 0.80%. However many credit cards (all cards by Captial One for example) waive this fee, and do not charge any fee of their on on top of this.
Regardless of the company, there is always a conversion charge around 2% and the rate applied is never the actual rate, banks usually calculate a rate using some kind of moving average.
Who's that? Halifax? They're great for everything else but non-GBP debit card transactions, and why I moved to HSBC and Co-Operative Bank.
CaxtonFX are also really good for foreign currency cards (2% markup, which is lower than I get with any of my British banks) and have really good customer service too.
Ouch. Seems credit cards out of the US are nowhere near as good, common there to have no foreign transaction fees (apart from probably some margin on the exchange rate).
> I'd never use a Debit Card for foreign currency transactions though, they always seem to have fees involved.
Nationwide used to have commission-free cash withdrawals on their debit cards abroad, but I think it was abused by people who had second homes in other countries so withdrawn a year or two ago. I believe they still offer a commission-free credit card though.
My impression was that the banks made a lot more money from the spread than they did from the commission, so I kind of find that surprising. In Canada it's easy to find commission-free cards. The spread is a hidden fee though, so the banks have hiked that up several times.
I'm pretty sure the Halifax card I mentioned gives the Visa wholesale rate too. I generally get same rate as quoted on FX sites anytime I've checked it.
No thanks.