Hi Bitsafe team

I can't believe I used to recommend your service.

Here's how your team's absolute incompetence and unwillingness to communicate lead to my account being blocked and 837€ missing.

First, a lesson in phishing.

I can't believe I need to spell out such obvious things, but here we are.

Phishing is a common way of stealing information from people, and it's been in use since the dawn of the internet. Anyone who has been online has heard of this scam technique.

Anyone who works within or close to the financial sector should be intimately familiar with how this scamming technique works.

Here's antivirus company Norton's article on phishing:
https://us.norton.com/internetsecurity-online-scams-phishing-email-examples.html

Here's the Federal Trade Commission's article on phishing:
https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams

As we see from the FTC website, the common phishing scam begins with an email that looks to be from a legitimate source, and is suspiciously looking to gather information from the receiver.

Please take a moment to familiarize yourself with the traditional phishing scam.

Now, in the following video, you'll see how a scammer uses a similar domain attack to fool this Youtuber into giving away his account information.

https://www.youtube.com/watch?v=YIWV5fSaUB8

You might be thinking - oh that's just some dumb Youtuber.

No, this is Jim Browning, with over two decades worth of studying and fighting scammers on the internet.

Why did he fall for the scam? Because the attacker's url had "google" in it.

Note, the address didn't end in google.com, as any address would if it was from the Google-company. The word "google" was in the middle of the url.

That's what makes it a scam.

All that being said, you'd imagine a financial service institution of all things would NEVER ask for personal information without first establishing trust and authenticity of the message.

A financial institution would never ask for sensitive information with their company name in the middle of the url.

And yet, we have Sara.

Sara, from the "compliance team."

Sara, who is unfamiliar with common phishing techniques, doesn't understand basic online security, and lacks basic people skills.

Here's what happened today 21.10.2021.

I receive an email from Sara, which is surprisingly similar to a phishing scam email. In the email Sara was asking for personal information relating to my Bitsafe account. And while Sara addressed me by name, the domain she was writing from was not bitsafe.com. It was "bitsafe.support".

As a security professional, my alarm bells immediately went off. Getting an email like this out of the blue was strange to say the least.

So I asked Sara why she wanted to know these things.

No response. Sara's way too important to let a plebeian like myself know what's going on.

Confused, I went to the Bitsafe website to see what the actual contact address for the company is. And as you see in the attached image (img1.png).

The contact address clearly points to a bitsafe.com domain.

So I alerted Bitsafe that there's suspicious emails coming from a person claiming to be from Bitsafe.

But... here's Sara with a brilliant new tactic.

She somehow intercepts my email and sends me a new email from the original "bitsafe.support" address.

Does she react to the fact that her communication looks like a phishing scam? No. With no explanation as to who she is, she instead repeats her earlier inquiry about my personal information.

At this point I'm real confused, so I ask her to provide some proof or credentials that she's actually working for Bitsafe.

As we've noted, Sara doesn't do the communication bit with plebeians like myself, so there's no response.

This all stinks to high heavens, so I start doing some digging on Google and asking a couple of friends how this is supposed to work. I eventually find the "open support ticket" button in my Gmail, which leads me to the https://help.bitsafe.support/ site.

Why didn't Sara point me to this direction in the first place?

Why didn't Sara give any indication as to her motivations and reasons?

Why Sara? Why do you so torture us who are beneath you?

On this sacred support website, I now see the whole conversation and it's linked to Bitsafe, at least in name.

So I respond to the support thread, demanding some explanation as to what's going on. I still have no clue who Saint Sara is. I still have no reason to trust what she says, much less provide her with any sensitive details about my account.

But since I now have some semblance of trust that Bitsafe.com and this shoddy support site are somehow connected, I respond to her inquiry.

As for Sara's inquiry. She asks:

1) Why did you open a Bitsafe account, where do you use it for?
2) What is the source of your incoming funds?

Now, I realize Sara doesn't communicate on the same level as us normal ground dwellers. I realize it would be presumptuous of me to assume she meant literally what she wrote in the question.

But literal or not, when it comes to accurately assessing someone's financial background, these questions are as vague as they come.

Note that I have tried to ask for more information and for Sara to elaborate on her motivation to ask these questions, without result.

As such, my responses are accurate, honest and fair.

The first question: Why did you open a Bitsafe account?
My answer: For bank transfers.

This is true. I can't for the life of me think of another purpose for a bank account.

The second question, also known as the latter part of the first question: Where do you use it for?

Here of course lies the true poetry of Saint Sara. Instead of asking something a mere mortal like myself would comprehend like "What do you use it for," she asks "Where do you use it for." Which can mean a thousand things.

So I answer again: From bank transfers.

This is true. This is where I use it for. I probably made a grammatical error here though, so that's on me. I guess the correct answer would've been "Into bank transfers" or something like that.

The third question, which is also the second question: What is the source of your incoming funds?

And my answer: Bank transfers.

This is 100% true and this is where my incoming funds are sourced.

I imagine this is where Sara's high horse huffed and puffed and galloped away in a cloud of hubris, because suddenly "Bitsafe management" dropped in to respond to my questions.

Fortunately "Bitsafe management," while rude and unreasonable, was more responsive than Sara.

Unfortunately, "Bitsafe management" was also unwilling to listen to my wild claims about phishing and online security, and hurried to come up with reasons to block my account.

Bitsafe management promptly said their whole team, on the behest of Saint Sara, had declared a unified decision to shut down my account post haste.

No amount of reason would change their mind. They just wanted a copy of my bank statement so they could get my funds out of Bitsafe ASAP.

As I sent my details, their responsiveness soon died out, and I now have no idea whether I'm going to get my funds back, much less when I'll get my funds back.

You'd imagine a professional support rep would at least confirm receiving the documents requested.

Now, to be quite serious, due to the absolute ineptitude of these people, I'm now down 837 euro.

401 euro is in transfer limbo. Will it ever arrive to the Bitsafe account? I don't know.

436 euro is stuck on hold. Will it ever be returned to my other bank account? I don't know.

Was any of this necessary?

No.

If you had the slightest clue of how to run an online business, you'd make sure your customers know who, how and when will contact them.

Oh and you'd make sure the email addresses on your website are the same. Yes, it's only when I was looking for the COMPLAINT PROCEDURE did I notice that you also mention the "bitsafe.support" contact on your website.

See attached image (img2.png)

If Saint Sara would've just for a moment exercised even the slightest bit of customer care and informed me that this is the official Bitsafe support-email contact, we wouldn't be in this mess in the first place.

So what do we do, Bitsafe? When do I get my 837€?

I know communication isn't your strong suit, but if you need more information or whatever, could you please just let me know what you need so I can give it to you?

I don't want to have to drag this out for months and escalate such a non-issue to however many consumer complaints departments in Europe. I'm happy to close my account since you clearly don't want my business, but please let me take my money out first.

But make no mistake. If this isn't resolved in a calm and prompt manner and I don't have my money back within a reasonable timeframe, every financial protection organization will hear of this.