preventing fraud in crypto Payment when paying with a payment instrument in fiat currency within the EU, the transaction is covered by the PSD2, which provides prudent protection for payers and their payment instruments. When the transaction is instead executed in bitcoin, an unbacked crypto-asset, the transaction is not covered by any EU regulation despite it being used as a method of payment for goods and other services. This leaves consumers in a bad position if their electronic wallet has been abused for fraudulent payments in unbacked crypto-assets as the victim bears the full loss and there is no option for rectification. Change is warranted around crypto payments as the current legal situation leaves consumers unprotected and vulnerable to digital economic crime. This article examines possible solutions to deter criminal activity in the crypto economy, and how to make financial regulation more adept to make crypto payments safer and protect payers in cases of payment fraud.
1. attacks on the world of crypto assets:
including cryptocurrencies, continues to be a returning problem for the crypto economy and the holders of crypto-assets. In the first half of 2024, crypto hacking thefts doubled to $ 1.38 billion compared to the same period in 2023, where thefts “only” amounted to $ 657 million.2 A precursor for this increase though, is the significant increase in value of some crypto-assets, causing criminals to be able to gain more when they perform their attacks.
Taking a closer look at some attacks from 2023,4 the details appear comparable to the issues present in regular payment fraud, something the 2nd Payment Services Directive5 (PSD2) provides measures to protect payment servicee users from, both before and after payment fraud has occurred. Some crypto payments, where the payer pays in crypto-assets which are covered by MiCAR’s6 definition of E-Money Tokens (EMTs), are covered by the protective measures of the PSD2, as these are covered by the Directive’s ‘funds’ definition. For other crypto-assets, particularly the popular bitcoin, this is not the case. Bitcoin does not have an issuer on which the holder has a claim, as required by MiCAR art. 49(2) to be considered an EMT, and hence is not covered by the ‘funds’ definition of the PSD2.8 This means that payers using bitcoin, and other unbacked crypto-assets, as their means of payment, are not covered by the protective measures of the PSD2, resulting in no right of rectification in cases of theft or fraud as the victim of such a loss will have to cover this burden entirely on their own.
2. (Its Achilles) The technology behind crypto payments:
To understand the vulnerability of crypto payments and the potential for criminal activity, it is necessary to explain the technology behind the crypto payment system. To comprehend the difference between fiat payments and crypto payments, even when using a debit card, a visualisation of different layers can be useful.
With fiat payments there are two layers of security, first the SCA applied when using the debit card for a payment transaction and then the underlying interbank payment system.14 SCA consists of at least two of three possible elements, which can be something the payer is in possessions of, has knowledge of, or biometrics. This secures a high level of security for each payment transaction and is mandatory for all payment service providers covered by the PSD2.
Where payments in fiat currencies is settled through the interbank payment system, payments in cryptocurrencies entails another, deeper level of settlement. For crypto payments, another layer is added consisting of the underlying blockchain technology validating, verifying, executing, and storing the transaction. This extra level is also considered an inherent characteristic of cryptocurrencies. The existence of crypto-assets is connected to an underlying distributed ledger technology (DLT), often a blockchain like the BitCoin blockchain.16 The property right to each crypto-asset is stored in a separate hash in a block on the blockchain. When the property right to the crypto-asset being used for a payment transaction is transferred to the payee, the transaction has to be verified and validated on the underlying blockchain
3. can the problem be solved through regulatory invention?
With the activities already being covered by existing criminal law, there is no apparent need for further criminalisation of the activities. A problem that was found in the Tuppawan Boonyaem v. Persons Unknown61 was instead the anonymity of the individual performing the criminalised activities. This problem is inherent to the nature and intended design of the crypto economy, but has also been critiqued when considering money laundering and terrorist financing risks in dealing with crypto-assets.
Have you ever lost crypto to fraud with no way of getting it back?
