Ctrl.blog

Account registration and two-factor authentication woes

The registration was initially quite smooth and followed the familiar pattern of entering an email address, phone number, setting a password, and then verifying the number and email address.

After completing these steps I was recommended that I enable two-factor authentication (2FA) using either the Google Authenticator app, or an SMS or automated phone call. I was told that I wouldn’t be able to withdraw funds later without first enabling 2FA, so I proceeded with configuring this extra security precaution.

I tried using the SMS option, despite NIST’s call to deprecate SMS as a 2FA, because it’s the most convenient option. I tried three times to set it up and waited 20 minutes after each attempt for an SMS that never showed up on my phone.

Failing that I thought I’d try setting up the Google Authenticator app on my phone, but quickly ran into another problem: the QR code needed to set up the website within the app wouldn’t show up.

The backend alternated between returning the string “undefined” and links to images that returned 404 Not Found error messages.

With both of my preferred options failing, I ended up choosing the last option which was an automated robot-caller giving me five numbers. I guess I’ll have to deal with that every time I want to login to my Cex.io account going forward.

Depositing money from your credit card

Immediately after registering, I landed on a page where I could enter how much money I’d like to spend on Bitcoin or how many Bitcoins that I wanted to purchase. They accept Visa and MasterCard as long as they’re issued by a 3-D Secure financial institution, or international wire transfer. The latter is so ridiculously expensive and unpredictable that I didn’t even consider it as an option.

I opted for 20 Euros worth of Bitcoin (the smallest possible amount available per transaction) and paid for it with Visa. The process was quite streamlined at first.

The transaction costs were 3,9 % + 0,20 EUR from Cex.io, and an additional 1,7 % currency conversion fee on top from my credit card provider Visa. The sum total of fees for 20 Euros was 1,37 Euro.

After choosing my amount and confirming, I entered my credit card information directly on the Cex.io website (not through a more trusted payment solutions provider.) This took a few seconds, and after verifying the transaction with my bank through the 3-D Secure process (“Verified by Visa”), I was told that my credit card had been charged. My account balance was still 0 EUR, however.

Surrendering your ID-papers

Except for the snag with the second authentication factor, the registration and on-boarding process was very straight-forward until this point.

After Cex.io had charged my credit card and effectively committed me to the process, Cex.io pulled what I can only refer to as “a dick move”. My account balance still showed 0 EUR even after charging my credit card, and I was now told that I’d to provide my government issued identification papers.

To be fair, they do disclose that you’ve to provide them with ID papers in their extended documentation. However, you’ve to read through a lot of legal text to figure out exactly what is expected. The timing of when they ask for identification ensures their customers are properly motivated to complete the tedious process that many will feel uneasy about performing over the internet. It’s definitely a practice that’s good for customer retention, but not customer satisfaction.

The verification process involves photographing yourself along with your credit card will all information clearly visible. You also have to photograph your passport or other government issued identity papers along with your credit card.

I couldn’t find any informational page where Cex.io discloses which external agencies they use to verify your identification papers or who exactly they share your information with. Their privacy policy only say that they’ve outsourced the task to one or more external agencies. The information, along with your credit card information, is stored for at least five years after you delete your account. If you don’t delete your account, there’s no telling how long they’ll store it. They could share it with anyone and the information could be used to steal your credit card or even your identity, there’s just no telling.

More worryingly, the reassuring Help chat widget that had been floating at the bottom of every page disappeared when I got to the verification process. It was still visible on some pages but it was no longer displayed on account or verification related pages.

There were plenty of red flags going up here around this process, but I pushed ahead.

Cex.io has a nice Payment Card Verification Guide that guides you through exactly what is needed to verify your identity. (You may recognize the inspiration for this review’s feature photo on that page.)

After taking some selfies of myself and my papers, I uploaded them directly through the Cex.io website and was told the process would take anywhere from some minutes to hours. Approximately 20 minuets later I got an email informing me that my photos had been rejected.

My selfie were rejected even though my face and papers where clearly visible. I was told that I “needed a 300 dpi resolution photo”; which I’d like to add is a meaningless metric without specifying a dimension to go with it.

My second attempt, using my phone’s superior back-facing camera rather than the front-facing camera, was approved after just ten minuets. Upon completing the verification process I now had an account balance of 20 EUR.

Let’s purchase some coins

I could finally purchase some Bitcoins! I imagine myself holding the sought after digital currency in my digital wallet and being all like Money 2.0 in no time. The dream was quickly cut short, however.

I entered that I wanted to spend 20 EUR to purchase some 0,03663551 BTC. Every step of the way everything showed 20 EUR as the final sum on every confirmation screen. Upon confirming the purchase, however, the receipt now showed 19,99 EUR instead of the agreed upon 20 EUR and my account now had a dead-weight of 0,01 EUR.

Now, this is very strange seeing how Bitcoin is technically and practically infinitely divisible. Cex.io should have been able to charge me 20 EUR exactly as the website and I agreed before the purchase. This “rounding error” meant that they effectively gained 0,01 EUR in abandoned currency as a hidden transaction fee. The minimum purchase sum is 20 EUR, so I can’t use that money. I’ll get back to this point again in the conclusion.

Cex.io also deducted another 0,02 % in transaction fees, but I was made aware of this fee beforehand and [somewhat hidden] in their marketing materials.

Withdraw your Bitcoins? Nope!

I finally had some Bitcoins! All I needed to now was to transfer the digital funds into my digital wallet. Yeah, that wasn’t going to be painless either.

Locating the withdrawal screen wasn’t hard. It’s featured prominently on every page as a big blue button. Cex.io’s website design had so far been intuitive and easy to navigate. There have been some friction points along the way, as mentioned above, but generally they convey information in an understandable fashion.

The withdrawal screen was another story entirely. I can’t accurately describe how it works, but you’ve to know exactly where to click beforehand to get it to allow you to withdraw your hard-fought-for Bitcoins into a digital wallet. It involves knowing that you’ve to ignore the most prominent part of the screen and choose BTC as the withdrawal currency from something resembling a calculator on the right hand side.

As I’d purchased 0,03663551 BTC I wanted to withdraw 0,03663551 BTC. However, the input field for the amount to withdraw helpfully informs me that the maximum amount is 0,03663551 BTC. Which should be fine because that’s exactly the amount I want to withdraw. Except that, of course, it wouldn’t let me continue with the maximum amount entered. I’d to deduct 0,00000001 BTC (a sum so small it can’t be represented in most conventional currencies) to get the withdrawal form to accept my sum as a valid entry.

Cex.io also charged a 0,0001 BTC commission (0,02 %) on the transaction in addition to the 0,00000001 BTC I was forced to abandon in my account.

However, “New accounts aren’t allowed to withdraw funds in the first 48 hours.” Even after complying with all the extensive and intrusive verification process that I never felt all that great about, I’m still not allowed to withdraw my Bitcoins. My account must be at least 2 days old before I can withdrawal my virtual currency. Of course, the withdrawal screen only mentioned this after I clicked the button to make the transaction happen.

By this time, it was 03:00 in the night local time and I was fairly pissed off. Two days later I returned for my Bitcoins, paid my last fees, and closed my account with Cex.io — hopefully for good.

Conclusion

Oh, boy where do I start.

I was annoyed by the appropriately systematic nickle-and-diming (or is it “bit-and-byting”?) during the process. Paying one fee would have been preferable to being charged small sums all through the process. I don’t even know how to calculate the total fees I ended up paying!

Having the system make you abandon small amounts of currency in your account is also not very reassuring. One such instance would be excusable as a programming error, random happenstance, or a rounding error. However, when it happens at every point in the process it leaves you with a bad feeling about the whole experience. I wouldn’t say Cex.io cheated me, but I do feel wronged when they skimmed off those abandoned funds off the top of my transactions.

Their “Licenses and Certificates” page lists various government and private authorities presented as endorsements. The problem is, of course, that they link to documents clearly stating that the certificate or business license can’t be used as an endorsement even though Cex.io presents them to customers as a kind of badge of honor to create the illusion of trust and endorsement.

The lack of transparency about the payment and identity verification agencies used by Cex.io makes it hard to establish trust. I don’t know who got a copy of my passport and credit card nor anything about their reputation nor the physical location of their operations. It could be well-known credit card scammers for all I know.

I felt good about the transaction until the point where I’d to verify my identity and readily available support options started disappearing from the website. I felt uneasy about every part of the identity verification process, and I don’t feel any better about it now. The process made me feel like I wasn’t dealing with a legit or serious company that would keep my personal data safe.

To summarize how I feel about the trustworthiness of and lack of transparency from Cex.io: I’m going to get a new passport and invalidate my old passport. I’ll also get a new credit card.

If you have no better Bitcoin exchanges accepting customers from your country, I’d still choose Cex.io again over their competitors. I’m definitely not recommending them, but Cex.io seem to have a better reputation than the rest based on other reviews and the company’s history.

Fortunately, there seem to be at least one better alternative available. Check out my Cubits.com review!