Ask HN: If your SaaS was used to commit a financial crime, what should you do?
Hypothetically, if your Solo-Founder SaaS was used a suspicious customer based in Russia to access a USA financial institution.
Get a lawyer involved, and then ring up the local cyber crimes unit and be prepared to dump all this evidence. There's a lot of interplay b/t security teams and law enforcement over this stuff so it's not unusual. They'll be happy you reported. Anyone can use a SaaS platform, worst case you might get a rude awakening on the need to do KYC/AML or some sort of user onboarding regulations that you weren't aware you had to follow. This is all about due diligence and if you did it once you knew you had to.
Using intermediary infrastructure to dodge OFAC sanctions or w/e like this is isn't uncommon. The uncommon part is being able to get knowledge on the intermediary infra (your saas), so you're doing a solid by reporting it and providing logs.
When something similar happened to me I was eventually contacted by the California computer crimes task force, IIRC. Very simple phone call, asking for notes I kept on the situation. Polite.
Then I got looped into the prosecution's long and kind of annoying email chain to everybody involved before there was an eventual going-nowhere of it all. Surprising but that's what happened. So you never know but some basic diligence is typically a good idea. This is not legal advice.
Generally you do a few things.
If something makes you feel uncomfortable, and your agreement allows it, close out the customers account.
Just like facebook / google and friends, I've found it better NOT to get into a lot of back and forth or just point to a generic policy (ie, overseas accounts not supported).
If you need to refund money, make sure you only refund to same payment method. Ie, a credit card refund should not go out by check. I've seen scammers use this with a stolen card, then try and get the refund by check. A few months later card owner contests bill. If you refund back to same card, then when owner protests, the money is already back, nothing to protest.
Consider a hold on funds if you are concerned that they will be returned to issuing entity if you a in the middle on a payment flow. If so you want to make sure your money handling stuff is compliant anyway with KYC and transfer licensing needs.
The cost of information leak is borne by the poster, but the value of the information is gained by those readers. Thus, there's asymmetric benefit.
2. Lawyer up
You might know us from the recent SuisseSecrets (https://www.occrp.org/en/suisse-secrets/) as well as covering russian laundromats through european banks: https://www.occrp.org/en/laundromats/
you can also reach out through jurre[@] occrp dot org
I'd recommend not changing anything about how your app functions until you follow the common advise here. Ask your attorney when you can make code changes. You may be destroying evidence even if it's just "the path they took"
An attorney will know how to navigate this in a way that protects you.
Why not? I always find this "don't take advice from non-lawyers" to be annoying when I've listened to a lot of really idiotic theories by lawyers. And who knows, you might also find some lawyers right here on HN.
There are only two possible outcomes to such a thing: (a) you are not entirely forthcoming about all potentially relevant details in that public forum and therefore the advice cannot be relied on in your particular situation; or (b) you are entirely forthcoming about all potentially relevant details in that public forum and therefore you've waived at least some of the protections of confidentiality and privilege.
> Why not?
Lack of expertise. Likelihood of conflict of interest. Lack of accountability. Lack of (because you almost certainly won't be willing to disclose enough, and if you did that has its own problems for your legal situation in many case) adequate information about the relevant facts.
(That's not to say you can't get legal information on which you can follow up from the internet, but there is a big difference between that and legal advice.)
I've had multiple high priced lawyers with years of experience in the area give me completely, factually wrong information about THEIR PRIMARY PRACTICE AREA over the years. It still blows my mind.
In one case, I was stupid enough to believe them even though I knew it didn't quite sound right and it cost me an immense amount of money and a huge amount of stress in the resulting litigation.
And I know they were completely factually wrong because I had double checked with them what they said, they confirmed it (reiterated it actually) - and then it was very much not correct, as confirmed by the following court case which I had to settle, because I had been operating under a factually wrong view of the law. Not even 'eh, could go either way', but 90% of the lawyers I interviewed for the follow-up litigation literally said 'Well, that's dumb. Why did you do that? Of course you're going to get sued. Did you write it down you were doing that? Well, you're in deep trouble. Sorry, my calendar is booked solid, can't help you.'
More recently, while interviewing civil litigation attorneys, I had one who was referred to me with excellent references. Easily 20 years of practice too, I forget the exact number I pulled from the Bar.
I had done quite a bit of research on the area. Specifically I had tracking down and read the complete civil procedure that defined the applicable statue of limitations, and did some cursory research on the case law around it. I also pulled the applicable penal codes, case law, and civil damage claims - in this case Conversion, Grand Theft, Subornation of Perjury, Perjury, and a few others - and had figured out the likely elements of the crimes that were applicable, which I could prove and how easily, which ones were iffy, etc.
When I laid out the evidence and the case, he tried to convince me that I was outside the statute of limitations (even though it had only been 6 months since the event had first occurred, and was still ongoing), and that the court would throw it out and I'd be liable under anti-SLAPP - even though I could prove the party involved had committed perjury and filed a false police report, and there was no plausible claim it was a matter of public interest.
The case law is quite clear that perjury is not a protected type of speech, and matters of public interest are also clearly defined enough that this wouldn't apply at all. So the anti-SLAPP statute couldn't apply.
I would have to prove perjury, but I literally had solid, fully contextual video evidence that showed that what was claimed in the other parties court filing (initial AND follow-up) was not and could not have happened, AND it showed that the opposite had happened - they were the party at fault, and they had to have known it, or were clearly mentally incompetent.
This video was from cameras the other party had requested be installed, AND knew recorded these things/area, AND that they knew I had access to and had their permission to access/download from.
When I asked him why he thought it was outside the statute of limitations since the applicable statute of limitations for civil claims in that state cut off at 1, 2, or 3 years for civil claims (and this was likely a 3 year case due to violations of the penal code), he literally sputtered out 'you knew that?' before making a rapid 'I wish you luck sir', and hanging up on me.
Bullshitters abound, and Lawyers are better than most at Bullshitting as it's a large part of the job. Same as sales folks. Most lawyers customers are in dire straights, overwhelmed and overloaded, and in trouble and changed life circumstances that they don't understand for reasons they have difficulty processing/understanding, let alone breaking down or describing in a coherent way.
If they run across someone who looks good, says what they want to hear, and has the trappings (books, the office, the tie, whatever), 99% of these customers can't or won't be able to do critical thinking on what is being said, let alone cross reference it with something concrete or do their own research.
They also don't have the time or are in life circumstances in most cases to interview enough attorneys and learn the relevant sections of law to do basic bullshit checks either.
There is a reason the Bar and licensing/testing exists - without it, it would be an even bigger disaster and shark chum feed. It's also been my experience that about 80% (or more) of licensed practicing attorneys are happy to bullshit you with happy go lucky stories about how they'll get x thing done, or you totally have a case, or you can totally do this thing and it'll be fine, when, while not impossible, that's just not really a good idea for you. And will happily turn the crank on billable hours producing things that look really cool and impressive if you don't know what's going on, but are often riddled with factual errors, missing useful procedural elements, or not providing evidence in a way that is going to make the case clear and easy to judge. At least that gets them paid in the resulting disaster or while it churns on with no end in sight anyway.
You also can end up with 'this is impossible', or 'that is not how it works', when actually, it could be done, it's just outside of their area of expertise (and they don't want to admit they don't know).
To the original point, it is rare to have someone give completely, clearly factually incorrect information about their specialty, but it does happen. If you interview 10 lawyers, you'll find at least one, probably two in my experience who will do so.
If I had written records of the wrong advice in my situation (instead of phone calls), I would have filed a complaint with the Bar, but lawyers are unfortunately ALSO pretty good at covering their asses, and the Bar is pretty good at looking like it's going after folks without really changing anything. So not worth trying frankly.
Caveat emptor.
For the same reason you wouldn't take technical advice about how to structure a scalable backend from the guy who mows your lawn.
I've listened to a lot of really idiotic theories by lawyers
Lawyers can, and will, say a lot of stupid things, because lawyers are very opinionated people and like to argue. It's why many of us became lawyers. But when we have a client the things we say and do with respect to that client's case are made on a professional basis (i.e., with at least some support from the facts, law, cases, etc.).
Liability (there's other good reasons the other commenters are pointing out too, but this is the most important one).
If your lawyer tells you something completely wrong that gets your entire business fucked by the US government then they (and ultimately, their insurance) is on the line for that.
If you follow a dumb comment from HN and destroy your business that's all on you.
The attorney you consult about the potential malpractice claim against the first lawyer may tell you that that's not an accurate description of the professional standard of care that is applicable, but, still, a lawyer you hire is more accountable than hnwhiz679.
Is it possible to win? Yes. May god have mercy on your soul.
But in all seriousness - yes. The only viable piece of advice is which lawyers should one consult.
You shouldn't be talking about this publicly either. You could be compromising the future investigation.