GPUYard.com - Beware of post-payment KYC and stolen funds.

WyvernCo

@leascomenconf Thank you for the warning and if you have not already, please leave them an honest trustpilot review for the vendor highlighting the surprise KYC. Any vendor that KYCs post-purchase deserves one (and especially one with a no refund policy!)

GpuYard

@forest said
I was under the impression that an A->B->A transaction was typically considered to have originated from A by most modern blockchain analysis companies.

Since this specific point keeps getting bumped, let me clarify exactly why returning funds "A -> B -> A" is absolutely not "risk-free" for a legitimate hosting provider in the real world.

1. Blockchain Tainting & LEA Scrutiny:

Refunding dirty crypto creates a permanent, public blockchain record connecting our clean corporate wallet directly to a highrisk/dark net wallet. When exchanges (where we liquidate to pay data center bills) or Law Enforcement Agencies run Chainalysis, they don't just see a "refund." They see our business wallet interacting with criminal funds. That puts our entire legitimate operational cash flow at risk of being frozen. We have had LEAs question us over exact scenarios like this in the past. We prefer zero interaction over a "refunded" interaction.

2. The "Zero-Risk" Exploit:

If we guarantee a seamless, no-questions-asked refund the moment a malicious user hits a KYC wall, we become a free testing ground. Botnet operators and spammers will constantly test our provisioning. If they get a server, they abuse it. If they hit KYC, they get their money back and try the next host losing absolutely nothing. Freezing unverified funds is the only real financial penalty that deters them from testing our network.

Our stance remains rock solid, and our offer to the OP still stands:
Submit Verified KYC = 100% Full Refund + 1 Month Free Server. Refuse KYC = Funds remain frozen on compliance hold.

We’ve laid out the technical, operational, and compliance realities. We are officially logging off this thread now. Have a great weekend, everyone!

tentor

@forest said:
That's not entirely true. You are allowed to return it to the same wallet, but you can't return it to another cryptocurrency or different payment method. For example, you can't accept BTC and then refund it in a bank transfer, as that would be a money laundering risk. But giving the BTC back to exactly where it came from is legal and risk-free.

Merchant would also need to ensure that same UTXO merchant has received from that customer is refunded. Otherwise it is kinda a mixer even if returned to the same source address.

forest

@tentor said:

@forest said:
That's not entirely true. You are allowed to return it to the same wallet, but you can't return it to another cryptocurrency or different payment method. For example, you can't accept BTC and then refund it in a bank transfer, as that would be a money laundering risk. But giving the BTC back to exactly where it came from is legal and risk-free.

Merchant would also need to ensure that same UTXO merchant has received from that customer is refunded. Otherwise it is kinda a mixer even if returned to the same source address.

That's a relatively minor issue, imo. The bigger issue is having all the information necessary to decide whether or not to KYC someone (in this particular case), yet accepting the money first.

I understand that there are situations where you'd have to KYC after, such as flagged transactions that you can't detect until the payment goes through, but if the KYC is triggered by registration IP + selected payment method, it's irresponsible to accept the money first, knowing it can't be given back without passing KYC. After all, the customer might simply be in a country that the KYC provider doesn't support.

whynotlearn

@forest said: That's a relatively minor issue, imo. The bigger issue is having all the information necessary to decide whether or not to KYC someone (in this particular case), yet accepting the money first.

Yea just ask for KYC first before accepting the payment if this is the case, They shouldn't accept the money in the first place before asking for KYC.

sillycat

@GpuYard said: They see our business wallet interacting with criminal funds.

You already interacted by accepting the payment.

maxxxxx

@GpuYard said:
1. The "Anonymous" Profile (The Red Flags):

This user registered using a fully encrypted, anonymous email service (tutamail.com). They paid using untraceable Cryptocurrency (BTC / USDT). Most importantly, our logs show that this order was placed via IP: xx.xx.xx.99, which belongs to (REGXA LLC) a known Data Center IP heavily associated with Tor Exit Nodes and proxies.

Tutamail doesn't even allow registrations over Tor so your point is not valid at all.

@GpuYard said:
2. Why KYC was Triggered:

Anonymous Email + Crypto Payment + Tor Node IP = 100% High-Risk. No legitimate customer buys powerful Dedicated/GPU servers while hiding their entire digital footprint behind a Tor network. Our automated security systems immediately flagged this and requested mandatory Identity Verification (KYC).

You knew all that before you took the money. And yes there are legitimate reasons, not even just for personal stuff but also legitimate business reasons.

@GpuYard said:
3. "Post Payment Surprise" is a Lie:

Before any checkout is processed, every user must explicitly check the box: "I have read and agree to the Terms of Service." Our TOS explicitly states that KYC is mandatory and that Crypto (BTC/USDT) payments are strictly non-refundable, especially if a user refuses verification. They legally agreed to this before sending any funds.

This is plain stupid. You either have a legal obligation to perform KYC or you don't. Obviously you don't.

Why do I say this is stupid? Putting KYC in the TOS does not make it legal without other GDPR obligations being met. You need to have valid legal basis to do it and your TOS is not one of them by itself.

If you are required by law to do KYC then you would have to state that as the KYC clause hidden in your TOS would not be valid "consent", it's not even a correct legal basis in that case.

@GpuYard said:
4. AML Compliance vs. "Theft":

The user flat-out refused to verify their identity. Returning untraceable cryptocurrency to an anonymous, unverified actor hiding behind a Tor node is a direct violation of international Anti-Money Laundering (AML) protocols. We do not refund crypto to unverified users because we refuse to let our platform be used as a financial revolving door for dark web activities. The funds are placed on a strict compliance hold.

Amusing. First you accept the money. Then you demand KYC based on your TOS and now the refund request you have provoked yourself you call a violation of AML protocols. This must be some alternate reality I have stepped in.

If OP is such a genious as you think and his goal was to "provoke" you to ask him for KYC so he has an excuse to ask for a refund because he wants to launder money that way. The solution is simple, give him the service he paid for. What will he do? Idle the server for a month?

@GpuYard said:
5. Our Offer for a Full Refund:

To demonstrate our absolute good faith and commitment to lawful business practices: If you genuinely require a refund, the solution is simple. Complete the mandatory Identity Verification (KYC) process to prove you are a legitimate individual. Once your identity is lawfully verified and we can confirm this is not a money-laundering attempt, we will gladly issue a 100% full refund of your payment.

KYC can not prove that he is a "legitimate individual" or that this is not a money-laundering attempt. I'll mention again "money-laundering attempt" that you provoked youself so just give the OP the server he paid for and let him idle it. He will not be happy his "money-laundering attempt" via the refund has failed.

@GpuYard said:
Conclusion:

We prioritize the safety of our network and the wider internet over accommodating anonymous users who refuse standard verification. We have zero tolerance for cybercriminals who try to weaponize consumer protection laws or use public forums to blackmail us into bypassing security protocols.

Cybercriminals? The way you are handling things real cybercriminals can have a vacation laundering money through your company. Looking at your statements this is not about stopping cybercriminals but protecting yourself because you don't have other valid measures do deal with cybercriminals.

@GpuYard said:
And to reiterate, we aren't keeping this as profit. The funds sit in a compliance hold. The user has a very simple, legal path to get 100% of their money back to their source wallet today: Just complete the KYC. Legitimate customers don't mind proving they are real people to get their money back.

Sure. Legitimate users don't mind risking their identity stolen over 251$. If I was in OPs place I would not do the KYC either but I would not have a problem with taking your company to court. Guess you'd be very happy verifying my identity that way

@GpuYard said:
This isn't just theory for us; it’s a lesson we learned the hard way. A while ago, a user purchased a server from us and used it to launch a ransomware attack on a well-known company in Europe. When that country’s cybercrime investigation agency contacted us for his details, we realized this bad actor had been a customer for several months, paying via USDT. At one point, he had paid for a bandwidth upgrade that we couldn't immediately fulfill, so we refunded the USDT back to his wallet.

Perhaps just don't take money for services you can't provide. Problem solved.

@GpuYard said:
The cyber investigation agency specifically questioned us as to why our business wallet sent funds back to a known cybercriminal's wallet. That incident is exactly why a strictly enforced KYC policy before any refund is now non-negotiable for us.

In that case I'd simply ask them if it's a "known cybercriminal" and they can't put him in jail what the fuck they expect me to do about it? And I'd simply tell them to fuck off bothering me with such questions since they're unable to do the job I'm paying them taxes for, plain and simple.

Levi

Damn, that went south very quick. Yard guy - refund and be over about this. Lesson learned. As you do not provide cheap servers for low end audience, refrain from further participation in this forum regarding this drama.

Just stop right here. We have a case where business owner explicitly banned clients from LET, we don't want another one. Your services are needed, they are niche. Don't drive down your reputation here.