Author Topic: Strange customer... (Read 51,500 times)

John2k · « **on:** October 09, 2007, 01:43 PM »

Hi,

Firstly, great site!

I need a bit of advice concerning a customer of mine. I recently just completed an encryption program for him, and now he wants to draw up a contract to finalise everything. The thing that worries me, is that he wants to view a copy of my passport to validate who I am plus my address etc. I've never heard of that before! The customer lives overseas, and he says that he wants to protect himself for when he makes his payment to me.

What should I do about it? Is giving the information he wants necessary?

Thanks for any help.

John.

f0dder · « **Reply #1 on:** October 09, 2007, 02:21 PM »

Hmm, that sounds a bit fishy to me.

On the other hand, I had to fax a copy of my student license + visa card to datarescue when I purchased IDA, since they've had a lot of stolen credit-card purchases... but that's a somewhat different situation than yours.

I'd definitely blank (and I do mean blank, not blurring or pixelizing etc. as those can be reversible) out any control codes etc. on the passport, so the image can't be used for forging a new passport. One can never be too careful.

Ralf Maximus · « **Reply #2 on:** October 09, 2007, 02:27 PM »

Nothing beats the advice of legal counsel. If you don't have a lawyer you can call up and spend 15 minutes asking simple questions of, then contact your local bar association and explain what you're after. This is exactly the kind of thing I ring up my lawyer about occasionally and if the call is a few minutes or so sometimes I don't even get billed.

My gut feeling is that since it's encryption related + overseas, he may be concerned about US export requirements regarding encryption. Could be a simple documentation procedure we are unaware of until it becomes an international sale.

John2k · « **Reply #3 on:** October 09, 2007, 02:34 PM »

To be honest, I am pretty much clueless with selling bespoke software.
I don't know the normal procedures involved with exchanging software, money, licensing etc.

I got a sinking feeling when he mentioned a passport, maybe it could be some kind of identity scam?

I should have looked into it all thoroughly before I even started programming.

Ralf Maximus · « **Reply #4 on:** October 09, 2007, 02:46 PM »

Keeping the relevant facts confidential, can you describe what kind of business arrangement you made before you delivered the code? Did you sign a contract?

Have you accepted any payments (cashed the check)?

Veign · « **Reply #5 on:** October 09, 2007, 02:50 PM »

Another option is to use a service like http://www.escrow.com and let it provide the protection. Or have him pay through PayPal where you never get his payment information.

I would not send my passport. And, you've probably been told this before, you should have had contracts drafted before the project started.

What is the value of the project?

John2k · « **Reply #6 on:** October 09, 2007, 03:05 PM »

Hi Ralf,

I havn't delivered the code yet, or took payment.

The customer contacted me to expand on a previous program that I had written. He stated that he was starting a software security company and needed an application to get up and running with. So he made an offer of a lump sum payment, and also a percentage of the software's revenue. After 2 weeks of wrangling out a design with him, I had come to the conclusion that he was asking for the impossible, so I suggested that another much simpler design which required small changes to the original code. We agreed on a price, and I got to work on the new design.
Yesterday I virtually finished the program(minus a few tweaks) and informed him. So up to now the last contact I had with him is asking for the passport, address etc.. He does want me to sign a contract and stop distrubuting the program that his is based on.

@Veign - Payment by his request, would be by bank transfer. I believe it's the safest way?

Thanks,
John.

Ralf Maximus · « **Reply #7 on:** October 09, 2007, 03:19 PM »

Passport requirement is a bit weird, unless you're a non-US citizen. What's your citizenship status? (Assuming you are located in the States and he is elsewhere.)

"Stop distributing the program that his is based on"? So you have an existing product, and he wants you to stop selling that too? Unless this was expressly agreed to before hand (doesn't sound like it) that's a rather bold demand. Especially if you derive income from the existing product, have an installed base of users, etc.

If the money's only so-so, I'd consider taking a walk. It's not worth keeping a business relationship going with somebody who'd make these kind of last minute requirements. Chalk up your time/work investment as a lesson learned and move on.

On the other hand, the money might be so tempting that you'd be willing to stop selling your existing thingie. Assuming HIS business model supports income for you, is successful, and you trust him to pay you in the future. All real concerns, especially more now since he has seemingly modified your informal agreement without consultation. That's a sign of bad faith, based on what I understand so far.

At this point, I wouldn't sign ANYTHING without passing the proposed contract through the hands of legal counsel. A contract review would take a few minutes and is worth whatever you pay for it to avoid future headaches.

mouser · « **Reply #8 on:** October 09, 2007, 03:20 PM »

an escrow service might be a good solution in general, but if he is wanting to be sure who you are, it seems to me like a bank transfer should give him that assurance and would be safe for everyone.

i would not send a passport scan.

it's probably just that he wants to be sure you are who you say you are so that he knows who he is dealing with, but there has to be a better way to give him such assurances besides sending confidential information like passport details.

Veign · « **Reply #9 on:** October 09, 2007, 03:28 PM »

To be honest, I would never supply bank routing information to a client. If a client wanted a 'bank transfer' type of payment I would have them use PayPal and I would eat the cost of using PayPal.

What sounds really fishy to me is he wants your passport, bank routing information and all personal information (address and such). That sounds scary.

Another thing I have learned doing freelance work is to have all contacts signed before starting a project. Signing a contract after work doesn't make sense since the purpose of the contract is to define, for lack of a better term, this-for-that.

How much is this project worth?

f0dder · « **Reply #10 on:** October 09, 2007, 03:32 PM »

Also, never-ever go for a "payment on success" payment strategy, I've burned my fingers with that crap.

John2k · « **Reply #11 on:** October 09, 2007, 03:42 PM »

Thanks for all of your replies.

Originally I wanted to use PayPal, but as mouser said, it would confirm to the customer who I really am, and put the customer at ease.
Although, asking for so many personal details, it could be a bad idea.

The project value is $5000 as is, and $2 per unit sold. Not great, but not bad considering I wasn't earning a great deal with the current version, plus a relatively short development time. He has proposed future applications at better rates.

I am from the UK, and he resides in Canada.

Quote from: f0dder on October 09, 2007, 03:32 PM

Also, never-ever go for a "payment on success" payment strategy, I've burned my fingers with that crap.

The wonders of hindsight!

John.

mitzevo · « **Reply #12 on:** October 09, 2007, 03:45 PM »

You could just ask them/him/her why they need that information. [And if they ask why you asked, for your own protection of course.]

Quote

he says that he wants to protect himself for when he makes his payment to me.

Quote

He does want me to sign a contract and stop distrubuting the program that his is based on.

Insurance I guess - So if he finds out that you have broken the contract in any way, i.e., started selling your own slightly modified version of his product, he can sue *some body* instead of trying to track down your net identity (which would probably be easy any how).

So I think best is to just ask why he needs what he wants and explain why you care.

Ralf Maximus · « **Reply #13 on:** October 09, 2007, 03:54 PM »

Ah. Forget what I said about US crypto rules -- they don't apply to a UK/Canada transaction.

As mouser suggests, don't give him your passport. There are other ways to prove your identity without giving up your personal history. He might be looking at the contractor tax angle and simply be looking for data necessary to declare his expenditures to the tax man, and requesting it in a ham-fisted manner. Might be worth a polite inquiry as to why he thinks he needs your passport data.

$5000 doesn't seem like enough to give up any existing/future software sales of your current product, especially since the $2 per unit sold is based on HIM doing everything right. Most business ventures don't work out, so the odds are against you seeing any royalties.

It occurs to me you hold all the cards. Push back with a revised contract eliminating his silly requirements and see what happens.

John2k · « **Reply #14 on:** October 09, 2007, 04:06 PM »

I just emailed the customer and told him to forget my passport (politely).

The revised contract is a good idea. When I receive one from him, I'll post it up so you can all take a look.

Thanks for the all of the advice, appreciate it!

John.

Darwin · « **Reply #15 on:** October 09, 2007, 04:27 PM »

John2k -good move! As a Canadian (albeit not a lawyer, software developer, etc.) I can tell you that the information that the customer has requested of you doesn't sound right - I've never heard of any bureaucratic requirement that a Canadian individual or business gather this kind of info in order to do business with an overseas individual/business. In fact, I'd say that it borders on illegal. But what do I know... I'm glad you didn't just do as he requested because I think it's FISHY, FISHY, FISHY...

mouser · « **Reply #16 on:** October 09, 2007, 04:35 PM »

It doesn't sound fishy to me, just sounds like you guys need to find a compromise that protects everyone.

Darwin · « **Reply #17 on:** October 09, 2007, 04:52 PM »

You might be right, Jesse. I'm probably just paranoid, but after years of living abroad, I am quite suspicious of any request to surrender one's passport - either in the original or as a copy.

cranioscopical · « **Reply #18 on:** October 09, 2007, 05:26 PM »

John2k,

I'm mightily relieved that you declined to send passport info. Nothing would induce me to do that, certainly not at this level of commerce.

I wonder what mechanism you have in mind to audit sales and enforce royalty payments?
Perhaps your client would like to send you his passport information so that you can do some verification of his bona fides...

John2k · « **Reply #19 on:** October 09, 2007, 05:56 PM »

Quote from: cranioscopical on October 09, 2007, 05:26 PM

Perhaps your client would like to send you his passport information so that you can do some verification of his bona fides...

I wonder what his answer would be?

It's embarrassing to think that this is all a scam, considering the effort it took to meet his requirements.
If it is a con, then it's the oddest one I've ever come across!

At least I learnt a thing or two about secure encryption.

Ralf Maximus · « **Reply #20 on:** October 09, 2007, 06:23 PM »

Mmmm, doesn't feel like a scam. More like the guy's new to programming-for-hire and kind of fumbling around. You'll know more when you get his response to your email(s) and your revision to his contract.

cranioscopical · « **Reply #21 on:** October 09, 2007, 07:17 PM »

Quote from: John2k on October 09, 2007, 05:56 PM

It's embarrassing to think that this is all a scam, considering the effort it took to meet his requirements.
If it is a con, then it's the oddest one I've ever come across!

It's probably not a scam but it' also better to be safe than sorry.
As others here have pointed out there are better and more professional ways to achieve what your potential client requires.

Good luck, I hope your efforts result in a good, mutually-beneficial relationship!

Darwin · « **Reply #22 on:** October 09, 2007, 07:39 PM »

Quote

It's probably not a scam but it' also better to be safe than sorry.

Agreed. A little paranoia in the cyber age is definitely a good thing (well, not a bad thing, anyway). Like Chris, I hope this is the start of something that benefits both you and your client - maybe you two will have a good laugh about it in years to come

John2k · « **Reply #23 on:** October 11, 2007, 11:21 AM »

Just to update, the customer has not contacted me since I refused the passport details, which was 2 days ago.

Looks like everything has turned sour.

Ralf Maximus · « **Reply #24 on:** October 11, 2007, 12:48 PM »

Or, he's reviewing his options. Give him a few more days then politely inquire. Asking to verify that he received your last communication is safe enough in this age of spam filters and whatnot.