Thoughts

Choosing domain escrow: Beware of the extra fees, hiccups, and risks.

The $9.99 Transpact escrow fee could end up being 10x more, if you use a money transfer service, like TransferWise.

When buying and selling domains online, escrow services help protect the assets and both parties until terms have been mutually agreed to, and money has changed hands.

For any kinds of transactions, from real estate to goods and services to domain names, an escrow workflow remains roughly the same. Instead of a buyer paying the seller directly and awaiting receipt of the goods and services (with the risk of fraud and non-delivery of goods by the seller), the buyer pays the funds to a “middle man” called escrow agent, who holds onto these funds. Once the seller has delivered the assets or services to the buyer, and the escrow agent is able to confirm this, the funds are released to the seller, minus the fees and commission charges levied by the agent.

Image: A typical escrow workflow (via Confidus Solutions)

In a way, eBay and Amazon marketplaces, without saying it, indirectly act as escrow agents by protecting both consumers and the sellers against fraud. You buy a product from Amazon and pay Amazon, not the seller. They hold onto the funds until the seller has shipped the product. After a short amount of time has elapsed and delivery to the consumer has been confirmed, Amazon releases the funds (minus their fees) to the seller. Both parties enjoy protection. And, there are refund and dispute resolution processes built into the workflow, should things go wrong.

Domain transfers

Similarly, for domain transfers, a number of escrow services exist but choosing one carefully is vital, as you’ll understand after reading my story.

In June 2020, I wanted to acquire the securityreport.com domain for my publication, Security Report which had been using the .uk TLD. The person who had previously owned securityreport.com was open to selling, and has been very friendly and easygoing. However, as a general caution both of us agreed to use an escrow service.

Typical escrow fees

Established names in the domain escrow industry like Sedo charge heavy fees, as much as 15% of the sale price. There are ways to get around this. But what we needed was a simple solution that would let us both agree to a one-page terms of sale, exchange money securely, and have me obtain the domain transfer authorization code to complete the transfer process with minimal fees.

We both agreed to use Transpact. The name appeared to have glowing reviews and a trustworthy reputation. Above all, Transpact offers an extremely low escrow rate: a flat $9.99 charge per party for domain transactions in USD.

I live in the UK and the seller was based in the US so this would provide both of us with some kind of reassurance.

I drafted a quick 1-page agreement, basically stating who the Buyer (myself) and Seller were, the asset aka domain being sold, the agreed-upon sale price, and the terms of the transaction.

Transpact + TransferWise = ?❗TROUBLE ❗?

Due to regulatory requirements, Transpact requires the bank account you register with their system during sign-up, is the same account from which the buyer sends the money to Transpact.

This is to prevent money laundering so criminals cannot abuse Transpact to create false ‘escrow arrangements’ when really all they are trying to do is move laundered money around. Whatever the reason or logic behind this restriction is, it seems like a simple enough request.

Now, the currency of this transaction was USD. The funds requested by Transpact, plus their fees from me, were in USD. This payment was to be made by me aka the buyer, from a UK bank account, however, to their UK bank account.

This is where things gets complicated.

As you can imagine, all my UK bank accounts only supported GBP as the currency. Instead of going through banking bureaucracy, I decided to use TransferWise. I thought their so-called ‘borderless banking’ account would send USD from my UK GBP account to Transpact easily.

In Transpact’s system I had entered TransferWise’s USD banking details assigned to me. In an ideal world, the money would be taken out of my UK GBP bank account, transferred to TransferWise’s USD account (after a low conversion fee), and sent out to Transpact.

But there’s one catch. With TransferWise, “The money never actually crosses any borders,” as explained in detail in their video and blog post.

Here’s my summary if you care to read, but feel free to skip:
The way TransferWise ‘borderless banking’ transfers money “internationally” is done in a manner that the actual funds never leave a country. Transfers are made within the same country instead.

For example, if I’m (call me A) based in the UK and trying to pay a party (B) in the US, and some random stranger (C) in the US is trying to pay some other random party (D) in the UK, instead of TransferWise actually “transferring” our funds across borders, they would take the money from both of us — from A and C, and make the transfers within the same country of the funds’ origin. So, my (A’s) money from the UK would go to D’s bank account (both based in the UK) via TransferWise. And similarly, C’s money from the US would go to the B’s account in the US. Remember, B is the party I was trying to pay. Because this is facilitated by TransferWise, they’d take a small fee as their commission. Now you may be thinking but what if we (A and C) were paying different amounts to our recipients? That is all sorted by the millions of customers TransferWise has — all sending money in real time, and their automated system much like a bank’s.

The caveats?

Different accounts, intermediary banking partners, red flags

Although the money does leave your USD TransferWise account, to the recipient the amount would be paid from a different account — TransferWise banking partner’s account, located in the recipient’s country.

This means, your TransferWise account number cannot ever match the account number from which TransferWise pays out the recipient.

Naturally, this raised a red flag in Transpact’s system. They could not accept the money due to regulatory restrictions and they offered to refund this to the same account, minus their administrative fees.

Transpact was also thorough enough to provide me with PDF proof of this refund being made to TransferWise banking partner’s account, from which Transpact had received the amount.

After a few email exchanges with TransferWise, I explained to them the situation and requested that the money returned by Transpact come back to my account. TransferWise acknowledged my request but stated upfront:

“Once the funds return to us, you’ll be notified immediately and you should be able to cancel the transfer and get a refund on your TransferWise USD balance. Please note as the funds were sent via SWIFT payment, the bounce backs may take from 5 to 10 working days to reach us. The worst case scenario we’ve heard of is 6 months when the money got stuck in an intermediary/beneficiary bank. Unfortunately, there’s nothing much more we can do to speed up this process and we need to wait until the funds return to us.”

Wow, can you imagine? A money operation this scale; with millions of customers, has refunds taking up to 6 months with TransferWise having no control over them!

But, I didn’t even have to wait that long for a refund,because, the money returned to TransferWise by Transpact never came back to me: instead, it bounced right back to Transpact, a few days later.

“If you’ve made a mistake in the amount you sent, or you don’t want to send the transfer anymore, your recipient will need to contact their bank and ask them to reject the payment. This means the money will be sent back to TransferWise, and we’ll refund it back to you,” reads TransferWise docs.

But in effect it looks like, the money goes through several banking partners and hops in a “one-way” fashion, with refunds and bounce-banks being quite difficult.

Regulatory Catch 22

On Transpact’s end, they would absolutely refuse to refund my money to any account (even my TransferWise USD account) other than the account the money was paid to them from — TransferWise banking partner’s, which was bouncing the refund right back to them.

Despite the fact I had provided Transpact with proof of income, the proof (bank statement) showing the origin of the money trail, and PDFs obtained from TransferWise website, their stringent policy persisted, and simply had its basis in anti-money laundering.

This started a long chain of emails between TransferWise, I, and Transpact.

Finally, after I thought I’d have to settle this in court, Transpact offered a compromise: asking me to obtain a letter from TransferWise confirming my USD bank details assigned by TransferWise, and that the funds had originally been paid by TransferWise from my TransferWise USD account through their intermediary banks.

The letter was obtained via TransferWise successfully, and after a thorough review by Transpact that it wasn’t forged (like I said, they are very thorough), I did get my money back… “less our various extra payment expenses that we have incurred,” stated Transpact.

Transpact’s fees and deductions

The $9.99 escrow fees ended up being more like $120+

The original transaction amount of $1,400 meant, there would be an escrow fee of $9.99 per party. I, being the buyer, offered to cover both parties’ escrow fees, bringing the amount paid via TransferWise to $1,419.98.

However, the money that got refunded to me due to this issue was: $1,419.98 minus the administrative fees (when they had attempted the first refund of this amount to TransferWise banking partner) = $1,371.50.

The second time, the remaining $1,371.50 which had bounced right back to them due to TransferWise’s lack of control, was refunded directly to my TransferWise USD account after Transpact made an “exception” after a thorough review. This, less… of course more fees = $1,316.78.

Thus far, I’ve lost $103.20 ($1419.98–$1,316.78) purely in Transpact fees. This does not include the currency conversion and transfer charges incurred by TransferWise.

But, wait, I also had to complete this transaction one way or another. I couldn’t just let the securityreport.com domain deal fall apart. So, while this refund mess was being sorted, I asked Transpact if I could pay again using my UK bank account (details of which would match the sender account they’d see on their end), and they agreed.

I asked for a GBP equivalent rate for $1419.98 that I could pay from my UK account. That was easy. See, if only I had known about this upfront!

Therefore, the total in escrow charges and administrative fees I paid for obtaining securityreport.com is $103.20 + $19.98 = $123.18, plus any premium Transpact may have charged for the GBP rate conversion offer.

Again, if you throw in the repeated conversion charges paid to TransferWise from the bouncebacks, this amount would go up even more, bringing the amount lost in fees altogether to 9-10% of the $1,400 transaction amount.

All that, combined with the headache of obtaining my own money back and two-dozen email exchanges with Transpact and TransferWise.

Now, tell me, would I dare risk doing business with either of these fellas again?

And why wouldn’t I just use another escrow service, and pay the 3%, 10%, or 15% in escrow fees?

Bad UI and workflow

Another thing I noticed, other than Transpact’s decades-old UI was the escrow workflow. For example, after both parties have signed the agreement — which is easy, and the buyer has made the payment, and all escrow fees have been paid, both the buyer and seller are asked to deposit a $/£0.01 from their bank account, before the transaction can be finalised.

This seems illogical and inconvenient to me. If all terms have been agreed to, buyer has paid for the goods, fees have been paid, why do both parties need to deposit a cent (or pence), especially the buyer who has already paid the amount and fees?

Alternative suggestions for domain escrow

My personal advice after navigating this mess is to avoid UK-based escrow services like Transpact altogether. The escrow and anti-money laundering regulations are stringent which hamper legitimate transactions. Transpact’s modes of payment are limited (bank account only, no credit cards!)

For cross-border transactions, Transpact’s workflow can get messy and counterintuitive.

If you must use Transpact to save on fees, stay away from using TransferWise or any other advanced banking services with it, as that will surely raise red flags in their system.

In my opinion, the low escrow fees, while very attractive, are a gamble.

Coincidentally, I came across US-based QwikEscrow which has an advanced UI, easier modes of payment (credit cards accepted — especially useful for international escrows) and almost same fees as Transpact.

According to QwikEscrow’s fee calculator, the $1,400 transaction would have cost me only $21 in escrow fees with the flexibility of paying with a credit card, minus the regulatory nonsense Transpact’s customers have to put up with.

Of course, there remain reputable names out there in the escrow industry with hefty fees, such as Sedo, taking as much as 15% in their cut, should your budget allow for it.

There’s also Escrow.com which offers a “standard” service. They charge you around 3% of the transaction amount in fees. For example, the $1,400 transaction in this case, would have cost me a flat $45.50 (if paid from a bank account), as opposed to the 8–9% I lost in dealing with Transpact, plus the hassle.

In conclusion, much like with anything, when shopping for an escrow service provider for your domain transaction, don’t always fall for lowest fees as those often reflect ideal case scenarios. The real-world is far from ideal and if something looks too good to be true, it probably is.

© 2020. Ax Sharma. All Rights Reserved.

Ax Sharma

Ax Sharma is a Security Researcher and Tech Reporter. His works and expert analyses have frequently been featured by leading media outlets including the BBC, Business Insider, Fortune, TechCrunch, TechRepublic, The Register, WIRED, among others. Ax's expertise lies in vulnerability research, malware analysis and reverse engineering, open source software and scams investigations. He's an active community member of British Association of Journalists (BAJ) and Canadian Association of Journalists (CAJ).

Recent Posts

Sea Turtle Cyber Espionage Campaign Targets Telecommunication and IT Companies in the Netherlands

Telecommunication, media, internet service providers (ISPs), information technology (IT)-service providers, and Kurdish websites in the…

4 months ago

Rogue WordPress plugin: Threat hunters uncover credit card skimming campaign targeting e-commerce sites

Rogue WordPress Plugin Found to Steal Credit Card Information in Magecart Campaign Threat hunters have…

4 months ago

Albanian Parliament and telco ‘One Albania’ suffer cyber attacks

The Assembly of the Republic of Albania and telecom company One Albania have recently fallen…

4 months ago

Carbanak Banking Malware Resurfaces with Updated Tactics in Ransomware Attacks

The banking malware Carbanak has resurfaced with updated tactics, incorporating attack vendors and techniques to…

4 months ago

Theme park giant Parques Reunidos hit by a ransomware cyber attack

One of the world's largest theme park operators, Parques Reunidos has disclosed a cybersecurity incident.…

1 year ago

Phishing kit screenshots your email domain on the fly to appear real

Phishing kit used by multiple hacked sites generates a log in page on the fly…

1 year ago

This website uses cookies.