Thread

The Google Play app review process now regularly takes longer than a week

374 points · 352 comments · inputmice

davidmurdoch · 1789565368 · focus · HN ↗
I'm partly to blame. I accidentally ran an illegal unregulated money transference service over Google Play.
It let users cash out their Google Play Credits for real cash, which I automatically wired them.
Someone then hacked in to a major bookstore chain, stole piles of Google Play Gift cards, activated them using their access, and used my app to get cash for them.
Luckily, the whole thing blew up on me before I got in serious trouble, rightfully so, and the app was removed by Google, then an investigation followed. A ton of copycat apps popped up immediately after, then a few months months later Google announced their app review process.
1. DrammBA · 1789567309 · focus · HN ↗
  I love how casually you're dropping this incredible piece of internet lore as if somebody asked you how's the weather.
  1. davidmurdoch · 1789567945 · focus · HN ↗
    Haha. I used to have some blog posts detailing things a bit more, but I let it die when Heroku cancelled their original free tier years ago.
    fnikacevic · 1789568810 · focus · HN ↗
    If you're inspired to rehash it here or another blog you'll have at least this additional reader.
    davidmurdoch · 1789583955 · focus · HN ↗
    <a href="https://web.archive.org/web/20220119132757/https://davidmurdoch.com/2017/08/05/about-my-dead-side-project-cashify/" rel="nofollow">https://web.archive.org/web/20220119132757/https://davidmurd...
    eks391 · 1789575835 · focus · HN ↗
    A domain is only ~$12/year if you don't buy it through a scammy site like godaddy that adds fake fees or quadruples the cost after a year. WordPress is easy for blogs, or you can just vibe code something in an afternoon if you don't care to have comments. Even embedding forms or an emailing tool can be done statically. Heck, there's probably a free option out there for simple posting that I don't know about.
    forgotmypw17 · 1789593124 · focus · HN ↗
    The biggest costs are not the money, but the work and cognitive load of the thousand cuts it takes to not only bring all of this up, but keep it running, not to mention migrating the content.
    However/also, "only" $12 to some is a considerable amount of money to others.
    Onawa · 1789593795 · focus · HN ↗
    If its a static or client-side website, GitHub Pages is free and allows you to use whatever domain you have already own. Almost all of the websites I run are hosted on GitHub Pages. No maintenance required, and updates are as easy as `git push`.
    forgotmypw17 · 1789655876 · focus · HN ↗
    Having done this for multiple sites, there's still a lot of friction and gotchas in the setup process, and it's also not guaranteed to not break/rot (e.g. have to renew the domain.)
    You didn't use the word "just", but I still want to link this article:
    <a href="https://alistapart.com/blog/post/the-most-dangerous-word-in-software-development/" rel="nofollow">https://alistapart.com/blog/post/the-most-dangerous-word-in-...
    crtasm · 1789582796 · focus · HN ↗
    what was the url? asking for a wayback friend
    davidmurdoch · 1789583895 · focus · HN ↗
    <a href="https://web.archive.org/web/20220119132757/https://davidmurdoch.com/2017/08/05/about-my-dead-side-project-cashify/" rel="nofollow">https://web.archive.org/web/20220119132757/https://davidmurd...
    MadnessASAP · 1789586132 · focus · HN ↗
    Wow! You managed to break almost every financial law and regulation in one go. That's amazing!
    rolandog · 1789642669 · focus · HN ↗
    Reminded me of Arrested Development's George Bluth's "Light Treason".
2. WA · 1789567990 · focus · HN ↗
  What did you do with all the Google Play Credits?
  1. davidmurdoch · 1789568612 · focus · HN ↗
    When you "spend" Google Play Credits in an app, Google Play treats those credits the same as if you paid with real money: they took 30% (their take isn't so steep today), I took 10%, and then I sent the user/buyer the remaining 60% directly from my bank account (I used Dwolla back then).
    It was risky because I didn't actually receive any money from Google until about a month later.
    skeptic_ai · 1789580745 · focus · HN ↗
    What you did was money laundering. And big chance for getting in trouble if let’s say ton of credits come from fraud/stolen and then google pays out to you and then crawl back once they realize is fraud.
    I’m curious how you didn’t get into money laundering problems.
    davidmurdoch · 1789582739 · focus · HN ↗
    Technically it was an unregulated money transference service without KYC. The user that stole the cards from the bookstore was the one doing the money laundering part. I just enabled it (which is probably worse, legally).
    I was investigated and cooperated fully.
    Edit: I just remembered, the bank I used for the transference did do KYC for all users who were sent funds. This makes it more like "money dirtying", since the account is tied directly to a real identity.
    skeptic_ai · 1789651077 · focus · HN ↗
    Thanks for your detailed answer. Could you tell me what other things you had to deal with? Any prison, bad credit, fees, lawyer fees ?
    krageon · 1789636606 · focus · HN ↗
    This is not laundering, it is in fact exactly as the service was meant to be used. As long as you save where the money comes from and where it goes you are at worst operating a discount pseudo-bank. But that's what google is also doing, so we can infer that this is okay.
3. IshKebab · 1789580324 · focus · HN ↗
  How did you "accidentally" do something that was so obviously not allowed?
  1. leetrout · 1789582591 · focus · HN ↗
    He accidentally got caught.
    davidmurdoch · 1789583941 · focus · HN ↗
    I responded to others with more details if you're interested
    kulahan · 1789586031 · focus · HN ↗
    I’ll never understand people so desperate to find villains in the world.
  2. davidmurdoch · 1789583310 · focus · HN ↗
    I didn't know what a "money transference service" was, and certainly didn't know this service that I didn't know about was highly regulated.
    I only created it because I had Google Play Credits that were gifted to me. I built an app to "convert" them to cash for myself. I had never built an app before. I was proud of it and tried to make it pretty and professional and useful for others, and used it as a learning experience. The listing on the Play Store was clear about what it was.
    I had to answer questions about what the API was being used for when I signed up for Dwolla (an actual regulated money transference service). I answered honestly. They approved it.
    The app sat unused with no downloads for years before someone on Reddit's `r/churning/` posted about it.
    IshKebab · 1789583948 · focus · HN ↗
    Right but... You've used gift cards before right? The whole point is that you can't convert them to cash. Not only that but Google/Apple gift cards are notorious for being used in fraud.
    I guess if you're young...
    MichaelZuo · 1789585498 · focus · HN ↗
    Most people dont read the fine print on the back of gift cards. So I can easily see someone never running into a situation where it’s actually explained that is not allowed face to face.
    davidmurdoch · 1789585580 · focus · HN ↗
    Sure.
    I created it back in 2011 or 2012.
    It wasn't a gift card that personally motivated me to make this. It was credits from an online referral program I was gifted. I guarantee I did not read the fine print at that time.
    mitxela · 1789603404 · focus · HN ↗
    It's obvious that you can convert them to cash, because merchants accept cash and do not want to pay their employees in gift cards.
    The process is just not obvious and usually not accessible to everyone.
    com2kid · 1789618945 · focus · HN ↗
    There are multiple companies dedicated to turning gift cards into cash.
    It isn't some new idea, he just didn't follow all the rules doing it!
    krageon · 1789636736 · focus · HN ↗
    > You've used gift cards before right? The whole point is that you can't convert them to cash.
    This is very untrue - there's a ton of services that do this and while it is against the ToS sometimes, there's plenty of place where ToS of this type are not legal and so you are perfectly within your rights to resell a gift card for money.
    SoftTalker · 1789590012 · focus · HN ↗
    I mean people in poor neighborhoods do the same thing with laundry detergent or anything else you can buy with SNAP benefits.
    trollbridge · 1789613084 · focus · HN ↗
    You can’t buy laundry detergent with SNAP benefits, since it isn’t food.
    SoftTalker · 1789662903 · focus · HN ↗
    Hm, maybe that loophole was closed recently? Definitely used to be a thing, people with benefits would buy something nonperishable and marketable. Tide detergent was the example. That could then be sold for cash, or traded for cigarettes or booze or something that the benefits program would not allow, and resold to people who needed laundry detergent. Everyone taking a cut along the way of course, but hey it's free to start with so who cares?
    I went ahead and did a web search on this, and found that I misremembered it. It wasn't that the laundry detergent was initially purchased with a public benefit program, it was outright stolen.
    <a href="https://reason.org/commentary/sound-money-tide-as-gold-standard/" rel="nofollow">https://reason.org/commentary/sound-money-tide-as-gold-stand...
    Still, variations on the scam with benefit programs are still run.
    trollbridge · 1789755772 · focus · HN ↗
    I’m really wondering how you confused “things that thieves steal” with “things people buy with food stamps”. Food is rarely shoplifted in America.
4. nemomarx · 1789582576 · focus · HN ↗
  > It let users cash out their Google Play Credits for real cash, which I automatically wired them.
  I really want to know what the intended design or use case was for this? This is why people usually only let you turn credits into in app balances right
  1. Gigachad · 1789593339 · focus · HN ↗
    Cashing out unwanted gift cards
5. samspot · 1789653850 · focus · HN ↗
  Anyone interested in this topic should check out <a href="https://www.bitsaboutmoney.com/archive/gift-card-marketplaces/" rel="nofollow">https://www.bitsaboutmoney.com/archive/gift-card-marketplace...

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.