How to be not liable if my application became something used for illegal stuff?

Question

I am currently working as a freelancer in a Freelancer platform (Freelancer.com).

I accepted a project that is requires cURL and PHP knowledge. He has the original script handed down to me, basically its a script that logins to a "banking" website, then allows its user to send money to other people. What he wants is to make the script first get "fixed" to allow login. Which I fixed.

The "banking website" will not allow users to readily transfer money to other users. There's physical verification required, which I am not familiar as it is overseas.

But I realized, this can be used for illegal. The application allows logging in to a "banking website", even though it cannot "confirm" or "bypass" the verification to successfully authorize the money transfer, just the fact that the application can login to this financial institution's records can be alarming.

I mean, if the employer decided to scrape the sensitive information, or get the username/password _POST request then record it, isn't that illegal? Isn't that phishing? Isn't that fraud?

I still have ongoing projects with him, and I'm already starting to think the other way.

I am actually scared, an employer has a script I helped coding, and he can use that for bad things. Even if I stop now, I helped him in fixing the "log-in" method.

Am I thinking too much? Can somebody give me some tips?

Thank you.

Answer 1

I would merely point out that no "user agreement" or contract will protect you, regardless of what it states, if you knowingly assist in illegal activity.

There is absolutely no such thing as a contract clause that indemnifies you from being held responsible for illegal activity if you know, or possibly even suspect it is occurring while you are working. Indemnification clauses generally cover future activity or use of your work once it has been completed and delivered. Essentially, they cover you once you are no longer actively working on anything so you can't be held responsible for things that occur in the future which can't be predicted. However, if it is occurring while you are working and you know... you can't escape that fact merely due to some clause in a contract or user agreement.

If I sell you a gun and 3 years later you shoot someone. I can't be held responsible for selling you the gun. If you tell me you want to shoot someone so then I sell you a gun... then I'm a party to the conspiracy of the crime and can be held responsible.

Unauthorized access to a third party's database is clearly nefarious.

I don't know "Freelancer.com" at all.. but I would, if possible, break the log in script again.... then walk away. At the very least I'd walk away immediately to try and mitigate any further involvement. There may be channels at the freelance site to allow you to contact the site itself about the project. I would do that, if possible, and explain why you want to terminate the project.

Unless the client can show written authorization from the "banking site" which allows him to log in with this app... and you can verify that authorization... I would not assist at all. And I would have asked for and verified this authorization before ever "fixing" anything.

Answer 2

First off, this sounds super sketchy and if I were you I would back out of it.

Read the User Agreement at Freelancer.com (https://www.freelancer.com/about/terms ) to see if it mentions anything about you being liable to the client for how the client uses the work product, or anything about working on a product that will be used for illegal purposes. If there isn't anything about you being liable to the client or the work product being illegal/used illegally, and you haven't signed a contract with the client, you probably don't have to worry about being financially liable.

However, you could still get caught up in a criminal investigation. Imagine spending long hours in a room at the police station, repeatedly trying to explain that you really didn't know how the client was going to use the product, and that you don't know where the client is now. You might even be forced to testify in court.

Just for reference, I once was interviewed by a client who sent me a contract that said something to the effect of "you agree to indemnify and protect us from any and all claims that the Work Product has been used to violate someone's rights". If I had signed that contract, I would have been fully responsible for anything illegal that the client did with the product!

If you are concerned, it would be best to talk to a lawyer.

Answer 3

1. Don't work is a project is suspicious

2. Don't work if a project is contradictory to your beliefs

3. It is not your project

4. Since you are paid to make the app, there are small chances that anyone will ever think of suing you

Answer 4

There is nothing wrong with using a bank api to create an app, there are many bank APIs out there for that exact reason. However, if you do not have test credentials into that API, it sounds like a dark app made for phising and capture username/passwords of people thinking they are using their banks app. Very few people create banking apps so highly unlikely it is legit. Regarding your liability, if the app is to commit fraud, don't think the FBI won't put you behind bars and let the courts decide your liability and livability.