First off, I gotta say that I really detest bounties. I hate that we have a bounty system, and generally-speaking I hate that people use it. All bounties are artificial rep inflation!
But I also recognize that bounties are sort of a necessary evil, like gambling or usury: if folks are gonna do it anyway, we're better off creating a low-resistance path that we can regulate than driving a black market for it.
...Which brings us to the question of what those regulations should be.
There are two fundamental sets of rules for bounties:
- The rules built into the system itself.
- The rules against fraud, which are moderator-enforced (with some tooling to assist them).
So what is fraud? Fraud is deception for personal gain.
- Using fake accounts to work around the built-in rules is fraud.
- Transferring reputation to/from a sockpuppet is fraud (both because it violates those built-in rules and because it's usually done to work around the rules that prevent voting for yourself).
- Using bounties as a means to pay / reward someone for something apart from the quality of their work can be fraud if you don't let on that that's what you're doing.
That last one's where things get dicey. You can easily argue that, for example, using bounties to transfer rep in exchange for real-world currency is fraud because doing so requires lying about your intentions: to offer a bounty you must select a pre-defined reason, and there's no "for CASH!" option. But of course, to consider this fraud we must somehow determine that your intentions are not what you purport them to be!
This is where moderators come into play. When someone catches wind of a scam, they flag the relevant question and a moderator looks into it - if there's enough evidence for them to be reasonably confident that the bounty is fraudulent, they'll revoke it (and perhaps take further action as the situation warrants). In the past, this has been used in cases where folks have tried to sell rep, privileges, accounts, protection, etc.
So that answers most of your questions. The big ones that remain are:
On "trading" bounties
Due to the way the reputation system works, in the past it has been possible to create "untouchable" rep via careful exchanges of bounties. This is reputation that cannot easily be tracked back to any specific action on the site - it's credited to the account, but can't be revoked by deleting relevant posts.
We've since made doing this a lot more work, with the end-goal of making it extremely obvious when someone's engaging in this sort of game long before they're able to sequester any significant amount of reputation. But it remains something to watch for whenever there's unusual bounty activity, especially that involving multiple users and numerous bounties among them over a long period of time.
Your specific situation
So, this is kind of a weird one.
- No one broke or subverted any of the built-in rules.
- There is no bounty trading that I'm aware of; if your description of the situation is correct, bounties moved in only one direction. That just leaves...
...Fraud. Technically, this is fraud if two things are true:
- The sole purpose was transferring reputation (the person offering the bounties had no particular appreciation of the answers to which they were awarded, nor any desire to see the questions attract better answers).
- There was some expectation of quid pro quo: a favor from the answerers in exchange for the bounty.
Normally, this wouldn't even come up unless something looked incredibly dicey - usually that means bounties being awarded to answers that are straight-up plagiarism or consist of links to random search results. In this case, we had the combination of a bounty on a somewhat lackluster question (uncharacteristic for the person offering it) and a conversation uncovered in chat that together aroused suspicion that rep-transfer was the sole goal here.
But... was there quid pro quo? Was some favor expected? I've seen talk in other rooms on chat.so that whisper darkly of attempts to get more delete-voters active in the SOCVR, but haven't seen any real evidence that this was the intent. In any case, mindless group-voting is an issue all by itself, and one I would hope any chatroom wanting to remain active long-term would avoid.
The moderators' actions to date strike me as reasonably prudent:
- Revoking active bounties while investigating the situation ensures that no reputation is lost in the event that posts must be deleted or users suspended, while allowing them to be re-offered should there turn out to be no trouble.
- Being reluctant to accuse specific individuals in public without concrete evidence is... just good manners.
I trust that the elected moderators on Stack Overflow will investigate this thoroughly, and if no untoward intent is found then nothing will come of it; if there is reason to suspect fraud then those involved will be contacted about it and have the opportunity to provide an alternate explanation.
In closing: be honest
The best way to avoid fraud - or accusations of such - is to just be up-front about your intentions. This is rule #1, after all. Folks may not agree with your intent, or like it, and if enough of them dislike it vehemently enough you may end up inspiring more rules in the future... But at least they can't really argue you're being misleading if you state up-front what you're doing. Bounties even provide a handy free-form text field for this exact purpose - so use it! As far as I can tell, the person who inspired this discussion made effective use of this feature right up until today.