Payments on P2P exchanges

[serious911]

Hi,

In general case, the P2P exchange (like LocalBitcoins and others) just connects buyer and sellers with each other. The workflow steps are well known and similar:

Step 1: Traders will register on p2p exchange.
Step 2: A buyer/seller places a buy/sell order.
Step 3: The matching engine works and matches the buyer with the right seller.
Step 4: If the buyer and seller agree and confirm to the terms of trade, then P2P exchange holds crypto assets of sellers to be sold.
Step 5: Buyer makes the payment for his/her purchase of crypto assets to the seller.
Step 6: After the payment confirmation by the seller, smart contract releases crypto assets to the buyer's wallet address.

I have a question about the payment process (step 5). How do P2P exchanges resolve fraud issues with fiat payments, which may happen?

For example, if buyer uses a stolen credit card / hacked bank account for purchasing cryptocurrency on P2P exchange. In this case the seller will receive the fiat money, confirm transaction and cryptocurrency will be sent to buyer. But in theory, the real owner of hacked bank account may later notify a bank about this stole and bank may stop transaction or revert it. But P2P can't revert a Bitcoin transaction. So the question is how do they handle such issues? Is it a widely spread situation?

Thanks

[1714022095]

1714022095

[1714022095]

1714022095

[darosior]

Hi,

Usually P2P exchanges don't allow for volatile payment methods such as credit cards. Here is the Bisq payment methods FAQ as a concrete example https://docs.bisq.network/payment-methods.

[Pmalek]

Usually P2P exchanges don't allow for volatile payment methods such as credit cards.

What about Coinbase, Cex.io or BitPanda. I think all three allow crypto to fiat exchanges assuming the client has gone through KYC.

OP has a point, I have never though about what would happen in a situation like that. Imagine that someone purchases a stolen credit card online, manages to pass KYC by faking a selfie, buys Bitcoin and withdraws it to his private wallet before the owner of the card notices the theft and disputes the transaction?!

[darosior]

Usually P2P exchanges don't allow for volatile payment methods such as credit cards.

What about Coinbase, Cex.io or BitPanda. I think all three allow crypto to fiat exchanges assuming the client has gone through KYC.

They aren't P2P exchanges, are they ?..

[Deathwing]

Usually P2P exchanges don't allow for volatile payment methods such as credit cards.

What about Coinbase, Cex.io or BitPanda. I think all three allow crypto to fiat exchanges assuming the client has gone through KYC.

OP has a point, I have never though about what would happen in a situation like that. Imagine that someone purchases a stolen credit card online, manages to pass KYC by faking a selfie, buys Bitcoin and withdraws it to his private wallet before the owner of the card notices the theft and disputes the transaction?!

Those sites you mentioned aren't P2P. They are exchanges. They are legitimate businesses so they are legally obliged to ask a hefty amount of information (hence KYC) and not they aren't easy to bypass. Even if you manage to do, their credit card processing system is different. (AVS, 3DS etc.)

Most P2P sellers will not accept credit cards due to commissions issued by their PoS providers. At least in Turkey they usually (more than 98% of the time) accept only cash. Checking for any counterfeit cash is a lot easier than handling credit cards anyway.

[DannyHamilton]

Usually P2P exchanges don't allow for volatile payment methods such as credit cards.

What about Coinbase . . . allow crypto to fiat exchanges assuming the client has gone through KYC.

OP has a point, I have never though about what would happen in a situation like that. Imagine that someone purchases a stolen credit card online, manages to pass KYC by faking a selfie, buys Bitcoin and withdraws it to his private wallet before the owner of the card notices the theft and disputes the transaction?!

Faking KYC on Coinbase is difficult.  They go to significant effort to verify that the KYC is correct.  If the KYC is correct, then they have the ability to come after you via courts.

However, they further protect themselves by limiting the amounts you can exchange initially.  This delay on increasing your limits buys time for the victim to realize and report the issue and reduces Coinbase's exposure to risk.

Furthermore, at times depending on their risk analysis, Coinbase may put restrictions on an account that causes delays on how soon crypto can be transferred out of the account after the crypto has been acquired.

There is no way to guarantee 100% that nobody will ever be able to engage in fraud.  Instead, the objective is to reduce risk, both by reducing the opportunities for fraud AND by reducing the value the criminal obtains when they succeed at fraud.

[The Cryptovator]

I am not aware if there is such as peer to peer exchange where you can buy bitcoin with credit card. Because I were look for it before few days for one of my client. What I realized wherever accept credit card there is very complicated KYC verification. So I think it will not very easy to buy crypto currency with stolen credit cards. For example my clients tried to buy Bitcoin from Binance, they verified account themselves, then during buy simplex has asked for verification again. And after first bought, Binance blocked account and asked submit KYC documents again. So it's really complicated process, client submitted KYC again and unblocked account. I think most of exchange use third party gateway like simplex for dealing with buy crypto currency and I think their verification process is quite complicated. But hackers are more smart than us, who know how they manage KYC verification.

[o_e_l_e_o]

For example, if buyer uses a stolen credit card / hacked bank account for purchasing cryptocurrency on P2P exchange. In this case the seller will receive the fiat money, confirm transaction and cryptocurrency will be sent to buyer. But in theory, the real owner of hacked bank account may later notify a bank about this stole and bank may stop transaction or revert it. But P2P can't revert a Bitcoin transaction.

It's a good question. The majority of the replies above are referring to Coinbase or other centralized exchanges and therefore don't answer your question.

As darosior points out, most P2P exchanges will not accept credit cards since they allow very easy chargebacks, and most customers do not have the facilities or services set up to accept credit card payments. Most also won't accept payments from services like Paypal, which also allow easy chargebacks. Many will, however, allow bank transfers and other services in which chargebacks are possible, but with some limitations.

BISQ, as mentioned above, is my current P2P exchange of choice. You can read how they deal with this problem here: https://bisq.network/faq/#chargeback-details. Essentially it comes down to only allowing small trades through these methods, and requiring accounts which use these methods to be older, established accounts, and requiring "signing" before using these methods (which essentially means the account is verified by a trusted trader first - https://docs.bisq.network/payment-methods#account-signing). This set up essentially means anyone with a stolen bank account is going to have to wait several months and make a number of other trades first, just to be able to cash out a thousand or so dollars via BISQ. There are far less time consuming ways to cash out a lot more money from a stolen bank account, with less chance of being caught in the meantime. This means, as far as I know, BISQ have never had a chargeback via a bank transfer before.

Having said that, although those security measures are good, the bottom line is that you are responsible for your own security. There are plenty of payments options which don't allow chargebacks. If you have any doubts about a specific trader, then insist on a non-chargeback option or trade with a different user.

[serious911]

For example, if buyer uses a stolen credit card / hacked bank account for purchasing cryptocurrency on P2P exchange. In this case the seller will receive the fiat money, confirm transaction and cryptocurrency will be sent to buyer. But in theory, the real owner of hacked bank account may later notify a bank about this stole and bank may stop transaction or revert it. But P2P can't revert a Bitcoin transaction.

It's a good question. The majority of the replies above are referring to Coinbase or other centralized exchanges and therefore don't answer your question.

As darosior points out, most P2P exchanges will not accept credit cards since they allow very easy chargebacks, and most customers do not have the facilities or services set up to accept credit card payments. Most also won't accept payments from services like Paypal, which also allow easy chargebacks. Many will, however, allow bank transfers and other services in which chargebacks are possible, but with some limitations.

BISQ, as mentioned above, is my current P2P exchange of choice. You can read how they deal with this problem here: https://bisq.network/faq/#chargeback-details. Essentially it comes down to only allowing small trades through these methods, and requiring accounts which use these methods to be older, established accounts, and requiring "signing" before using these methods (which essentially means the account is verified by a trusted trader first - https://docs.bisq.network/payment-methods#account-signing). This set up essentially means anyone with a stolen bank account is going to have to wait several months and make a number of other trades first, just to be able to cash out a thousand or so dollars via BISQ. There are far less time consuming ways to cash out a lot more money from a stolen bank account, with less chance of being caught in the meantime. This means, as far as I know, BISQ have never had a chargeback via a bank transfer before.

Having said that, although those security measures are good, the bottom line is that you are responsible for your own security. There are plenty of payments options which don't allow chargebacks. If you have any doubts about a specific trader, then insist on a non-chargeback option or trade with a different user.

Thank you for the detailed explanation.

[serious911]

What about the case with not honest buyer or seller?

For example, the buyer and seller agreed and confirmed the terms of trade. Then may be two potential issues:

1) The buyer makes the payment for his/her purchase of crypto assets to the seller. But the seller is not honest and don't want to confirm receivment of money. Or the seller is not able to confirm transaction because of problems with Internet connection/problems with bank or personal circumstances.

2) The buyer is not honest and says that the money was sent to seller. Also buyer may provide a fake transaction receipt or painted screenshot.

The KYC may filter impostors and improve security, but how we can check transactions and resolve such issues?

P2P exchange may ask a transaction receipt or screenshot in dispute, but this transaction receipt may be faked. Usually the information about payment transaction is not open as in blockchain.

Thanks

[o_e_l_e_o]

-snip-

These issues are generally much easier to solve than the chargeback issue we have discussed above. Again, I will use BISQ as my example since it the exchange I currently am most familiar with.

First of all, both buyer and seller must pay a security deposit prior to trading, which are refunded after the trade. In the case of someone trying to scam, they will lose their deposit, which acts as an incentive to be honest.

Secondly, bitcoins to be bought or sold are held in a multi-sig escrow, so no one can ever run away with the other party's money after one side completes their deal.

If there are issues with a trade in BISQ, you can escalate first to mediation (https://docs.bisq.network/trading-rules#mediation), and if that is insufficient, up to arbitration (https://docs.bisq.network/trading-rules#arbitration). Arbitrators will ask for evidence in the form of notarized bank statements, and have the ability to refund you any lost money if the evidence is in your favor.

[serious911]

Thank you. The information about mediation and arbitration in BISQ is very useful.

First of all, both buyer and seller must pay a security deposit prior to trading, which are refunded after the trade. In the case of someone trying to scam, they will lose their deposit, which acts as an incentive to be honest.

What do you mean by security deposit prior to trading?

It is true for  seller because he should deposit the crypto assets to Escrow wallet of P2P exchange before trading. But the buyer has a fiat money and he want to buy cryptocurrency. Should we also ask buyer to make a security deposit before trading?

[Pmalek]

What do you mean by security deposit prior to trading?

Both the seller and the buyer need to deposit a fixed or agreed-upon amount of crypto as a guarantee that they will be honest and do the trade.

I assume that this deposit is held by an escrow of some sort. Once the buyer sends the payment and the seller confirms that he received it, they contact the escrow who releases the security deposits back to the original accounts together with the funds from the buyer.

If one of the parties tries to cheat and says he never received payment from the buyer, I assume that the escrow will take a look at the presented evidence and decide who is right. In that case he doesn't get his security deposit back.

So the security deposit is a guarantee of good intentions by both parties. 

[o_e_l_e_o]

What do you mean by security deposit prior to trading?

For someone to post an offer (either a buy or sell offer), they must first pay a security deposit in bitcoin of between 5% and 50% of the trade value (they get to pick the value they want to pay - the default is 10%). If they are offering to sell BTC, they most also pay the amount of BTC they are offering to sell.

When someone else accepts their offer, they must pay the same value security deposit, also in bitcoin. If this user is the bitcoin seller, then they also pay the amount of BTC they are selling. Once this second party have paid, both security deposits (which are equal) and the bitcoin being traded is transferred to a 2-of-2 multi-signature escrow address, with each of the buyer and the seller holding a single key.

Once both parties mark the fiat payment as successfully sent and received, then the bitcoin in the escrow address being trader will be sent to the buyer, and the two security deposits returned to each user.

The escrow address also signs a 20-day time-locked transaction to transfer everything in it to the BISQ DAO. A BISQ Arbitrator can examine in the case and either return the bitcoin to the each user or pay out to a user who was scammed.

Should we also ask buyer to make a security deposit before trading?

Yes. Even if you only want to buy BTC with fiat on BISQ, you must first deposit some BTC to BISQ to pay your security deposits.

-snip-

The Arbitrator (if it comes to that) does not hold a key to the escrow address - only the buyer and seller do. The Arbitrator can't access the funds directly - he or she can refund the scammed party with funds from the BISQ DAO, and the time-locked transactions from the escrow address will refund the BISQ DAO. If you do not need to involve an arbitrator (and I never have), then there is no one to "contact" to release funds from the escrow address - it is all done automatically once both parties have marked that the payment has been made.

[serious911]

In most cases P2P exchanges do not process fiat payments and only provide Escrow service for cryptocurrencies. They do not accept credit cards or bank transfers. They only deal with crypto currencies and take some fees from crypto assets exchange.

Some of them were even banned in some countries, but continues to operate and growth. For example, WazirX was banned in India by RBI (Reserve Bank of India).

Does P2P-exchange require a registration as a financial organisation or buying a license from government in specific country to operate worldwide?

Thanks

[buwaytress]

-snip-

In response to dishonest traders.

Have not had the bad luck to have such cases against me but that's mainly because I try to protect myself. Over the years on LBC, I've learnt who to trust -- and in return they learn how to trust me. There is practically no incentive to act dishonestly except for perhaps a small window of opportunity to scam as much as possible -- but then your name and reputation are gone and you've basically lost your ability to ever trade again.

On BISQ like oeleo says, it's even better (it has to be, since it's new, has lower entry threshold unlike LBC). The system isn't perfect, but there is just far too much at stake to act dishonestly only for a fistful of dollars.

[o_e_l_e_o]

Does P2P-exchange require a registration as a financial organisation or buying a license from government in specific country to operate worldwide?

But true P2P exchange like Bisq don't need any.

Just to expand on this a little:

BISQ isn't a financial organization. It isn't even an organization in the way you would usually think of one. It is what is known as a DAO - a decentralized autonomous organization. It is essentially a decentralized mechanism for developing and maintaining the BISQ platform. People involved in BISQ - developers, contributors, designers, mediators, arbitrators, buyers, sellers, traders, etc. - can propose changes to the platform and vote on said proposals. There is no registered company, offices, CEO, managing director, etc. It doesn't need to buy a license because it's not a company and, much like bitcoin, a government can't enforce any laws upon it. A government could kick and scream and even declare it illegal, but they can't shut it down like they can with a centralized exchange.

There's some more good information about this here:
https://docs.bisq.network/intro.html
https://docs.bisq.network/user-dao-intro.html

[serious911]

Does P2P-exchange require a registration as a financial organisation or buying a license from government in specific country to operate worldwide?

But true P2P exchange like Bisq don't need any.

Just to expand on this a little:

BISQ isn't a financial organization. It isn't even an organization in the way you would usually think of one. It is what is known as a DAO - a decentralized autonomous organization. It is essentially a decentralized mechanism for developing and maintaining the BISQ platform. People involved in BISQ - developers, contributors, designers, mediators, arbitrators, buyers, sellers, traders, etc. - can propose changes to the platform and vote on said proposals. There is no registered company, offices, CEO, managing director, etc. It doesn't need to buy a license because it's not a company and, much like bitcoin, a government can't enforce any laws upon it. A government could kick and scream and even declare it illegal, but they can't shut it down like they can with a centralized exchange.

There's some more good information about this here:
https://docs.bisq.network/intro.html
https://docs.bisq.network/user-dao-intro.html

The idea behind BISQ looks great, really like Bitcoin. But in real life there is someone who registered a domain, pays for website hosting every month, develops & supports a website, etc.

These people should get a reward for their work. So BISQ should earn money for itself to be alive and completely decentralized (maybe take fees from trades or something else). In a way like miners get a reward from Bitcoin mining.

P2P-exchanges, like Paxful/WazirX take fees from trading and they are registered as private companies in USA/UK. Sorry if it is not allowed to mention such companies on this forum.

[o_e_l_e_o]

But in real life there is someone who registered a domain, pays for website hosting every month, develops & supports a website, etc.

These people should get a reward for their work. So BISQ should earn money for itself to be alive and completely decentralized (maybe take fees from trades or something else).

That is exactly what happens. In addition to website hosting and developing, there are also social media managers, support staff, the mediators and arbitrators we previously discussed. BISQ does charge a small trading fee and uses this fee to pay these people for their services. These people also have to post a bond of BTC to be allowed to take up one of these roles. If they were to go rogue (so start trashing BISQ all over their social media channels, for example), then the community can vote to confiscate their bond. Such financial penalties, again much like the security deposits for trading we discussed above, act as an incentive to act honestly.

You can read more about this here: https://docs.bisq.network/user-dao-intro.html#ensure-honesty-in-high-trust-roles

Sorry if it is not allowed to mention such companies on this forum.

Totally fine. You will never have a post deleted on this forum just for mentioning competing services. The only caveat to that is if you are spamming advertising for them.

[serious911]

Thanks all of you for answers and explanations!