P2P fiat trades: How do escrowers avoid being fooled by fake documents?

[d5000]

I would really like to use non-KYC P2P exchanges like Bisq or HodlHodl more than I do at this moment. But I have still doubts about the security of the trading process there - so I currently use P2P only for very small amounts.

My main doubt is the following:

If there is a conflict between the seller (the person who sells Bitcoin or other cryptocurrencies) and the buyer (who will normally do a fiat transaction to the seller, such as a bank transfer), how does the escrower/mediator/arbitrator cope with the problem of a fake payment proof - i.e. manipulated PDFs of receipts, and fake/manipulated screenshots?

This could affect both buyers and sellers:

- If I sell Bitcoin, and the buyer doesn't send the money, but sends a fake "proof of payment" to the escrower. In the case of Bisq, if the mediator/arbitrator accepts the "proof", I'll not only lose my coins but also my security deposit.
- If I buy Bitcoin, send the money, but the seller says he hasn't received it, I would send a proof of payment - but the seller can say I could have faked it.

I know screenshot/PDF manipulation is not absolutely trivial, but a pro scammer should be able to do it convincingly.

The only way I guess the buyer could really prove he sent the money is if the bank/payment service provided a digitally signed document as receipt. But it seems this is not an established practice (at least, none of the banks/payment processors I operated with offered that.)

Several years ago I have seen a software project (I forgot the name and link, sorry) aiming to cope with this problem and enabling people to prove they visited a certain website, which could be used to prove that they downloaded a receipt. But I didn't hear again about that project and even for me it seems there could be some high technical hurdles for that, and it even would provide new possibilities to "fake" proofs.

Are my doubts unfunded and there are good solutions for that or is this still a problem?

(If somebody has experience with the problem and wants to share it with me but doesn't want to publish it in the form of a post fearing scammers could use it, send me a PM if you want )

[virginorange]

Good question.

If I was a mediator at Bisq, I would ask for bank account statements of both parties. So you would see a discrepancy in bank statements of both parties.

I would then make a guess according to the reputation of both parties (account verification time, number of previous conflicts, age of onion address) and write my guess both parties. Maybe the scammer gives up.

If the scammer keeps the show running, I would then suggest screen sharing. Would one party be willing to share their screen and log into their bank account with me?

I think scamming would be probably uneconomical for the scammer, since he would need old accounts with many previous successful trades and few arbitrations. Given the effort and fees involved combined with the moderate probability of success, scamming does not pay out.

However I'm not associated with the Bisq Dao, so my view is only from a user of Bisq.

[d5000]

I would then make a guess according to the reputation of both parties (account verification time, number of previous conflicts, age of onion address) and write my guess both parties. Maybe the scammer gives up.

This has its risks, it doesn't avoid a professional selective scammer (one who lets several accounts "grow" over time) scamming a newbie. So it should never be the last step.

If the scammer keeps the show running, I would then suggest screen sharing. Would one party be willing to share their screen and log into their bank account with me?

That's actually a good idea. The scammer could, of course, set up a fake bank website on his computer, but he has to manipulate his browser code and take care always that everything's right. It would be already more difficult to do. I don't know if manipulated browsers of this kind, however, are already circulating (e.g. in darknet forums).

In this case however the arbitrator could require the trader to download a fresh browser, e.g. from the Mozilla website, and do the login with this one. This would already be extremely difficult to fake, above all if you'd require to download the installer from a mirror, for example - the best effort would be if the arbitrator provides the mirror himself. Maybe DNS manipulation may be still possible.

So I think this method - as long as the honest party would agree to do it - is quite good actually.

It would be interesting if this practice is being used at P2P exchanges (again, I also accept PMs about this).

Edit: It could also be an idea to require the login process/screenshot fast, i.e. agree a time with both parties, and then they must provide the proof in 5 minutes - e.g. a screenshot with an additional element which prevents it to be pre-fabricated, even if it's only a open text document where the date and time and a word proposed by the arbitrator.

[so98nn]

I am not sure how they work it on those platform but on localbitcoins you as a seller has the opportunity to click on "payment confirmation" then only your escrowed funds are released to the buyer.

Meaning as bitcoin seller you get more leverage as compared to the person who is buying it. Buyer has more risk since he will be transferring you real cash and you still has the upper hand of possessing the bitcoins in the escrow and they are only released when you give consent of bank transfer.

I am not sure what's got you confused? May be the way Bisq works?

[Charles-Tim]

I am not sure how they work it on those platform but on localbitcoins you as a seller has the opportunity to click on "payment confirmation" then only your escrowed funds are released to the buyer.

Meaning as bitcoin seller you get more leverage as compared to the person who is buying it. Buyer has more risk since he will be transferring you real cash and you still has the upper hand of possessing the bitcoins in the escrow and they are only released when you give consent of bank transfer.

I am not sure what's got you confused? May be the way Bisq works?

Know that no one has advantage over anyone, both buyers and sellers has the same advantage and the buyer or the seller can be scammed if care is not taken. d5000 meant that the buyer can try to convince that the seller is trying to scam, but instead, providing a fake receipt that he made the payment but no coin received. Anyone can want to scam, be it the buyer or the seller because their are different tactics in scam, but if the buyer and seller follow the right procedure, there are ways to know the person that wants to scam. Scammers can think they are perfect and try all possible ways to scam, but likely even from the statement of account, it is possible to know the fake and the original. But I understood you too, in reality, where the scam usually happen is when the coin is released from escrow, especially if deceived by fake bank credit alert message. If the right ways are followed, I do not think the scammers will not be known easily.

[Findingnemo]

With the years of experience on trading LBC and many issues with other party resolved by the escrow but I didn't have any fake payment receipt yet to explain how they will handle the case but based on my experience when there is a dispute the support will ask for the documents from both parties and one who failed to submit them will get trouble.

[d5000]

[...] on localbitcoins you as a seller has the opportunity to click on "payment confirmation" then only your escrowed funds are released to the buyer [...]. Meaning as bitcoin seller you get more leverage as compared to the person who is buying it. Buyer has more risk [...]

Charles-Tim has already explained what I meant: In the case the process isn't working smoothly, an arbitrator will try to resolve the dispute. The problem is there's no way the seller can prove that he did not receive the money. This opens possibilities to both the buyer and the seller to try their luck with fake "proofs of payment" or, in the case of the seller, a screenshot indicating he didn't receive any money, taken before the transfer took place and faking the timestamp.

I also disagree that the buyer has more risk. The seller has, apart from the "fake document scam", the risk that the buyer is operating from a hacked bank/e-wallet account, which will lead to chargebacks. (Bisq however took some measures to avoid this, like a hash of the bank account number/IBAN and Account Signing.)

It is also easier for KYC-embracing platforms like Localbitcoins to prevent several scam techniques, as you would have to resort to complicated identity theft techniques to fool their verification mechanism. (However, in several cases outside of the crypto world, video-ident has also already been fooled by scammers.)

[...] if the buyer and seller follow the right procedure, there are ways to know the person that wants to scam. Scammers can think they are perfect and try all possible ways to scam, but likely even from the statement of account, it is possible to know the fake and the original.

This is where I have my doubts. Deepfake technology does already exist even for videos (which is computationally much more power-hungry than a screenshot manipulation). So I'd not be surprised if there is software with AI components to fake a document.

Providing these documents in a short time, and/or provide a video where you log in into your bank account, could increase security; screen sharing like proposed by @virginorange as a last resort (if both parties submit their receipts/screenshots in time and the "scammer party" has convincingly faked the document) may be extremely difficult to fake.

Still searching for other ideas.

[cozytrade]

Good question.

If I was a mediator at Bisq, I would ask for bank account statements of both parties. So you would see a discrepancy in bank statements of both parties.

I would then make a guess according to the reputation of both parties (account verification time, number of previous conflicts, age of onion address) and write my guess both parties. Maybe the scammer gives up.

If the scammer keeps the show running, I would then suggest screen sharing. Would one party be willing to share their screen and log into their bank account with me?

I think scamming would be probably uneconomical for the scammer, since he would need old accounts with many previous successful trades and few arbitrations. Given the effort and fees involved combined with the moderate probability of success, scamming does not pay out.

However I'm not associated with the Bisq Dao, so my view is only from a user of Bisq.

All this can be faked very easily. I can make bank accounts with editing software in my names even bank statement. How do we know about the reputation of a particular person if he doesn't have many reviews? I think even reviews can be brought or can be reviewed by a group of scammers. It's risky to use a non KYC exchange for P2P trade when trust is the key for safe transactions.

[virginorange]

All those reasons for avoiding P2P out of fear of beieng scammed sound convincing.

But from experience I can tell scamming has to be pretty rare, since I was not scammed once and my sample size is reasonable large.

If somebody is scared of being scammed on Bisq, I can provide a couple of onion addresses from people that traded with in the past.

[Adbitco]

I think @Virginorage clearly answer the questions but I would love to throw little light. When it comes of using p2p and as a trader from my experience the buyer first send payment to you after you might received the alert to your bank before you released bitcoin or any other currencies which the person (Buyer) requested otherwise if you first initiate payment without the buyer sending first you could get scammed.
In contrary if it's happened that you are the one buying you will start the payment process and after you paid then the seller releases your crypto or bitcoin. The easiest way to solve this issues is where I do trade, there's always a checkmark on users that are trusted to deals with so while trading with such users there's no fear of being scammed yet only required you to cautiously trade.