Direct trades and the payment that comes back
P2P crypto trading risk examined by Ilia Nikolaevich Zavialov: reversals, frozen accounts and the paperwork that decides it
A direct trade looks like the simplest transaction in the field. One party sends money, the other sends crypto, and no institution sits in the middle taking a cut. The difficulty is that the two halves of that exchange obey completely different rules. One of them can be undone by a third party weeks later, and the other cannot be undone by anybody at all. Every serious loss in this area comes from that single asymmetry, and it is not a technical problem. It is a contract and procedure problem, which means it can be managed by a company that writes the procedure down before it trades rather than after.
English version for the United States.
Why companies end up here at all
Direct trading is attractive for ordinary commercial reasons. It avoids the onboarding of a regulated venue, it settles quickly, and it works in situations where a company needs a small amount of crypto for a supplier who insists on it.
It also appears by accident. A treasury with a residual balance, a marketing budget paid to a contractor abroad, a customer who wants to settle in stablecoin. Each of these produces a moment where somebody in the company has to buy or sell directly.
The exposure is rarely approved as a decision. It accumulates through small conveniences that nobody wrote a policy for, and the first time anybody writes one is usually after a loss.
This matters because the sums involved are not small in aggregate. Crypto linked losses reported in 2025 came to 11,366,669,732 dollars across 181,565 complaints, and the average payment to a fraudulent operation rose to 2,764 dollars from 782 the year before.
There is one more reason companies end up trading directly that is worth naming honestly. A regulated venue asks questions about the source of funds and the purpose of the transaction, and a direct trade does not. Whenever the appeal of a method is that nobody asks, the risk being avoided has usually moved rather than disappeared.
The asymmetry that causes everything
A crypto transfer is final. Once it confirms, there is no institution that can recall it, no chargeback window and no dispute process that reaches into somebody else's wallet.
A payment made by card, by a consumer payment application or by a check is reversible, sometimes for months. The person who sent it can ask their provider to take it back, and the provider decides.
Between those two facts sits the whole risk. The seller of crypto performs the irreversible half and receives the reversible half, which means they carry the entire exposure of the trade by default.
This is not a flaw in any particular platform. It is the structure of the two payment systems, and no amount of care about the counterparty changes it. Care changes the probability, and the structure decides what happens when care fails.
The practical consequence is a rule about order. The irreversible half should always be the last one to move, and the party sending it should only do so once the other half has passed the point at which it can be taken back.
How a reversal actually happens
The buyer pays with an instrument that carries a dispute right. They receive the crypto, which is final. Some days or weeks later they tell their provider the payment was not authorized or the goods were never delivered.
The provider decides the dispute on the evidence it has, which is a payment record and two accounts. Crypto is invisible to it, and a screenshot of a blockchain explorer is not the kind of document it processes.
The money is taken back from the seller. Not requested, taken, because the reversal is executed by the provider rather than negotiated between the parties.
The seller now holds nothing. The crypto is gone irreversibly, the money is gone reversibly, and the recourse available is a civil claim against a counterparty who was frequently using somebody else's identity.
A check produces the same ending more slowly. It clears, the funds appear, the crypto is released, and the check is returned unpaid afterwards, at which point the bank reverses the credit. The timing is what makes this hard to defend against by instinct: a reversal arriving three weeks later lands long after the trade has been filed as completed, reconciled in the accounts and forgotten by everybody who handled it, and by then the counterparty profile is gone and the chat has been archived.
The frozen account, which is often worse
The second failure mode does not involve a dispute. The money arriving is genuine and stolen, and the transfer is one link in a laundering chain that the seller has now joined without knowing it.
The original victim reports the theft. Their bank traces the funds to the account that received them, and that account is frozen while it is investigated. This is routine, automatic and usually gives no notice.
A frozen company account stops payroll, supplier payments and direct debits at the same moment, and the freeze lasts for as long as the investigation does rather than for as long as is convenient.
The company is also now visibly part of a chain. Money mule networks are pursued as organized activity, and in one three month international operation 2,469 people acting as intermediaries were arrested and 17.5 million euros was stopped before it could be laundered.
Being an unwitting link is a defensible position and it is a position that has to be defended, with documents. A company that can produce the counterparty record, the platform trade identifier and the compliance checks it ran is in a different conversation from one that can produce a chat history.
Third party payments
The clearest single warning in direct trading is a payment that arrives from a name other than the counterparty's. It is presented as ordinary: a company account, a relative, a friend who owes them money.
The reason it matters is that a third party payment breaks the only link the seller has between the money and the person they dealt with. If the payment is later disputed or traced, the counterparty is not the payer and the payer never agreed to anything.
This is also the exact shape of a laundering step. The payer is frequently an intermediary account, and the seller is the mechanism converting that money into a form that cannot be recovered.
Every serious platform prohibits third party payments in its own rules, which is worth knowing because it means accepting one usually forfeits the platform's protection as well.
The rule to write down is short. The name on the payment matches the name on the account, or the trade does not happen, and no explanation changes that.
Forged confirmations
The lowest effort attack is a screenshot. An image of a completed transfer, a banking application showing a pending payment, an email that looks like a payment notification from a bank.
All three are trivial to produce and none of them is evidence of anything. The only acceptable confirmation is the money visible in your own account, in your own banking interface, opened by you.
Pending is the word that does most of the damage. A payment shown as pending has not settled, can be canceled by the sender in several systems, and looks identical to a completed one in a screenshot.
The same applies in reverse for buyers. A transaction identifier supplied by a seller means nothing until the funds appear in the buyer's own wallet with confirmations, because an identifier can belong to any transaction at all.
A useful habit removes this entire category at once. Never read a confirmation that somebody else supplied, in any direction. Open your own account, your own wallet or your own explorer, and treat anything sent to you as a claim about reality rather than a record of it.
Disputes on a platform
Platforms that hold crypto in escrow during a trade are materially safer, and the protection only operates inside the platform's own rules. A trade moved to a private chat leaves the escrow behind.
The request to complete outside the platform is therefore not a way to save a fee. It is the removal of the only mechanism that can hold the asset while a dispute is examined, and it should end the trade.
Disputes are decided on documents. The payment record, the account names, the timestamps and the platform's own log of the trade. Anything agreed verbally or in an external chat is frequently outside what the platform will consider.
Releasing early destroys the position entirely. Escrow exists to be released after settlement is confirmed, and a release made on a screenshot is a release made on nothing.
What a company should write down before trading
Which payment instruments are acceptable, by name. Instruments that can be reversed by the payer or their provider are either prohibited or subject to a holding period before the crypto is released.
A holding period that matches the reversal window of the instrument, not the patience of the counterparty. Pressure to release immediately is the most common feature of a trade that is about to go wrong.
A hard limit per trade and per counterparty, written before a specific opportunity exists. Limits decided in the presence of a deal are not limits.
Two person approval for any release of company assets, with the approver separate from whoever holds the keys. This is the ordinary rule for payment runs, applied where it is usually forgotten.
A named owner for the whole activity, and a record of every trade in one place with the counterparty, the instrument, the amount, the platform identifier and the date. The predictable failure is finance assuming legal is handling it, legal assuming finance has the numbers, and the person who opened the account having left. The record looks like bureaucracy until an account is frozen, at which point it becomes the difference between a short conversation with the bank and a long one.
The checks before a specific trade
The counterparty: account age, completed trade count, and whether the profile was created recently. A new account offering an unusually good rate is a combination with one obvious explanation.
The rate itself. A price meaningfully better than the market is not generosity, it is compensation for a risk the other party knows about and you do not.
The payment instrument, before anything is agreed. Ask which method will be used and confirm it is on your written list. Discovering the method at the moment of payment removes the ability to refuse it.
The name. The payment must arrive from the counterparty, and a promise that it will come from a company or a relative is a reason to stop rather than a detail to accommodate.
The pressure. Urgency in a direct trade is almost always manufactured, because a genuine buyer with legitimate funds loses nothing by waiting for a payment to settle.
If it has already gone wrong
Stop trading with that counterparty immediately and do not attempt to recover the position with a second trade. A second trade with the same party is the outcome the first one was designed to produce.
Export everything at once: the platform trade record, the full chat, the payment record, the transaction hash, the account names and the timestamps. Platform records are retained for a period rather than forever.
Open the platform dispute inside its own window and with documents rather than a narrative. Platforms decide on records, and a clear submission made early is treated differently from a long explanation made late.
If the account is frozen, contact the bank with the file rather than waiting to be asked. A company that arrives with the counterparty record, the platform identifier and its own checks is in a materially different position from one that arrives with an explanation.
Report to the police, and expect the follow up approach offering recovery for an advance payment. That offer targets exactly the person who just lost money in exactly this way.
Each payment instrument, whether it can be taken back and what that means for the seller
| How the money arrives | Can it be reversed | What it means for the seller |
|---|---|---|
| Card payment | Yes, for months in some schemes | The whole exposure sits with the seller |
| Consumer payment application | Yes, through a dispute process | The provider decides, and crypto is invisible to it |
| Check | Yes, after it appears to have cleared | Funds can be credited and then removed |
| Instant bank transfer | Rarely by the payer | The risk moves to a freeze rather than a reversal |
| Cash in person | No | Other risks entirely, and no reversal risk |
| Payment from a third party name | Depends on the instrument | The link between payer and counterparty is broken |
| A payment shown as pending | It has not arrived at all | Nothing should be released against it |
| A screenshot of a transfer | Not a payment in any sense | Evidence of image editing at most |
Questions and answers
- Why is the crypto seller always the one who loses?
- Because they perform the irreversible half of the exchange and receive the reversible half. Once the crypto confirms nobody can recall it, while the payment they received can be taken back by the payer's provider weeks later.
- The buyer sent a screenshot of the completed payment. Is that enough?
- No. A screenshot is an image and proves nothing. The only acceptable confirmation is the money visible in your own account in your own banking interface, fully settled rather than pending.
- The payment is coming from their company account instead. Is that a problem?
- Yes, and it is the clearest warning available. A third party payment breaks the link between the money and the person you dealt with, and it is the standard shape of a laundering step. Serious platforms prohibit it in their own rules.
- Why would my bank account be frozen if I did nothing wrong?
- Because the funds you received may have been stolen from somebody who has now reported it. Their bank traces the money to the receiving account and it is frozen while that is investigated, usually automatically and without notice.
- Is trading outside the platform ever reasonable to save fees?
- No. The escrow that holds the crypto during a dispute only operates inside the platform. Moving the trade to a private chat removes the single mechanism that could protect either side, and the saving is a fraction of what is at stake.
- What single rule reduces the risk most for a company?
- A holding period matched to the reversal window of the payment instrument, written down before any specific trade exists. Everything else is a refinement of that, and pressure to release immediately is the most reliable warning there is.