P2P scams in 2026: triangulation, fake receipts, chargebacks and Telegram deals – how they work and how to stop them

In early 2025, a Brazilian trader sold R$15,000 worth of bitcoin on the P2P platform Hodl Hodl. Everything went by the book: the buyer sent the money via Pix to his account at Banco do Brasil, he saw the payment arrive and released the coins from escrow. The trade was closed, and the platform had done its job.

Soon afterwards, the buyer went to her own bank, PagBank, and claimed she had been the victim of a scam. The bank triggered MED, the Central Bank of Brazil's mechanism for returning money to victims of Pix fraud. On that request, Banco do Brasil automatically blocked the seller's account. On February 27, the bank sent the R$15,000 back to the buyer without waiting for any evidence, and the account stayed blocked until March 5. By the time the seller regained access, the money was gone. So were the coins.

The seller filed a police report, Hodl Hodl banned the buyer's account, and he took the bank to court. A court in the state of Goiás ruled that the bank had not followed the Central Bank's rules and ordered Banco do Brasil to return his R$15,000 and pay another R$3,000 in damages. The bank appealed and lost.

This seller was lucky: he had every document from the trade and made it all the way to court. Most stories like this end with the money simply lost. The case shows clearly how P2P fraud works. Escrow protected the coins right up to the moment the seller pressed "Release". Everything that happened after that took place inside a bank, where the platform cannot see.

Almost every scheme is built on this: triangulation, fake receipts, chargebacks, deals in Telegram. In 2025, the Nigerian OTC service Breet analyzed more than 20,000 posts about P2P trading and ran over a hundred of its own trades on five platforms. Suspicious or manipulative behavior showed up in roughly one trade in six.

Why escrow does not protect the seller

Escrow holds what can be verified on the blockchain: the coins. The platform cannot see the fiat transfer. It does not know whose bank account the money came from, whether it actually arrived or whether the bank will pull it back a month later. OKX states plainly in its dispute rules that the parties themselves must check the sender's name against the account holder's name, and that the platform does not do this for them.

The decision "the money is here, I can release" is made by the seller, and once the button is pressed, the platform considers the trade complete. The same OKX rules say that if the seller releases the coins without confirming full payment, the seller bears full responsibility and the platform is not liable for the losses. That is why scammers do not break the escrow. They attack everything around it: the bank transfer, the receipt, the chat and the seller's haste.

Ten P2P scams: how they work and how to stop them

1. Triangulation and third-party payments

This is the most dangerous scheme for a seller, because what they lose is not the coins but the bank's trust. The scammer deceives an outsider: sells them a phone that does not exist, offers an "investment" or gets money out of them some other way. At the same time, the scammer opens an order to buy USDT from a real seller on a P2P platform and gives the victim that seller's bank details. The victim sends the money, the seller sees it arrive and releases the USDT to the scammer. When the victim realizes they have been cheated, they go to the police – and the trail leads to the seller's account. We covered the mechanics of the triangle in detail in our article on bank accounts frozen after a P2P sale.

This appears to be what happened to an Indian trader who sold about $1,000 in USDT on Binance P2P in September 2026. The rupees arrived in his State Bank of India account, and the trade was closed. On September 22, the bank placed a lien of ₹101,337 on the account. On October 1, it placed another lien for the same amount on the same transfer, plus one more for ₹16,737. Part of the money he had already sent to a friend's account was also put on hold. By his count, almost ₹4.5 lakh is now frozen – five times more than the crypto he sold was worth.

The seller complained to the national cybercrime portal and to the Ministry of Home Affairs' cyber safety channel but got no clear answer. He has kept the Binance order and proof of where the USDT he sold came from. Yet a lien like this can usually be lifted only by the investigating officer or a magistrate, and according to those affected, such reviews take anywhere from several weeks to many months. The seller says the buyer was later linked to a scam. The money he paid with belonged to someone else's victim.

2. Two orders on one seller

What Binance calls a "triangle scam" in its help center is actually a different scheme, despite the similar name. The exchange's support team describes it like this. Two scammers open orders with the same seller at almost the same time: one for 5,000 USDT, the other for 6,000 USDT. The second one sends 5,000, and the first one presses "Paid" and attaches the second one's receipt. The seller sees a 5,000 payment on the statement, matches it to the first order and releases the coins on both. In the end, the seller has given away 11,000 USDT and been paid for only 5,000.

3. Fake receipts, screenshots, SMS and fake banking apps

This is the most widespread scheme. The buyer presses "Paid" and sends a screenshot of a transfer that never happened. Sometimes there is a transfer, but only for pennies: the scammer sends the seller a token amount and then edits the figure on the receipt image. The receipt looks genuine because the transaction number and bank details on it are real. According to a Technext survey, almost half of Nigerian P2P traders have received a fake receipt at least once.

The fakes keep getting more convincing, and Argentina shows this well. In January 2024, eight young people at a beach club in Mar del Plata ordered 1 million pesos' worth of drinks and paid for them with a fake version of the Mercado Pago app. It imitates the popular wallet, shows an "infinite balance" and produces a receipt that is almost impossible to tell from the real one: the right amount, the recipient's name, the familiar design. The group was detained, but the app is still circulating. Later, in the province of Formosa, people found a version that even plays the sound of an incoming payment notification. Against a P2P seller, an app like this works exactly as it does against a bartender: on the screen, it all looks like a payment.

4. Chargebacks, payment reversals and MED in Brazil

Here the money really does arrive, but then it goes back – as in the story of the Hodl Hodl seller. The buyer receives the coins and then disputes the transfer with their bank, claiming to be a fraud victim or saying they never made the payment. Binance describes this as a classic chargeback.

In Brazil, there is an official mechanism for such claims: MED. It was created to return money to real victims, but on a MED request, the seller's bank first blocks the funds and only then looks into the case. A payment can be disputed not right away but weeks later: another Brazilian seller, who traded on Bisq, learned of a dispute 55 days after the trade. In other countries the mechanisms have different names, but the idea is the same: in Nigeria, banks reverse payments after the coins have been released, and in Turkey, lawyers describe EFT transfers sent on weekends and cancelled before they settle.

5. Scheduled Pix (Pix agendado)

This is a Brazilian version of the fake receipt. The scammer does not send a Pix but schedules one for a future date and forwards the confirmation to the seller. The financial service Afinz explains that such a receipt looks almost real, except that instead of "Pagamento" it says "Agendamento de pagamento" – a scheduled payment. Sometimes the date is simply cropped out. The seller releases the coins, the scammer cancels the scheduled transfer, and the money never arrives.

6. "Marked as paid but never paid" and fake support in the chat

In December 2025, MEXC warned of a rise in such cases in Ukraine and described the scenario in detail. The scammer responds to a sell ad and presses "I have paid" without sending anything. As soon as the appeal option becomes available, they open one and claim they sent the money but received no crypto. Then messages from "support" appear in the order chat – with emojis and labels such as "⚠️Support" or "Assistant P2P ✅". The "agent" demands that the coins be released or the account will be blocked, and sends a fake receipt to look convincing. In the same notice, MEXC warned about fake "agreements" and documents that scammers send after the order has been created.

7. Overpayment with a request to refund the difference

The buyer sends more than the order amount and asks for the difference back – but to another account, "because this one is blocked". Often the overpayment itself came from a third party or is later reversed. The seller refunds the "extra" from their own money and becomes a link in a laundering chain.

8. Deals in Telegram and WhatsApp, QR-code logins and fake USDT checks

When a deal leaves the platform, both the escrow and the dispute rules disappear. This is where the biggest losses happen. In September 2026, on-chain investigator VAL described the case of a trader who lost 2,151,772 USDT. The trader did business with his partner over Telegram. Scammers hijacked the partner's account and, in his name, arranged a large transfer.

The trader was careful: he first sent a test payment of 10 USDT and got confirmation in the chat that it had arrived. Only then did he send the main amount. The next morning the chat had been deleted, and the "partner" stopped responding. The stolen USDT was moved to another wallet, swapped for TRX and sent to deposit addresses at the MaskEX exchange. Six days later, Tether froze about $1 million, and investigators managed to trace roughly half of the funds. The test payment did not help: it verifies the address, not the person on the other side of the chat.

There are also smaller but widespread scenarios. A "buyer" on WhatsApp asks the victim to check their USDT on a third-party website; the victim connects a wallet, signs an approval and loses 4,678 USDT. In another version, instead of an order QR code, the scammer sends a QR code for logging in to Binance, and once the victim scans it, the scammer gets access to their account.

9. Bizum inverso in Spain

This scheme came from ordinary online selling, but it also hits P2P sellers who accept Bizum, Spain's popular instant payment system. In 2025, Spanish police arrested 16 members of a group behind more than 200 victims and over €480,000 in losses.

Here is how they operated. On classifieds platforms, the scammers posed as buyers and said they were paying from a company account, so the seller had to "accept" the payment. In reality, they sent not a transfer but a payment request: the seller pressed "confirm" and sent their own money to the scammers. To confuse victims, the group sent fake screenshots of incoming payments and sometimes called while posing as bank employees to "help" with the transaction. The money passed through the accounts of front people who rented out their accounts for a commission. Those who resisted were threatened with the misuse of their personal data.

10. One payment on two platforms and systematic underpayment

Many merchants post identical ads on several exchanges at once. This is the basis of a scheme MEXC warned about in December 2025 after a wave of cases in Kenya. The scammer finds the seller's ad on another platform and completes a normal trade there: actually sends the money and receives the coins. Then they open an order with the same seller on MEXC – for the same amount and with the same payment details. They have no intention of paying twice: they press "Paid", and when the seller does not release the coins, they open an appeal and upload the receipt from the first trade. The receipt is genuine, the amount and details match, and a tired seller juggling dozens of orders across different exchanges can easily take one payment for two.

The second scheme in this group does not look like fraud until you do the math. In Nigeria it is called kobo chopping: the buyer rounds the amount down and underpays by a few dozen or a few hundred naira. In Breet's research, the amount paid differed from the order amount in almost one trade in three. By the service's estimate, for a merchant doing 500 trades a day these "small change" losses add up to more than ₦2 million a year. Nigeria also has "negotiators" who demand their own "profit" of ₦500–1,000 before releasing the coins.

How to spot P2P fraud: red flags and rules for each scheme

How P2P platforms resolve disputes

An appeal is the main line of defense for both sellers and buyers. But it works by the rules of each specific platform, and the side that loses a dispute is most often the one that did not know those rules in advance: released the coins too early, deleted the chat or submitted the wrong evidence. Here is how disputes work on the largest platforms.

Binance

When one side opens an appeal on Binance, the counterparty has 10 minutes to respond in the order chat. If the two sides do not reach an agreement, a support agent joins the dispute within 24–48 hours. The agent reviews the order chat and the evidence both sides have uploaded. A screenshot of the chat does not count as proof of payment.

Binance has a set procedure for common situations. If the money came from a third party, the seller can open an appeal right away and refund the payment to the account it came from. If the buyer overpaid, the parties should first try to settle it in the chat, and if that fails, open an appeal and attach proof of payment.

Binance's evidence requirements are strict. Video proof must be recorded with two devices: one films the other as you log in to your banking app and open your profile and transaction history. Screen recordings are not accepted, cuts and edits are not allowed, and the file must be no larger than 200 MB. The bank statement must be a PDF covering the last three months, downloaded from the bank, with no edits, cropping or password. Photos of a statement converted to PDF are rejected.

OKX

OKX has the most detailed dispute rules, and they show clearly whose side the platform takes in each situation.

If the payer's name does not match the buyer's verified name, the coins are not released, the seller refunds the full amount, and the buyer pays the refund fees. The buyer's P2P functions are suspended for 15 days, and for 30 days if it happens again. If the buyer paid less than the order amount, they must pay the rest within the set time, otherwise the seller refunds what was received. But if the seller released the coins before receiving the full payment, the loss stays with the seller: OKX states plainly that it is not responsible for the losses and cannot guarantee recovery.

If the buyer sends a fake receipt, support cancels the order, and after three such cancellations the buyer's account is suspended. If the buyer wrote "BTC", "OKX" or "P2P" in the payment reference, the seller may release the coins or refund the money, and once again the buyer pays the fees. The other way around, if the buyer paid the correct amount from their own account and the seller refuses to release the coins, support will release them after 12 hours. The exception is orders priced 10% or more below the market: this rule does not apply to them.

OKX's key rule is worth remembering for anyone who trades P2P: once a trade is complete, all payments are final unless the law requires otherwise. Getting released coins back through support is almost impossible.

Bybit, Bitget and KuCoin

Bybit prohibits third-party payments. If such a payment does arrive, support advises the seller to refund the sender and cancels the order only after the refund is confirmed. The exchange itself warns that such disputes can drag on, and some remain unresolved for a long time. That is why it is better not to let things reach an appeal and to check the payer's name before releasing the coins.

Bitget requires the bank account holder's name to match the verified name on the exchange and states plainly that third-party payments are often linked to money laundering and put the seller's account at risk of being frozen. For merchants, the rules are even stricter: coins must be released within 30 minutes of payment, and violations lead to a warning, then a 24–72-hour ban and loss of merchant status. If illegal funds are found in a trade, the account is blocked immediately and the information is passed to law enforcement.

KuCoin describes six common schemes, from fake payment confirmations and SMS to chargebacks and two simultaneous orders.

Rules experienced P2P merchants follow

People who trade P2P every day agree on one thing: what protects you is not the platform but discipline. Here are the rules that come up again and again in exchange help centers and in advice from merchants in different countries.

What P2P fraud means for the seller legally

A seller whose account received a victim's money looks like an accomplice to the bank and the police. Proving that you knew nothing about the scheme is up to you, and the laws are getting tougher in 2026.

In Brazil, Law 15.397/2026 came into force in May 2026. It added a separate offense to the criminal code: providing your bank account for transactions with criminal proceeds, punishable by 1 to 5 years in prison. Intent is required for a conviction, but renting out an account to run someone else's P2P turnover now falls squarely under the law.

In Turkey, triangulation cases are treated as fraud using banks and information systems under Article 158/1-f of the Criminal Code, and under the anti-money laundering law, the financial intelligence unit MASAK can suspend transactions on an account for seven business days.

In Spain, the Supreme Court has long treated "money mules" as accomplices to fraud, and a person who failed to check a transaction despite obvious signs of something wrong can be charged with negligent money laundering. In July 2026, police broke up a network of 67 EU citizens who had opened more than 800 accounts, through which €140 million passed.

In September 2026, India's Central Bureau of Investigation warned that a single careless trade can turn a crypto seller into a suspect.

Where an address check helps and where it does not

Scammers are happy to exploit the word "AML": phishing websites pose as USDT checking services. That is why it is important to understand what an address check actually does.

It helps when the risk is on the crypto side. If a "seller" from Telegram gives you an address to send funds to, a check will show whether it is linked to scams, mixers or sanctioned addresses. If you are buying USDT, checking the incoming coins will show whether they are linked to the darknet or theft: coins like these can be frozen the next time you deposit them on an exchange. Finally, a saved, dated report is proof that you checked your counterparty before the trade. Turkish lawyers explicitly include such reports in the document package for lifting an account freeze.

A check does not help where everything happens inside a bank. Blockchain analytics cannot see triangulation, fake receipts, chargebacks, MED, scheduled Pix or Bizum inverso: it has no way of knowing who sent you lira or reais. Here, only name matching, waiting for the money to be credited and refusing third-party payments work.

P2P fraud FAQ

This article is for informational purposes only and does not constitute legal advice.