search

bisq-network / bisq

A decentralized bitcoin exchange network
https://bisq.network
GNU Affero General Public License v3.0
4.71k stars 1.27k forks source link

Add support for Revolut payment links to avoid disputes #1806

Closed cbeams closed 5 years ago

cbeams commented 6 years ago

A common source of disputes with Revolut trades has emerged. The scenario is like this:

  1. The seller publishes an email address in the Bisq trade details that is not actually registered with Revolut.

  2. The buyer tries to send payment to that email address, but Revolut says it's not valid, i.e. not associated with a user account.

  3. The buyer opens a dispute and explains that they can't complete payment.

  4. I discuss the situation with the seller, and they explain that the buyer should send them a Revolut "payment link" via the interface at https://www.revolut.com/ie/payments.

  5. The buyer does so, shares the payment link with me via arbitration chat, and I relay the payment link to the seller.

  6. The seller accepts the payment via the payment link, and I then close out the issue.

The problem here is twofold:

  1. the buyer has no idea whether the email address in the trade details is a registered Revolut account, or one that needs a payment link sent to it. They also may not know that payment links even exist, so when the get the 'invalid account' message from Revolut, they just go straight to a dispute.

  2. Assuming they do know about payment links and create one, the seller does not get notified via email about the payment link. The buyer must manually email the payment link to the seller. This is not great for opsec on either side.

I see two options to solve this problem:

  1. Require that email addresses published in trade details are actually registered with Revolut, not just arbitrary addresses that can receive a payment link.

  2. Enhance the UI to allow the seller to specify how they expect the payment (direct via Revolut, or via a Revolut payment link), and add something to the UI (a popup, I guess) that explains to the buyer what they need to do in case of a payment link (give them the payment link creation URL as specified above, and explain that they must manually email the payment link to the seller's provided email address).

I would estimate I've dealt with a dozen or so disputes of this nature since we started supporting Revolut, and it requires an inordinate amount of back and forth to get these disputes resolved, so I think it's worth to do something to solve it.

My gut feeling is that we should go with something like option (2) above. While it's more complex, I don't think that simply making a rule as described in (1) will work very well. People won't read it, they'll still use unregistered email addresses, and we'll still end up with disputes. The only advantage there is that we'd be able to say it's a clear protocol violation. Right now we can't even do that.

/cc @alfsbs

sqrrm commented 6 years ago

I agree that (2) sounds better.

With the information on how to handle this within the client the users should in general be able to handle things without bringing it to dispute, which is the aim here. I don't know enough about revolut to say, but if there is no added security risk with using payment links then that seems like a distinct advantage for bisq to be able to support them.

flix1 commented 6 years ago

This problem does not arise if the Revolut user gives a phone number instead of an e-mail. The phone number allows instant payment.

It's worse for privacy than e-mail... but if you make a Revolut payment you are going to end up having the other person's phone number anyway. So maybe just keep it simple and eliminate the e-mail option?

flix1 commented 6 years ago

Yes, I've checked. If you go through your Revolut received or made payments you can see a statement which shows the phone number of the payer/payee... so no additional privacy is lost if we limit this to the phone number option.

aicbaicb commented 6 years ago

When a Revolut account is opened, it can be opened either using an email address or phone number. In either case, sending to a registered account is instant. If sending to an unregistered email address or phone number, a payment link would be created. As such, there is no advantage to limiting to phone number only, as by doing so it will not be possible to send to an account setup with an email address, and if the phone number is unregistered, we're back to the payment link issue

aicbaicb commented 6 years ago

The reference to the payment link https://www.revolut.com/ie/payments is incorrect. The only way to send a link is through the iOS/Android app.

aicbaicb commented 6 years ago

A third option which would work better than option 2 would be to modify the UI such that the buyer can paste/type in the payment link which would be sent through the UI to the seller, thus avoiding the need to email the link.

ghost commented 6 years ago

@flix1 wrote:

... so no additional privacy is lost if we limit this to the phone number option.

With email, you can use protonmail, riseup, etc. Which pretends to respect privacy. With a phone number, privacy is gone.

montvid commented 6 years ago

I just tested the revolut payment system. For bisq purposes only Name and Surname and payment link is needed see option 2. The buyer can provide a photo of his Revolut history with the sellers name and surname to confirm he has paid the seller.

1 If you send money to a telephone number only the person whose number it is gets the money. In your Revolut history you will see the person who claimed the money name and surname no matter what his nickname may be.

  1. If you generate a payment link anyone can take the money provided they have the link (no email needed and revolut crashes/does not send out an email anyway) and a revolut account. In your Revolut history you will see the person who claimed the money name and surname no matter what his nickname may be.
montvid commented 6 years ago

@flix1 i don't see any phone number in my statements regarding money sent to me via a link or by any other means. What should I push in Revolut to get the info you claim you see?

flix1 commented 6 years ago

Hi @montvid this is how I did it:

-Go to the revolut wallet. -Scroll down the list of payments. -Click on an incoming payment for the details

In the payment details scroll down and you should see the phone number of the payer, just above money received and Fee.

montvid commented 6 years ago

@flix1 on the latest revolut 5.21 there is no such info. Above Money received and Fee there are buttons Statement and Hide and no phone number.

stale[bot] commented 5 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

ManfredKarrer commented 5 years ago

I think that should be still kept open.

ManfredKarrer commented 5 years ago

2426 should be a easy fix. We will see if it helps to reduce dispute cases.

lestephane commented 5 years ago

I'm trying to do my first payment, got the exact experience mentioned, i try to add a contact by email address, the user is not shown as being a Revolut user, and i'm asked to "Create payment link", which I sure as hell don't want to send to an email. This is on 0.9.4, so it's unclear whether it contains 2426.

I want to pay from Revolut user to Revolut user, all in the Revolut App, no link. Given that, I want to cancel the payment for the trade i initiated. Can I let the trade period expire and if I do, will I lose my deposit?

More generally, is there no way to tell from the UI ahead of time whether we're dealing with a user 'by-email' as opposed to 'by-phone-number'?

Confusion galore

ManfredKarrer commented 5 years ago

@lestephane Old accounts created before 0.9.4. can still have email addresses. We did not want to force all users to set up a new account.

You can open a dispute with cmd+o or ctrl+o. You will not lose the deposit. Give the arbitrators a link to that GH issue just in case.

Revolut is a bit of a mess unfortunately. Surprised why it is so polular... They seem to have the policy to attact users by - just use it - no registration required. But once money is sent/received - ah then you need to register - "sorry didn't you read the fine print" / "did u take our advertising serious"?

lestephane commented 5 years ago

@ManfredKarrer Thanks for taking the time to respond, I pre-emptively ctrl+o'd with the GH issue link earlier today. Now waiting for the trade remaining time to run its course, or the arbitrator to come back to me (whichever comes first I guess). So far, I'm happy with bisq. These UX quirks will smooth out over time.

lestephane commented 5 years ago

By the time the arbitrator came back to me regarding my support ticket, the trade period had ended. The arbitrator said he would ask the other user for his phone number, still waiting for an update, and my deposit is still locked.

I think this issue is still unresolved, since I have no way to tell ahead of time if a user registered by email or by phone number.

So I want to avoid Revolut users registered by email like the plague. And want nothing to do with Payment links. Don't care how they work, don't need / want to know.

Suggested resolution:

split the Revolut payment method into two payment methods:

That way, I can filter to hide all Revolut (payment link) offers, and I never have to waste an arbitrator's time regarding this problem again.

aicbaicb commented 5 years ago

Revolut is a bit of a mess unfortunately. Surprised why it is so polular... They seem to have the policy to attact users by - just use it - no registration required. But once money is sent/received - ah then you need to register - "sorry didn't you read the fine print" / "did u take our advertising serious"?

You are right. I have been using Revolut with no problems for over a year. Suddenly they froze my account for a "review". Early on, I'd sent (and had approved) proof of source of funds and other KYC documentation, so I don't know why it's been frozen now. The only potentially problematic transactions are Bisq, so it may be that it's not the best idea to use Revolut with Bisq right now.

aicbaicb commented 5 years ago
  • If I'm dealing with an email user, I'm later asked to create a payment link, I get confused, I open a support ticket. Negative experience.
  • If I'm dealing with a phone number user, the user shows up as Revolut user, I'm not confused, type the amount, the reference. Positive experience.

This is only if the user set up the Revolut account using a phone number, but uses the email address with Bisq. My Revolut is setup with my email address, so anyone sending to me using Revolut would not get a payment link.

I do agree that it would be a good idea to know in advance if the seller is using a phone number or Revolut-registered email address (which would be direct) as opposed to a non-registered address (which would generate a payment link). I too try and avoid payment links, so I generally only buy from the same dozen or so people that I've dealt with before and thus know they're not using a payment link, or I know their phone number (from previous trade) and can thus send direct.

lestephane commented 5 years ago

@aicbaicb so you keep a list of people you're used to trading with? Do you do it using their onion address, and does that address remain the same over time?

aicbaicb commented 5 years ago

@aicbaicb so you keep a list of people you're used to trading with? Do you do it using their onion address, and does that address remain the same over time?

@lestephane I keep track of onion addresses. There is an option to insert a name into a trader, and it also indicates how many transactions you have had. I don't know whether the onion address can be changed, but I've never had a problem with my system so far, although Revolut have now frozen my account pending a "review", so not sure of the future.

lestephane commented 5 years ago

How many bisq transactions did you do with Revolut prior to suspension?

On Sun, Mar 3, 2019 at 12:10 PM aicbaicb notifications@github.com wrote:

@aicbaicb https://github.com/aicbaicb so you keep a list of people you're used to trading with? Do you do it using their onion address, and does that address remain the same over time?

@lestephane https://github.com/lestephane I keep track of onion addresses. There is an option to insert a name into a trader, and it also indicates how many transactions you have had. I don't know whether the onion address can be changed, but I've never had a problem with my system so far, although Revolut have now frozen my account pending a "review", so not sure of the future.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bisq-network/bisq/issues/1806#issuecomment-469008129, or mute the thread https://github.com/notifications/unsubscribe-auth/AFNTlK7Sf_EypUM1mQgMdrlRFtTgXW8qks5vS5-tgaJpZM4X1OHN .

aicbaicb commented 5 years ago

How many bisq transactions did you do with Revolut prior to suspension?

@lestephane About 50 trades