New user account model

[sqrrm]

The current model for new high risk accounts (fiat accounts with charge back risk) is to impose a limit of approx. USD100 for buying BTC until the accounts has been signed. This is meant to prevent scammers from cashing out stolen bank accounts in an effective manner. A limit higher than USD100 has shown to be used by scammers.

The current system with signed accounts is a tree of signed accounts where signed sellers can sign unsigned buyers if they complete a trade. Trading with a signed account allows users to know that the account has traded on Bisq previously which gives a level of confidence that it's not a scammer.

The cost to start trading larger amounts on Bisq is to make one low value trade to prove that the account is not a newly stolen account. Bad actors can still use their own accounts but would likely not be able to continue for long if they don't follow the rules of their bank.

This is the model we have been on for the last couple of years and it has worked rather well. It's now bumping into some limits with mining fees being high and BTC price rising. Perhaps there are some other ideas out there on how we could improve the onboarding experience.

[m52go]

As a very short-term measure, could we make it possible for buyers to make offers that can only be taken by signed sellers? That would require a new user to only need to pay for 1 on-chain tx instead of 3, as well as the lower maker fee.

I agree the whole model needs to be changed, but I assume any significant change won't be quick and/or easy.

[sqrrm]

One way to use the signed accounts would be to have no limit on the size for unsigned accounts. The seller would however get a warning for offers with unsigned accounts if the trade amount is more than USD100 or some such value.

This is something we couldn't do before we had account signing and I think this would help new users to avoid taking larger buy offers as a big red warning will deter most that don't know what they're doing. It would also allow experienced users to continue taking the calculated risk of trading with those unsigned.

This could be coupled with the suggestion to only allowed signed seller to take an offer.

Unsigned buyers that want to take offers would either have some fixed limit or we add a setting for sellers if unsigned buyers are allowed.

[pazza83]

I like the signing model and think it works well and reduces risks but am aware there are some concerns with it's propagation.

I think more risks are currently posed by the account types that do not require signing.

Yesterday I set up a Faster Payments account. I can immediately make or take trades at 0.25 BTC.

If the goal is to make users with new accounts start trading with lower amounts first then it fails to achieve this with accounts that do not require signing.

I would be in favor of requiring signing for all accounts. This would achieve lowering the risks of users trading with stolen accounts.

I think everyone would agree that Bisq should reduce the risk of new users trying to do chargebacks, but should Bisq also reduce the risk of new users trading using account they should not have access to?

[sqrrm]

Scammers of one form or the other would have to be the issue, otherwise I don't see an issue with allowing full amounts immediately.

I don't know specifically about faster payments, but the thinking has been to categorize payment methods in tiers of how likely it is someone nefarious could get access and use an account, and the ease of doing charge backs. Do you find this mode broken? I know it's not perfect but most of the imperfections, if not all, come from the fiat system so not much we can do apart from doing our best.

[pazza83]

Hi @sqrrm

I think it is important to distinguish between types of fraud. I am sure their are lots of possibilities but in general:

1. Chargebacks (user using their own account)
2. Stolen accounts (user using another persons account)
3. Triangulation fraud (user using another persons account)
4. Card fraud (possible now with Amazon and TransferWise)

Account signing is great and protects users from all of the above by limiting potential losses to 0.01 BTC or less.

Accounts that do not require signing are protected from chargebacks only and losses for the other frauds could be as much as 0.25 BTC.

For this reason, I would propose extending the use of account signing to all account types. The limit of 0.01 BTC combined with the aging is a good way to ensure the user of the account is who they say they are.

Maybe as mentioned in the other thread an option for sellers to make offers to people who are already signed, and similarly for buyer to make offer only for signed sellers to take, would be great.

Traders wishing to trade with unsigned new users could still do so but would likely expect a better price when buying and higher price when selling.

[sqrrm]

I am not convinced about extending the signing to other account types that don't require signing right now. That's kind of the benefit, but if you think it would add a lot of value it's of course doable.

Seeding a market with accounts can be a bit slow and annoying as you noticed when you started a couple, but should be alright. Do you think there would be any negative attitudes against non signed accounts in those markets if signing were introduced?

Adding an option to only trade with signed accounts is doable but we risk making it even harder to get signed I guess.

[pazza83]

@sqrrm thanks for the reply.

I agree that the signing process adds additional hurdles that ideally would be avoided.

I think there would be some negative attitudes against non signed accounts, but hopefully this would be temporary as most users would be able to be signed within 30 days by completing a trade.

From a traders perspective I think I would be happy to trade small amount 0.01 BTC and under with unsigned accounts. Currently I am more hesitant to trade larger amounts with accounts that do not require signing.

For example if I make a 0.25 BTC offer for GBP faster payments it could be taken by someone with a stolen account with 0 account age.

This risk is not there with SEPA, I know if I make a 0.25 BTC offer for EUR using SEPA then the account is signed and aged.

For this reasons I currently would feel a lot more confident trading large amount via SEPA than faster payments.

The above will become more of an issue if SEPA is removed as an account type that requires signing. I think it should be, chargeback risk is low, however it is the other fraud types that would make me worry about having to deal with fraud cases on large transaction amounts.

I like the signing / aging process, but if something else could be implemented to achieve the same goals, and avoid the problems with signing, I would be interested in that also. Not sure if any other ideas have been proposed?

[sqrrm]

I see your point and it's actually a better system to not require signing but having it as a tool for users to guide their trading. If more people agree I think we should do that as long as there's no technical issues. It would add more distributed data which could be heavy eventually but I don't think that's an issue at this point.

[Jakub-CZ]

How about delaying the finalization of the trade significantly if the buyer is unsigned? E.g.: release the last transaction 3 weeks after the seller confirms that they received the payment (or whatever is necessary to make the charge back much less likely).

One disadvantage for sellers: their security deposit remains locked for longer.

[m52go]

@pazza83 proposed this a few days ago. I think it's a great idea, but convincing users (particularly buyers) to lock funds for that long might be hard.

Maybe clear UI guidance of what's happening before, during, and after the trade could help, so users can steer clear of such offers and/or understand what's happening (and why) if they choose to carry out such a trade.

[pazza83]

I would be interested to know what the end use of the BTC is users are buying on Bisq. I would assume it is for investment? If that was the case a 3 week period for unsigned account might not be too bad. If they are looking to access the funds to exchange for something else, or pay for something the 3 week period would likely be a stumbling block.

[m52go]

Even if it is for long-term holding, a 3-week holding period is psychologically tough...it's natural to want delivery of an item ASAP after purchasing it.

With that said, there is precedent...River (for example) imposes a 6-20 day holding period for this exact purpose.

[pazza83]

If it was possible it would allow other previously discounted payment methods to be implemented with a long lock up period. For example PayPal / Venmo. Not sure if that would be a good or bad thing though.

[disquito]

What if a buyer with an unsigned account had to make a separate non-trade related deposit (not insignificant) for duration of 30 days from their first trade with unsigned account. This deposit will be used to cover the risk of chargebacks and will be released back to buyer after 30 days if there are no issues.

[disquito]

Could a problem-free trading history (30-60 days) on low(er) risk accounts (such as Revolut) be used to sign other higher-risk accounts of the same user as well?

[sqrrm]

How would the problem free history decided? It seems fairly easy to game such a system if I could just create an account and not trade. It would also require the accounts to use the same identifiable information to make self signing viable. I feel this might not be a great way to do it.