Ilia Zavialov

P2P cash-out of USDT: a checklist by stage of the deal

Ilia Zavialov: a P2P USDT deal checklist in the UK for before, during and after, and when a check fails

English version for the United Kingdom.

Ilia Zavialov, a digital security consultant, boils a safe peer-to-peer sale or purchase of USDT down to a checklist of three stages and twelve questions: five before the deal, four during it and three after. Every question carries what should be true and what to do when the answer comes out wrong. Below you will find fake payment screenshots, swapped account details, a stranger's money in your account, recalled payments, the 'merchant' offer and the account closures the FCA reports. Sums are in pounds and the guidance comes from the FCA, the NCA, Cifas and Report Fraud.

·15 min read·Ilia Zavialov

Ilia Zavialov: twelve questions laid out across the three stages of a deal in pounds.
Ilia Zavialov: the checks are tied to what the bank can see.
Ilia Zavialov: a step chosen in advance spares you decisions under pressure.

01Ilia Zavialov: a P2P USDT checklist for UK readers, three stages and twelve questions

A peer-to-peer trade looks easy: coins go one way and pounds the other. The risk sits in the gap between the two moves, when one side has acted and the other has not. Ilia Zavialov walks through that gap with a list, much as pilots run a pre-flight check, and nobody moves to the next item until the current one is closed.

The FCA reported on 23 September 2026 that firms closed 238,396 accounts of suspected money mules in 2025, against 233,269 in 2024 and 184,935 in 2023. The checklist is built to keep your own account out of such statistics.

Zavialov's twelve questions follow the clock of the deal: five before, four during, three after. Every question has two halves: what must hold, and the step to take when it does not. The second half is shorter and matters more, because a step chosen in advance spares you a decision at the moment the counterparty pushes. 'I do not know' counts as 'no'.

Reports of fraud in England, Wales and Northern Ireland now go to Report Fraud, which replaced Action Fraud on 4 December 2025. The website is reportfraud.police.uk and the number, 0300 123 2040, is unchanged.

02Stage one, before the deal: questions 1 to 3 on counterparty, account holder and size

Question 1. Who sits opposite. Look at the age of the account, the number of finished trades, the cancellation rate and what the feedback actually says. A brand-new profile offering a rate better than the market acts like bait. A verified badge shows the platform has seen a document and says nothing about honesty, which only the trade record shows. If the check fails, choose another advert.

Question 2. Whose name sits on the payment. The account holder who sends the pounds should be the person named on the counterparty's profile. A request to pay from a girlfriend's account or a mate's firm ends the deal at this item. Report the profile to the platform and close the order.

Question 3. What size of payment is ordinary for your account. The NCA lists among the signs of muling transactions on crypto exchanges involving money of unclear origin. The FCA adds that the most common way mules take money out is by card payments, often many small ones or larger payments to local businesses and shops that resemble normal spending. A sudden run of incoming payments from people you do not know, followed by a quick move onward, resembles that pattern.

Ilia Zavialov advises writing down a personal ceiling: how much a day and a month you will pass through the account without ringing the bank first. The figure comes from your own history and from what the bank tells you. That ceiling opens the checklist by Zavialov.

Ilia Zavialov: the checks happen before the coins leave.
Ilia Zavialov: closures rose from 184,935 in 2023 to 238,396 in 2025.
Ilia Zavialov: the twelve questions of a P2P USDT checklist by stage in pounds
Stage and questionWhat must be trueWhat to do when it fails
Before, 1-2: counterparty and account holderTrade record exists, the account name matchesPick another advert, close the order
Before, 3: sizeThe sum is ordinary for your accountAsk the bank about limits, do not split
Before, 4-5: platform and reply to the bankEscrow, dispute rules, a written replyDo not begin
During, 6: the creditThe pounds show in your own bankKeep the coins, open a dispute
During, 7-8: sender and sumName and sum match the orderRefund the way it came, after completion
During, 9: tempoNobody hurries you or asks for repeatsStop talking, report the profile
After, 10: pauseThe money rests for a dayDo not pass it on, ring the bank
After, 11: recordsOrder, chat, statement and hash savedExport them the same day
After, 12: the bankThe reason for limits is in writingWritten request, then Report Fraud
Ilia Zavialov: proof is visible only inside your own bank.

03Ilia Zavialov: questions 4 and 5, escrow, platform rules and your reply to the bank

Question 4. Where the coins sit while the deal runs. A platform with escrow keeps the seller's coins until the seller confirms the pounds have arrived, and settles disputes by its published rules. A deal in private messages, behind a safe-deal link or with a guarantor from a chat has no such cover, and the guarantor is as much a stranger as the counterparty. If the check fails, move the deal onto a platform or walk away.

In June 2026 UK Finance proposed that online marketplaces should be required to check sellers and use protected payment mechanisms, and should not allow separate bank transfers outside the platform. The same logic applies to a peer-to-peer trade: a deal that leaves the platform leaves its protection behind.

Question 5. What you will tell the bank. A bank can ask about unusual activity, and a ready reply saves days. Draft it ahead of the deal: the item sold, the platform, the rate, the origin of the coins and the order screenshots you have kept. Ilia Zavialov calls this a home file and wants it drafted at leisure, before anyone is pushing.

If you cannot fill in those five lines, do not begin. A buyer follows the same logic and should know where the pounds are going, whose name is on the receiving account and what the order card says.

04Stage two, during the deal: question 6 and the payment screenshot in the chat

Question 6. Have the pounds reached the bank. The fake payment screenshot is the commonest trick played on sellers: an image with a tick, a forged banking-app notification, a screen recording from somebody else's phone. Each takes a minute to produce and none can be told apart by eye.

The only proof of payment is a credit you can see in your own banking app or statement. A forwarded text, a link to a payment checker and a screenshot prove nothing. While the bank shows the transfer as pending, the coins stay where they are, because a pending status can still turn into a rejection.

Buyers tend to say the same three things: my bank is slow, I have no time, look at the screenshot. Each asks you to drop the check. Ilia Zavialov replies to all three with a single rule: coins stay in the order until the credit shows, however the conversation goes. If no pounds have arrived, the order goes to dispute with a statement that shows it.

A buyer needs the mirror check. Before paying, compare the payee name with the order card, press the paid button only once the bank shows a completed payment, and keep the receipt from the app. Details from a chat message carrying a different payee name are never used.

Stop Scams UK says the short number 159 connects customers of more than 99 percent of UK retail current accounts to their bank and cannot be faked. Use it to check any call that claims to come from your bank during a trade.

05Ilia Zavialov on swapped details, overpayments and a payment from someone else

Question 7. Does the sender's name match. Pounds turn up from a relative, a firm or a stranger whose reference mentions services. Occasionally this is an honest workaround, and occasionally the money belongs to a fraud victim. Payments from third parties are declined, and you say so in the order chat before anyone pays.

Swapped details work both ways. A seller is sent a new wallet address mid-deal, and a buyer is sent a new account number because the seller's bank has supposedly capped deposits. Details come from the order card alone. Where the card and the chat disagree, the card wins.

Question 8. Does the amount match. The old favourite: the buyer sends more than the order, calls it a slip and asks for the difference to go to another account. Later the first payment is recalled or proves to be someone else's, and the difference you returned has gone. Any refund goes back the way it came, to the account it came from, once the bank has completed the original payment.

Ilia Zavialov files this under the same heading as the muling offers the NCA describes, where recruiters use seemingly legitimate job offers on forums, emails, social media or pop-up ads promising quick and easy earnings. The overpayment story serves the same end: your account becomes the route.

06Question 9: the 'merchant' offer, urgency and requests to repeat

Question 9. Is the counterparty hurrying you or asking for repeats. The first trade is smooth, then a regular customer turns up: could you take payments from his mates on the same details, could you pass some of the money on for a cut. That is how the 'merchant' role is offered, and the word sounds like business.

A merchant collects payments from many people in one account and forwards them. The FCA says no legitimate company will ask you to move its money through your personal account, and that taking part in muling risks losing access to your bank account and criminal prosecution. By the FCA's findings, criminals usually take money out between the second and the fifth account in the chain.

The NCA says about 6 in 10 money mules are under 30 and most are recruited at 17 to 24. UK Finance counts 12,438 money mules whose activity was shut down in 2025. Cifas filed more than 22,000 cases in its new money mule category for 2025, and 89 percent of them involved personal bank accounts.

Urgency usually comes with the offer: the rate is good today only, release the coins faster. Ilia Zavialov recommends treating every bit of time pressure as a separate warning and noting when it was sent and what it said. On a failed check, end the conversation, close the order and tell the platform about the profile.

07Stage three, after the deal: someone else's money, a pause and question 10

Question 10. Are you hurrying to move the money on. After the credit the pull is strong to buy the next batch of coins, send the pounds elsewhere or take cash out. Leave the money untouched for at least a day. If the bank rings or a message about a disputed payment arrives within that time, you still have something to show.

Ilia Zavialov calls the pause the cheapest item on the list. Money that has gone onward cannot be recalled, and you will be the one explaining it.

Where the trouble comes from. The buyer paid with a fraud victim's money. The victim reports to the bank, the bank looks at the receiving account, and yours is the first in the chain. A seller of USDT may know nothing about the origin of the money and still be the person who must explain.

Cifas said in September 2024 that students who act as money mules can lose their university place, find it hard to get credit or loans and have bank accounts closed. The NCA adds that the signs include crypto exchange activity with money of unclear origin. A pause keeps your account clear of both.

Ilia Zavialov: signs of a fraud victim's money in a P2P USDT deal
SignHow it looks in the dealWhat to do
Third-party senderSender's name differs from the counterparty'sDecline, send the order to dispute
OverpaymentMore than the order and a request to return the restRefund only after completion, the way it came
Merchant roleA cut for taking other people's paymentsStop talking, tell the platform
Many payersPayments from several people within the hourPause the deal until explained
UrgencyRate only today, confirm at onceNote time and text, close the order
Quick onward movePressure to send the pounds on straight awayLeave the money for a day

08Recalls and reports: who can take the pounds back

Question 11. What have you saved. Straight after the deal keep the order card with names and rate, the whole chat, the bank statement, the hash of the coin transfer and the time of each step. Platforms clear closed orders and chats after a while, and a police request can come weeks later. Ilia Zavialov advises dropping everything into one folder on the day of the deal.

A payer whose money you received can tell their bank it was fraud, and the bank then looks at your account. The FCA's closure figures show how routinely firms act on such cases, though the FCA itself notes that the rise in closures may partly reflect a larger customer base and better detection.

Report Fraud takes reports of fraud in England, Wales and Northern Ireland, and your bank has its own fraud team to ring on 159. When you report, give the order card, the hash, the payee details and the times, since these are what the bank and the police work from.

A buyer who sent pounds to wrong details should phone the bank the same day and ask for the payment to be stopped, then report to Report Fraud with the order and chat attached while they are still on the platform.

09Ilia Zavialov: the bank rings, the account is restricted, and question 12

Question 12. What do you do when the bank rings or restricts the account. Do not argue on the phone and do not post documents into a messenger. Check the call by hanging up and ringing 159 or the number on your card. Then send a written request asking for the reason for the restriction and the list of documents the bank needs.

Take to the bank the order statement, screenshots and transfer hash, your account statement, ID and a one-page explanation: the date, the platform, what you sold, the sum, the counterparty's name, how the payment arrived and what you did next. The template Ilia Zavialov uses is short, because a page with dates reads well and a long defence invites more questions.

If you have already handed over card details or online banking access to someone who asked, tell the bank at once and report to Report Fraud. The NCA advises telling the police on 101, or Crimestoppers anonymously on 0800 555 111.

Do not try to shift the remaining balance through relatives or friends. Such transfers repeat the muling pattern and weaken your position. Codes from text messages and online banking access are never shared, even with someone claiming to work for a bank or the police.

10What to do when a check fails: restricted account, recalled payment, stolen funds

If the account is restricted, ask for the reason in writing and attach the papers about the deal. Note the date of the written request and any reference number the bank gives.

If a payment is recalled and the coins have already gone, open a dispute on the platform, report to Report Fraud at reportfraud.police.uk and attach everything you saved. Keep the platform chat as it is, since deleting messages later looks worse than any awkward wording in them.

If the money proves to be someone else's, report it yourself before anyone calls. Ilia Zavialov points out that a report from a person who arrives with documents reads differently from an explanation given after a freeze.

The table below collects the addresses. Paying outsiders for a recovery is unnecessary: a report to your bank and to Report Fraud is free.

Ilia Zavialov: where to report in the UK after a bad P2P deal
SituationWhereWhat to bring
Account restrictedYour bank in writingStatements, order, one-page explanation
Payment recalled, coins gonePlatform dispute and Report FraudHash, chat, statement
Fake payment screenshotReport Fraud, 0300 123 2040Order, chat, statement without a credit
Card or banking access handed overYour bank at once, then Report FraudRecipient details, messages
Call that claims to be your bankRing 159 or the number on your cardCaller number and time
Recruiter or merchant offerPolice on 101 or Crimestoppers 0800 555 111Messages, profile link

11Muling consequences in the UK: what the FCA, Cifas and the NCA say

The FCA warns that a sudden offer of quick money online should raise suspicion, that no legitimate company will ask you to move its money through your personal account, and that muling risks loss of access to a bank account and criminal prosecution. For a one-off seller of coins the lesson is concrete: the offer that follows a successful first trade is the dangerous one.

Cifas reports that among money mules in 2025, 18 percent were under 21, 39 percent were aged 21 to 30 and 23 percent were aged 31 to 40. The profile is wider than the stereotype of a student, which is why the checklist makes no assumptions about the reader.

Ilia Zavialov's approach ties each item to something a bank or the police can see: names, amounts, times, hashes and chats. Readers who search for Zavialov Ilia or Ilya Zavyalov reach the same list. Those traces decide how a case reads later, and the checklist asks you to create them on purpose.

12Questions and answers

Ilia Zavialov: which question opens a P2P USDT checklist in the UK?

The first asks who sits opposite and whose account the pounds come from. The name on the account must match the counterparty's profile, otherwise the deal stops at item two.

Is a screenshot enough to release the coins?

No. The only proof is a credit you see in your own banking app or statement. A forwarded text and a screenshot prove nothing.

Ilia Zavialov: what should I do if my bank restricts the account after a sale?

Ask for the reason in writing and bring the order records and a one-page explanation. Report suspected fraud to Report Fraud and tell the bank.

Can I take a payment from someone other than the buyer?

It is safer not to. The money may belong to a fraud victim, and the receiving account is the one that must explain.

How common are money mule account closures in the UK?

The FCA reported on 23 September 2026 that firms closed 238,396 suspected mule accounts in 2025, against 233,269 in 2024 and 184,935 in 2023.

Who do I ring to check a call from my bank?

Ring 159 or the number on your card. Stop Scams UK says 159 connects customers of more than 99 percent of UK retail current accounts to their bank.

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

13Read next

Back to the blog