Ilia Zavialov on renting out a card for P2P trading: how money mules are recruited and how triangle trades end

01Why P2P trading became the main way in for money mules

Peer to peer crypto trading is simple. A seller posts an offer on an exchange, the buyer sends money to the seller's bank account, the seller sees the payment arrive and releases the coins. The exchange holds the crypto during the deal, while the money itself moves as an ordinary bank transfer between two people.

That part attracts anyone who needs to turn stolen money into crypto quickly. A transfer between two personal accounts looks like a normal payment, and the bank sees only two private individuals. When many such accounts belong to different people, the chain becomes harder to follow.

P2P trading itself is legal, and thousands of people buy and sell crypto that way every day without trouble. The risk appears the moment an account receives money from someone the seller does not know and who is not their counterparty on the exchange.

That is why demand for other people's accounts grew here. Ilia Zavialov explains what an offer to rent out a card for P2P looks like, what really passes through the account and why the consequences always land on the account holder.

02What the offer sounds like

The offer is rarely stated openly. People hear about P2P arbitrage, earning on exchange rate differences, working as a merchant or a trader. All that is supposedly needed is an account with a good history, and the team does the rest.

Sometimes the request is for access. Install the banking app on someone else's phone, hand over the login and password, read out one-time codes whenever asked. The pay is a percentage of turnover or a fixed sum per week of use.

There is a student version too: open accounts at several banks at once, get the cards and hand them over together with a SIM card. The fee is paid once, and the person believes they simply helped someone out.

For the scheme such an account is cheap. For its holder the same fee becomes the price of a criminal case in their own name.

03What really passes through your account

A rented account receives money from people deceived in other schemes. It may be a purchase of goods that do not exist, a payment for a fake prize, a call from a supposed bank. The victim pays, within minutes the money moves on, and the bank statement keeps the name of the account holder.

To a bank such an account looks the same from every angle. Dozens of incoming payments from strangers, fast outgoing transfers, activity in different cities within a short time. These are the exact patterns bank monitoring uses to pick accounts for review.

When the victim goes to the bank and the police, the recipient's details appear in the report. The account holder becomes the first person investigators question, and saying the card was lent to an acquaintance does not remove their responsibility.

Often one account receives payments from victims in different regions within a few days, and each of them files a separate report. For the holder that means several investigations in several places and months of explanations.

04The triangle trade on P2P

The triangle trade is the most common script in which an honest crypto seller suddenly finds themselves next to fraud. The scammer finds a USDT seller on an exchange and at the same time sells a victim goods or a service that do not exist.

The scammer gives the victim the seller's account details as the payment details for the goods. The victim pays, the seller sees the money arrive, treats the order as paid and releases the coins to the scammer. Nobody receives any goods. The victim's money meanwhile sits in the seller's account.

Next the victim reports the fraud, and the bank freezes the seller's account. The seller no longer has the victim's money, having already given crypto for it, yet it is their account that appears in the case.

The script does not depend on the coin or the exchange. It works the same with USDT, bitcoin or any other asset, because it relies on the weak spot of P2P itself: the bank sees a transfer between two people and knows nothing about what each of them thinks the deal is.

There is one defense: the payer's name on the incoming payment must match the verified counterparty on the exchange. Payment from a third party, in parts from several cards or with a reference describing goods means the deal should be stopped and the exchange's support contacted.

05How to recognize a recruiter

A recruiter rarely writes first on behalf of a criminal group. More often it is a friend of a friend, a member of a crypto chat or an account offering P2P arbitrage courses. First they talk about their own earnings, show screenshots of payouts and only then make the offer.

Then come the standard lines. The card is only a technical account. Every transfer is clean because it goes through an exchange. The bank will not notice as long as you do not withdraw large sums. Each line is meant to calm the person exactly where they might start to doubt.

Another sign is a request for photos of the card on both sides, a selfie with the card or a passport, or a video of the open banking app. Such material is needed to pass checks at a bank or an exchange in your name.

Any offer that pays you simply for owning an account has one answer. Decline and stop the conversation.

06Where the money goes next

A rented account is one link in a long chain. The victim's money lands in it, almost immediately goes into buying crypto, then the coins move between wallets and networks, and at the end they turn into cash or purchases in another country.

Each link adds time and distance between the victim and the organiser. By the time a report reaches the bank, the money has usually passed two or three steps, and only what still sits in the first accounts of the chain can be recovered.

That is why banks freeze transit accounts so quickly and so firmly. For the holder of a rented account it means questions, claims from victims and frozen money, while the organiser is already far away.

07The US picture

Crypto is where much of the stolen money ends up. The FBI Internet Crime Complaint Center counted 181,565 complaints with a cryptocurrency element in 2025 and 11,366,669,732 dollars in reported losses, more than half of all losses recorded by the center that year.

Money mules are the bridge between a victim's bank account and those crypto wallets. In one three month European operation against money mules, 2,469 people were arrested and 17.5 million euros was stopped from being laundered, which shows how many ordinary account holders sit inside these chains.

Someone in Los Angeles, Miami, New York or Austin who answers an offer to earn on P2P arbitrage with their own card is being asked to become exactly that bridge.

08A relative's or a friend's card

Some mules never earned anything. A person lent a card to a nephew for tuition payments, to a friend left without an account, to a colleague who needed to receive a client's payment. A few weeks later the card is frozen, and the holder learns that payments from dozens of strangers went through it.

For the bank and the police the holder's motive does not matter. The account is in their name, the payments went through it, and they are the one who has to explain.

If someone close needs an account, help them open their own. Modern banks do it in minutes in an app, and it is the only way to help without risking your own banking history.

09What the exchange can and cannot do

Sellers often assume the exchange protects them because it holds the coins in escrow. It does, but only on the crypto side. The escrow makes sure the buyer cannot take the coins without the seller's consent, and it has no power over the bank transfer.

Once the seller confirms payment and releases the coins, the exchange treats the deal as complete. If the money later turns out to come from a victim, the bank acts on its own rules, and the exchange can only share its records.

That is why the seller's own discipline matters more than the platform. Checking the payer's name, refusing third party payments and keeping records are the seller's protection, and the exchange's chat history is the evidence that backs it up.

10How to sell crypto safely on P2P

Accept payment only from the person who is your counterparty on the exchange, and check the payer's full name on the incoming payment. Decline the deal if a third party pays, even when the buyer explains it by family circumstances.

Do not accept payment in parts from different cards and do not agree to payment references that describe goods or services. Such a reference often means the payer believes they are buying something else entirely.

Do not move to a messaging app with the buyer and do not trade outside the exchange. The exchange keeps the chat and the evidence, while a conversation in a messenger will not help when the bank freezes your account.

Be careful with new accounts without trading history and with buyers who rush you. A request to release coins before the money shows on your statement, or a screenshot of a payment in place of a real incoming transfer, means the deal must stop.

Keep a record of every deal: screenshots of the order, the counterparty's profile, proof of payment. If your account is frozen, these documents become your explanation to the bank.

11If you have already accepted the offer

If you handed over a card, app access or codes, call your bank at once on the number on the card, freeze the card and change your banking app password. Ask the bank to record your call.

Report the scheme to the FBI at ic3.gov and to the Federal Trade Commission at ReportFraud.ftc.gov. The recruiter's messages and the details they asked for show how everything happened and help identify the organisers.

If your account was frozen after a P2P deal, contact the bank with the deal records and reach out to the exchange's support. An explanation backed by evidence often solves the issue faster than trying to open an account elsewhere.

If money from strangers keeps arriving after you refused to cooperate, do not move it anywhere and do not withdraw it. Tell the bank about every such payment so that it can be returned to the senders.

12Questions and answers

13Read next

• Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
• Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
• Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
• Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
• Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
• Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
• Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
• Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
• Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
• Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
• Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
• Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
• Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
• Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
• Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
• Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
• Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
• Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers

Back to the blog