Ilia Zavialov

P2P cash-out of USDT: a checklist by stage of the deal

Ilia Zavialov: a P2P USDT deal checklist for before, during and after, and what to do when a check fails

English version for the United States.

Ilia Zavialov, a digital security consultant, reduces a safe peer-to-peer sale or purchase of USDT to a checklist of three stages and twelve questions: five before the deal, four during it and three after. Each question comes with what should be true and what to do when the answer comes out wrong. The sections below cover swapped payment details, a stranger's money landing in your account, recalled payments, fake payment screenshots, the 'merchant' offer, third-party senders, and what FinCEN guidance says about people who exchange crypto for a living. Amounts are in dollars and the rules come from the FTC, the FBI and FinCEN, which is where Zavialov's checklist takes its facts.

·15 min read·Ilia Zavialov

Ilia Zavialov: five, four and three questions of a P2P USDT checklist by stage, illustration
Ilia Zavialov: twelve questions laid out across the three stages of a deal.
Ilia Zavialov: talk on P2P USDT deals and the checklist by stage in front of an audience
Ilia Zavialov: the step for a failed check is chosen before the deal.
Ilia Zavialov: a P2P USDT checklist with three stages and twelve questions
Ilia Zavialov: each stage has its own questions and a step chosen in advance.

01Ilia Zavialov: a checklist for P2P USDT deals, three stages and twelve questions

A P2P trade looks simple: you release coins and receive dollars, or the other way round. The danger sits in the gap between the two moves, when one side has already acted and the other has not. Ilia Zavialov suggests walking through that gap with a list, the way pilots run a pre-flight check: until an item is closed, nobody moves on to the next.

The list follows the clock of the deal. Before the deal you choose the counterparty, the platform and your limits, and nothing is lost yet. During the deal money and coins move, and a mistake costs the most. After the deal the bank, the payee and sometimes the police start asking questions, and your records speak for you.

There are twelve questions: five before, four during and three after. Each has two parts, what must be true and what to do when it is not. The second part is shorter and matters more, because an action chosen in advance spares you a decision at the moment the counterparty pushes. An answer of 'I do not know' counts as 'no'.

The FBI Internet Crime Complaint Center counted 181,565 complaints with a cryptocurrency link in 2025, up 21 percent from 2024, with 11.366 billion dollars in reported losses and an average loss of 62,604 dollars. Those figures include investment fraud, a different scheme from a P2P trade.

02Stage one, before the deal: questions 1 to 3 on counterparty, payee name and limits

Question 1. Who is on the other side. Check the account age, the number of completed trades, the cancellation rate and the text of the feedback. A fresh profile that promises a better rate than the market behaves like bait. A verification badge says the platform saw an ID; only the trade history speaks to reliability. If the check fails, pick another offer, because a platform lists dozens.

Question 2. Whose name is on the payment. The owner of the account the money will come from should match the name on the counterparty's profile. When you are offered a spouse's card or a friend's company account, the deal ends at this item. Report the profile to the platform and close the order.

Question 3. What amount looks ordinary for your account. FinCEN says a currency dealer or exchanger counts as a money services business above 1,000 dollars per person per day in one or more transactions, while a money transmitter has no threshold. Those rules target people who trade as a business, and they show where regulators draw the line between a one-off sale and a trade. Splitting a large amount into pieces draws attention by itself; ask your bank about limits first.

Ilia Zavialov advises writing down a personal ceiling: how much per day and per month you will pass through the account without calling the bank. The number comes from your past activity and from the bank's answer. That ceiling is the first line of the checklist by Zavialov.

Ilia Zavialov: the three stages of a P2P USDT deal and the checks at each stage, illustration
Ilia Zavialov: the checks happen before the coins leave.
Ilia Zavialov: dollars attempted and dollars frozen in the FBI Financial Fraud Kill Chain in 2025
Ilia Zavialov: 679 million of 1.16 billion dollars attempted were frozen, a 58 percent success rate.
Ilia Zavialov: the twelve questions of a P2P USDT checklist by stage
Stage and questionWhat must be trueWhat to do when it fails
Before, 1-2: counterparty and payeeTrade history exists, the account name matchesPick another offer, close the order
Before, 3: limitsThe amount is ordinary for your accountAsk the bank about limits, do not split
Before, 4-5: platform and bank answerEscrow, dispute rules, a written answerDo not start the deal
During, 6: the creditThe money is visible in your own bankKeep the coins, open a dispute
During, 7-8: sender and amountName and amount match the orderRefund the same way, after completion
During, 9: tempoNobody rushes you or asks for repeatsStop talking, report the profile
After, 10: pauseThe money sits for a dayDo not forward it, call the bank
After, 11: recordsOrder, chat, statement and hash savedExport them the same day
After, 12: the bankThe reason for limits is in writingWritten request, then report
Ilia Zavialov: real payment proof compared with a fake screenshot in a P2P USDT deal
Ilia Zavialov: proof is visible only inside your own bank.

03Ilia Zavialov: questions 4 and 5, escrow, platform rules and your answer for the bank

Question 4. Where the coins sit during the deal. A platform with escrow holds the seller's coins until the seller confirms the money arrived, and settles disputes under its own rules. A deal in private messages, through a safe-deal link or via a guarantor from a chat has no such protection, and the guarantor is as much a stranger as the counterparty. If the check fails, move the deal onto a platform or cancel it.

The FTC states that cryptocurrency payments typically are not reversible and do not come with legal protections, and that funds are usually recovered only if the person you paid sends them back. For a seller that is a reason to be strict about the money arriving first. For a buyer it is a reason to pay only to the details in the order card.

Question 5. What you will say to the bank. A bank can ask about unusual activity, and a ready answer saves days. Write it before the deal: what you are selling, on which platform, at what rate, where the coins came from and which screenshots of the order are saved. Ilia Zavialov calls this a home file, written calmly while nobody is pushing.

If you cannot fill in those five lines, do not start. The same logic holds for a buyer, who should know where the dollars are going, whose name is on the receiving account and what the order card says.

04Stage two, during the deal: question 6 and the payment screenshot in the chat

Question 6. Has the money reached the bank. A fake payment screenshot remains the most common trick played on sellers: an image with a green check mark, a faked push notification, a screen recording from somebody else's phone, a status of 'pending'. Each takes a minute to make.

The only proof of payment is a credit you see yourself in your own bank app or statement. A forwarded text message, a link to a payment checker and a screenshot do not count. If the bank shows the transfer as pending or the funds as held, the coins stay in escrow, because the status can still change to a rejection.

Buyers tend to repeat three lines: my bank is slow, I am short on time, look at the screenshot. Each line asks you to skip the check. Ilia Zavialov answers all three with one rule: coins stay in the order until the credit appears, whatever mood the other side is in. If the check fails, open a dispute and attach a statement showing no deposit.

The check works in reverse for buyers. A buyer of USDT takes payment details only from the order card. A message from supposed platform support in a private chat with a different account number comes from a scammer, since real support does not change payment details in a conversation.

05Ilia Zavialov on swapped payment details, overpayments and third-party senders

Question 7. Does the sender's name match. Money arrives from a relative, a company or a stranger with a note about services. Sometimes it is an honest workaround. Sometimes the money belongs to a victim of fraud, as the next sections explain. The rule is simple: no third-party payments, and say so in the order chat before payment.

Swapped details work in both directions. A seller gets a new wallet address for the coins in the middle of the deal, and a buyer gets a new account number because the seller's bank supposedly limits deposits. Details are taken only from the order card. If the card says one thing and the chat another, the card is right.

Question 8. Does the amount match. The classic: the buyer sends more than the order, calls it a mistake and asks for the difference to go to another account. Later the first payment is recalled or turns out to belong to someone else, and the refunded difference is gone. Refunds go back the same way and to the same account the payment came from, and only after the bank has completed the transfer.

Ilia Zavialov treats this as a close relative of the routine the FTC describes in its money mule alert: a recruiter sends money, usually by check or in Bitcoin, and asks for it to be forwarded by gift cards or a wire. The FTC warns that helping move stolen money can bring legal trouble even without intent, and that when a check proves fake the bank asks for the whole amount back.

06Question 9: the 'merchant' offer, urgency and requests to repeat

Question 9. Is the counterparty rushing you or asking for repeats. The first trade goes smoothly, then a regular customer appears: can you accept payments from his friends on the same details, can you forward part of the money for a percentage. That is how the role of a 'merchant' is offered, and the word sounds like business.

A merchant takes payments from many people into one account and passes them on. The FTC says recruiters find money mules on dating sites, job sites and social media. If you are already involved, the FTC advises stopping the payment, stopping contact, telling your bank and the transfer service at once and reporting at ReportFraud.ftc.gov.

The Department of Justice announced the fifth Money Mule Initiative on May 22, 2023: over roughly three months it took more than 4,000 actions against people who helped fraudsters move money, and more than 25 were criminally charged.

Urgency usually travels with the offer: the rate is good today only, release the coins faster. Ilia Zavialov recommends treating every time pressure as a separate warning sign and noting the time and wording of the message. If the check fails, stop talking, close the order and report the profile to the platform.

07Stage three, after the deal: someone else's money, a pause and question 10

Question 10. Are you in a hurry to move the money onward. After the credit there is a strong pull to buy the next batch of coins, wire the dollars elsewhere or withdraw cash. Hold the money in place for at least a day. If a call from the bank or a message about a disputed payment arrives within that time, you still have something to show.

Ilia Zavialov calls the pause the cheapest item on the checklist. Money that has gone onward cannot be recalled, and you will be explaining it alone.

Where trouble comes from. The buyer paid with a fraud victim's money. The victim reports to the bank, the bank looks at the receiving account, and yours is first in the chain. A seller of USDT may know nothing about where the money came from and still be the one who has to explain.

The FBI 2025 Internet Crime Report states how fast the clock runs: if you discover a fraudulent transfer, time is of the essence, so contact the financial institution at once and ask for a recall of the funds. The IC3 Financial Fraud Kill Chain handled 3,900 incidents in 2025 and froze 679,013,183 dollars of 1,163,919,846 dollars attempted, a 58 percent success rate.

Ilia Zavialov: signs of someone else's money in a P2P USDT deal
SignHow it looks in the dealWhat to do
Third-party senderThe sender's name differs from the counterparty'sDecline, send the order to dispute
OverpaymentMore than the order and a request to refund the differenceRefund only after completion, the same way
Mistaken transferA stranger asks you to send money back to a phone or cardDo not send, call the bank
Merchant roleA percentage for taking other people's paymentsStop talking, tell the platform
Payers at many banksParts of the amount come from several accountsPause the deal until explained
UrgencyRate only today, confirm at onceNote time and text, close the order

08Recalls, disputes and reversals: who can take the dollars back

Question 11. What have you saved. Right after the deal save the order card with names and rate, the whole chat, the bank statement, the hash of the coin transfer and the time of each step. Platforms delete closed orders and chats after a while, and a request from investigators can arrive weeks later. Ilia Zavialov advises putting everything in one folder on the day of the deal.

A buyer who paid you with stolen money, or a payer who disputes a transfer, can ask a bank to recall it. The FBI advises sending any recall request immediately and filing a complaint at ic3.gov regardless of the amount, with full transaction details, because IC3 may be able to assist banks and law enforcement in freezing funds.

The FTC adds the other half: once your coins have gone to the buyer, they are not coming back unless the buyer sends them back. Money in a bank can be recalled and coins cannot, so the order of the steps matters more than their speed.

FinCEN guidance FIN-2019-G001 of May 9, 2019 repeats that exchangers and administrators of virtual currency generally qualify as money transmitters while a user, a person who obtains virtual currency to purchase goods or services for itself, does not.

09Ilia Zavialov: the bank calls, the account freezes, and question 12

Question 12. What do you do when the bank calls or freezes the account. Do not argue on the phone and do not send documents to a messenger. Check the call by hanging up and dialing the number on the back of your card or in the app. Then submit a written request asking for the reason for the restriction and the list of documents the bank needs.

Bring to the bank the order statement, screenshots and transfer hash, the account statement, your ID and a one-page explanation: the date, the platform, what you sold, the amount, the counterparty's name, how the payment arrived and what you did next. Ilia Zavialov's template keeps that page to dates and facts.

If you have already handed over card details or online banking access at someone's request, the FTC advises stopping the payment, ending contact, telling the bank and the transfer service right away and reporting at ReportFraud.ftc.gov. The FBI asks for a complaint at ic3.gov regardless of the amount.

Do not try to move the remaining balance through relatives or friends. Such transfers repeat the pattern of a money mule and worsen your position.

10What to do when a check fails: frozen account, recalled payment, someone else's money

If the account is frozen, ask for the reason in writing and attach the documents about the deal. Keep the date of the written request and any reference number the bank gives you.

If a payment is recalled and the coins have already gone, open a dispute on the platform, report to the FTC at ReportFraud.ftc.gov and to IC3 at ic3.gov, and attach everything you saved. The FTC lists the same channels for suspicious cryptocurrency activity, along with the CFTC, the SEC and the exchange used to send the money.

If the money turns out to be someone else's, report on your own initiative before anyone calls you. Ilia Zavialov points out that a report from a person who arrives with documents reads differently from an explanation after a freeze.

The table below collects the addresses. Paying outsiders for a recovery is unnecessary: a report to the bank, the FTC and IC3 is free.

Ilia Zavialov: where to report in the United States after a bad P2P deal
SituationWhereWhat to bring
Account frozenYour bank in writingStatements, order, one-page explanation
Payment recalled, coins gonePlatform dispute, ic3.gov and ReportFraud.ftc.govHash, chat, statement
Fake payment screenshotic3.gov and ReportFraud.ftc.govOrder, chat, statement without a credit
Card or banking access handed overYour bank at once, then the FTCRecipient data, messages
Call that claims to be your bankCall back on the number on your cardCaller number and time

11What FinCEN guidance says about people who exchange crypto for a living

FinCEN guidance FIN-2019-G001 of May 9, 2019 says that a natural person who works as a peer-to-peer exchanger and provides money transmission with real currency or convertible virtual currency must comply with Bank Secrecy Act rules as a money transmitter, regardless of the regularity or formality of the deals.

Such a person registers with FinCEN as a money services business. A person who does this infrequently and not for profit or gain is exempt. A reader selling a few coins now and then is described by the exemption, while a reader who trades for profit on a regular basis should ask a lawyer which duties apply.

The checklist gives that guidance a practical role in questions 1 and 9. A counterparty who asks you to take payments for a percentage may be asking you to run an unregistered money business, and a bank that sees repeated deals may ask the same thing. Ilia Zavialov's method keeps the answer ready before the question arrives. Whether readers search for Ilia Zavialov, Zavialov Ilia or Ilya Zavyalov, they reach the same checklist.

12Questions and answers

Ilia Zavialov: which question starts a P2P USDT checklist?

The first asks who is on the other side and whose account the money comes from. The name on the account must match the counterparty's profile, otherwise the deal stops at item two.

Is a screenshot enough to release the coins?

No. The only proof is a credit you see in your own bank app or statement. The FTC says cryptocurrency payments typically are not reversible, so coins that leave cannot be called back.

Ilia Zavialov: what do I do if my account is frozen after a P2P sale?

Ask for the reason in writing and bring the order records and a one-page explanation. Report fraud you suspect at ic3.gov and ReportFraud.ftc.gov.

Can I accept money from a third party?

It is safer not to. The payment may be a fraud victim's money, and the receiving account is the one that has to explain.

Do P2P exchangers have to register with FinCEN?

FinCEN guidance of May 9, 2019 says a natural person acting as a P2P exchanger must comply as a money transmitter, with an exemption for infrequent activity not for profit or gain.

What does the FBI advise after a fraudulent transfer?

Contact the financial institution at once and ask for a recall, then file a complaint at ic3.gov regardless of the amount, with full transaction details.

Monogram of Ilia Zavialov

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

13Read next

Back to the blog