Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Revolut payment links to avoid disputes #1806

Closed
cbeams opened this issue Oct 23, 2018 · 24 comments

Comments

Projects
None yet
8 participants
@cbeams
Copy link
Member

commented Oct 23, 2018

A common source of disputes with Revolut trades has emerged. The scenario is like this:

  1. The seller publishes an email address in the Bisq trade details that is not actually registered with Revolut.

  2. The buyer tries to send payment to that email address, but Revolut says it's not valid, i.e. not associated with a user account.

  3. The buyer opens a dispute and explains that they can't complete payment.

  4. I discuss the situation with the seller, and they explain that the buyer should send them a Revolut "payment link" via the interface at https://www.revolut.com/ie/payments.

  5. The buyer does so, shares the payment link with me via arbitration chat, and I relay the payment link to the seller.

  6. The seller accepts the payment via the payment link, and I then close out the issue.

The problem here is twofold:

  1. the buyer has no idea whether the email address in the trade details is a registered Revolut account, or one that needs a payment link sent to it. They also may not know that payment links even exist, so when the get the 'invalid account' message from Revolut, they just go straight to a dispute.

  2. Assuming they do know about payment links and create one, the seller does not get notified via email about the payment link. The buyer must manually email the payment link to the seller. This is not great for opsec on either side.

I see two options to solve this problem:

  1. Require that email addresses published in trade details are actually registered with Revolut, not just arbitrary addresses that can receive a payment link.

  2. Enhance the UI to allow the seller to specify how they expect the payment (direct via Revolut, or via a Revolut payment link), and add something to the UI (a popup, I guess) that explains to the buyer what they need to do in case of a payment link (give them the payment link creation URL as specified above, and explain that they must manually email the payment link to the seller's provided email address).

I would estimate I've dealt with a dozen or so disputes of this nature since we started supporting Revolut, and it requires an inordinate amount of back and forth to get these disputes resolved, so I think it's worth to do something to solve it.

My gut feeling is that we should go with something like option (2) above. While it's more complex, I don't think that simply making a rule as described in (1) will work very well. People won't read it, they'll still use unregistered email addresses, and we'll still end up with disputes. The only advantage there is that we'd be able to say it's a clear protocol violation. Right now we can't even do that.

/cc @alfsbs

@sqrrm

This comment has been minimized.

Copy link
Member

commented Oct 23, 2018

I agree that (2) sounds better.

With the information on how to handle this within the client the users should in general be able to handle things without bringing it to dispute, which is the aim here. I don't know enough about revolut to say, but if there is no added security risk with using payment links then that seems like a distinct advantage for bisq to be able to support them.

@flix1

This comment has been minimized.

Copy link
Member

commented Oct 23, 2018

This problem does not arise if the Revolut user gives a phone number instead of an e-mail. The phone number allows instant payment.

It's worse for privacy than e-mail... but if you make a Revolut payment you are going to end up having the other person's phone number anyway. So maybe just keep it simple and eliminate the e-mail option?

@flix1

This comment has been minimized.

Copy link
Member

commented Oct 23, 2018

Yes, I've checked. If you go through your Revolut received or made payments you can see a statement which shows the phone number of the payer/payee... so no additional privacy is lost if we limit this to the phone number option.

@aicbaicb

This comment has been minimized.

Copy link

commented Oct 23, 2018

When a Revolut account is opened, it can be opened either using an email address or phone number. In either case, sending to a registered account is instant. If sending to an unregistered email address or phone number, a payment link would be created. As such, there is no advantage to limiting to phone number only, as by doing so it will not be possible to send to an account setup with an email address, and if the phone number is unregistered, we're back to the payment link issue

@aicbaicb

This comment has been minimized.

Copy link

commented Oct 23, 2018

The reference to the payment link https://www.revolut.com/ie/payments is incorrect. The only way to send a link is through the iOS/Android app.

@aicbaicb

This comment has been minimized.

Copy link

commented Oct 23, 2018

A third option which would work better than option 2 would be to modify the UI such that the buyer can paste/type in the payment link which would be sent through the UI to the seller, thus avoiding the need to email the link.

@HarryMacfinned

This comment has been minimized.

Copy link
Contributor

commented Oct 23, 2018

@flix1 wrote:

... so no additional privacy is lost if we limit this to the phone number option.

With email, you can use protonmail, riseup, etc. Which pretends to respect privacy.
With a phone number, privacy is gone.

@montvid

This comment has been minimized.

Copy link

commented Oct 28, 2018

I just tested the revolut payment system. For bisq purposes only Name and Surname and payment link is needed see option 2. The buyer can provide a photo of his Revolut history with the sellers name and surname to confirm he has paid the seller.

1 If you send money to a telephone number only the person whose number it is gets the money. In your Revolut history you will see the person who claimed the money name and surname no matter what his nickname may be.
2. If you generate a payment link anyone can take the money provided they have the link (no email needed and revolut crashes/does not send out an email anyway) and a revolut account. In your Revolut history you will see the person who claimed the money name and surname no matter what his nickname may be.

@montvid

This comment has been minimized.

Copy link

commented Oct 28, 2018

@flix1 i don't see any phone number in my statements regarding money sent to me via a link or by any other means. What should I push in Revolut to get the info you claim you see?

@flix1

This comment has been minimized.

Copy link
Member

commented Oct 31, 2018

Hi @montvid this is how I did it:

-Go to the revolut wallet.
-Scroll down the list of payments.
-Click on an incoming payment for the details

In the payment details scroll down and you should see the phone number of the payer, just above money received and Fee.

@montvid

This comment has been minimized.

Copy link

commented Nov 1, 2018

@flix1 on the latest revolut 5.21 there is no such info. Above Money received and Fee there are buttons Statement and Hide and no phone number.

@stale

This comment has been minimized.

Copy link

commented Jan 30, 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the was:dropped label Jan 30, 2019

@ManfredKarrer

This comment has been minimized.

Copy link
Member

commented Feb 2, 2019

I think that should be still kept open.

@ManfredKarrer

This comment has been minimized.

Copy link
Member

commented Feb 15, 2019

#2426 should be a easy fix. We will see if it helps to reduce dispute cases.

  • It use "Registered phone nr." as label title when creating an account.
  • Email is still supported for backward compatibility. Also we dont do input validation to be more flexible if it turns out that we still should support email
  • I added a popup stating that the phone number must be registered at Revolut (@flix1 said that is the case anyway, but there was another post with different opinion, so I added it just to be safe).
@lestephane

This comment has been minimized.

Copy link

commented Feb 26, 2019

I'm trying to do my first payment, got the exact experience mentioned, i try to add a contact by email address, the user is not shown as being a Revolut user, and i'm asked to "Create payment link", which I sure as hell don't want to send to an email. This is on 0.9.4, so it's unclear whether it contains 2426.

I want to pay from Revolut user to Revolut user, all in the Revolut App, no link. Given that, I want to cancel the payment for the trade i initiated. Can I let the trade period expire and if I do, will I lose my deposit?

More generally, is there no way to tell from the UI ahead of time whether we're dealing with a user 'by-email' as opposed to 'by-phone-number'?

Confusion galore

@ManfredKarrer

This comment has been minimized.

Copy link
Member

commented Feb 26, 2019

@lestephane Old accounts created before 0.9.4. can still have email addresses. We did not want to force all users to set up a new account.

You can open a dispute with cmd+o or ctrl+o. You will not lose the deposit. Give the arbitrators a link to that GH issue just in case.

Revolut is a bit of a mess unfortunately. Surprised why it is so polular... They seem to have the policy to attact users by - just use it - no registration required. But once money is sent/received - ah then you need to register - "sorry didn't you read the fine print" / "did u take our advertising serious"?

@lestephane

This comment has been minimized.

Copy link

commented Feb 26, 2019

@ManfredKarrer Thanks for taking the time to respond, I pre-emptively ctrl+o'd with the GH issue link earlier today. Now waiting for the trade remaining time to run its course, or the arbitrator to come back to me (whichever comes first I guess). So far, I'm happy with bisq. These UX quirks will smooth out over time.

@lestephane

This comment has been minimized.

Copy link

commented Feb 27, 2019

By the time the arbitrator came back to me regarding my support ticket, the trade period had ended. The arbitrator said he would ask the other user for his phone number, still waiting for an update, and my deposit is still locked.

I think this issue is still unresolved, since I have no way to tell ahead of time if a user registered by email or by phone number.

  • If I'm dealing with an email user, I'm later asked to create a payment link, I get confused, I open a support ticket. Negative experience.
  • If I'm dealing with a phone number user, the user shows up as Revolut user, I'm not confused, type the amount, the reference. Positive experience.

So I want to avoid Revolut users registered by email like the plague. And want nothing to do with Payment links. Don't care how they work, don't need / want to know.

Suggested resolution:

split the Revolut payment method into two payment methods:

  • Revolut (payment link) -> for people registered by email
  • Revolut (app) -> for people registered by phone number

That way, I can filter to hide all Revolut (payment link) offers, and I never have to waste an arbitrator's time regarding this problem again.

@aicbaicb

This comment has been minimized.

Copy link

commented Feb 27, 2019

Revolut is a bit of a mess unfortunately. Surprised why it is so polular... They seem to have the policy to attact users by - just use it - no registration required. But once money is sent/received - ah then you need to register - "sorry didn't you read the fine print" / "did u take our advertising serious"?

You are right. I have been using Revolut with no problems for over a year. Suddenly they froze my account for a "review". Early on, I'd sent (and had approved) proof of source of funds and other KYC documentation, so I don't know why it's been frozen now. The only potentially problematic transactions are Bisq, so it may be that it's not the best idea to use Revolut with Bisq right now.

@aicbaicb

This comment has been minimized.

Copy link

commented Feb 27, 2019

  • If I'm dealing with an email user, I'm later asked to create a payment link, I get confused, I open a support ticket. Negative experience.
  • If I'm dealing with a phone number user, the user shows up as Revolut user, I'm not confused, type the amount, the reference. Positive experience.

This is only if the user set up the Revolut account using a phone number, but uses the email address with Bisq. My Revolut is setup with my email address, so anyone sending to me using Revolut would not get a payment link.

I do agree that it would be a good idea to know in advance if the seller is using a phone number or Revolut-registered email address (which would be direct) as opposed to a non-registered address (which would generate a payment link). I too try and avoid payment links, so I generally only buy from the same dozen or so people that I've dealt with before and thus know they're not using a payment link, or I know their phone number (from previous trade) and can thus send direct.

@lestephane

This comment has been minimized.

Copy link

commented Mar 2, 2019

@aicbaicb so you keep a list of people you're used to trading with? Do you do it using their onion address, and does that address remain the same over time?

@aicbaicb

This comment has been minimized.

Copy link

commented Mar 3, 2019

@aicbaicb so you keep a list of people you're used to trading with? Do you do it using their onion address, and does that address remain the same over time?

@lestephane I keep track of onion addresses. There is an option to insert a name into a trader, and it also indicates how many transactions you have had. I don't know whether the onion address can be changed, but I've never had a problem with my system so far, although Revolut have now frozen my account pending a "review", so not sure of the future.

@lestephane

This comment has been minimized.

Copy link

commented Mar 10, 2019

@aicbaicb

This comment has been minimized.

Copy link

commented Mar 11, 2019

How many bisq transactions did you do with Revolut prior to suspension?

@lestephane About 50 trades

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.