Triangulation scams turn an innocent third party into the one who pays for someone else's Bitcoin. Peach shuts it down without asking for your ID.
The play, step by step:
1. The scammer lists something for sale somewhere else entirely. A phone, a concert ticket, furniture on a classifieds site, eBay, Facebook Marketplace. A normal sale, nothing to do with Bitcoin.
2. A buyer (the victim) agrees to buy that item and gets ready to pay.
At that exact moment, the scammer jumps onto a P2P Bitcoin marketplace and takes a trade with a real seller.
3. The scammer passes the seller's bank details to the victim as if those were the scammer's own details for the item being sold.
4. The victim transfers the money to the seller, believing they're paying for a phone.
5. The seller sees the money land, confirms the payment, and releases the Bitcoin to the scammer.
6. The scammer walks away with Bitcoin they never paid for. The victim is out their money and never gets the item. The seller, acting in complete good faith, became the unwitting tool in the middle. Three parties, one of them a total stranger to the deal. That's the triangle.
Why it's hard to catch
From the seller's side, everything looks normal. The right amount of money shows up, on time, for the trade they agreed to. No obvious red flag in the moment.
The only thing that's wrong is who the money came from. The payment is sitting in the seller's account from a person who thinks they just bought a secondhand phone. If the seller has no way to know who the payment was supposed to come from, that mismatch is invisible.
This is where buyer payment details come in and why Peach asks for them.
When you take a trade on Peach as a buyer, you enter the details of the account you're paying from. The seller sees those details in the app. So when the money arrives, the seller has something to check it against: the name and account that actually sent the funds vs. the name and account Peach says should be sending them.
In a normal trade, they match. The buyer paid from their own account, exactly as declared. Trade confirmed, Bitcoin released, everyone happy.
In a triangulation scam, they don't match. The money landed from some random victim's account, not from the buyer named in the trade. That mismatch is the seller's signal.
At that point the seller should NOT* confirm the payment, he should open a dispute. Mediators step in, the Bitcoin goes back to the seller, the money is refunded to the victim, and the scam fails. The trade fails too, but the seller can republish without an extra on-chain transaction.
*there have been cases where the victim complains to the authorities and drags the honest seller into it. You do not want that. Disputing early protects you.
This is the only method we've found to stop third-party payments and triangulation scams without compromising the things that actually matter: no KYC, no surveillance, no handing your identity to anyone. You declare the account you pay from, the seller checks it matches, done. It works on the vast majority of payment methods (cash and a few anonymous methods are handled differently).
Why a payment reference doesn't fix this
Fair question we get a lot: why not just have the seller set a reference/memo and tell buyers to include it? If the payment carries a secret code, surely only the real buyer can pay correctly?
It sounds good, but it doesn't close the hole. The scammer is talking to the victim, so he just forwards the reference along with the bank details: "pay this account, put this code in the reference." The victim dutifully includes it. The payment arrives with a perfect, matching reference, and the seller has no reason to suspect anything. The scammer controls the message, so the scammer controls the reference. It protects nothing.
Checking who sent the money is fundamentally different. The scammer can't forward their own bank identity to the victim. The victim pays from the victim's account, and no reference in the world changes that name. That's why the payment-details check works where a memo doesn't.
When Peach asks for your payment details, it's not a KYC step and we, at Peach, can't see it, except in case of dispute. It's a small, honest piece of information that lets the seller confirm the money came from you, and not from someone who has no idea they're funding a Bitcoin trade. It protects the seller, it protects an innocent stranger, and it keeps the marketplace clean without anyone uploading a passport.
P2P done right means trading directly without giving up your privacy. Stopping triangulation scams is part of doing it right.
Happy peaching 🍑
