I’m using Bisq 0.6.0 to sell BTC for Euro via SEPA. Until recently, I had a limit of 0.25 BTC per trade, which matches the FAQ and all information I was able to find here and elsewhere.
However, when I wanted to open another maker offer yesterday, Bisq suddenly told me that my trade limit is 0.1875 BTC instead.
Where does this come from, and how was it actually changed without me updating the software? Unless I’m very mistaken, I already did trades for 0.25 BTC with the same Bisq version previously.
Is there a way to increase my limit again? With the super-high mining fees, it is very annoying to have such a “relatively low” limit - the total fees are about 1% of the trade amount recently, which feels way too high.
I am unaware of the new limits, but they usually happened when updating the software.
Some of these limits are there because of limitations of the payment method. For example, we had a user recently that had a daily limit of 2000$ to send, so he had to send two payments in two different days.
The withdrawal fee can be changed in settings, but the default values are probably using dynamic fee estimation.
Perhaps developers added a way to update these values without releasing a new version and requiring users to update.
The account witness feature starts to fade in with 15.12.
Payment accounts which are less then 1 month old have lower limits as security protection against stolen bank account scammers.
The withdrawal tx fee is determined by fee estimation service and changes depending on the blockchain congestion level.
Thanks! Bisq shows the age of my payment accounts currently as 28 days - I assume that’s somehow related to when the new feature was introduced.
Does that mean that I can again trade with up to 0.25 BTC in a few days (when the age reaches one month)? Since I wasn’t able to find anything about this in the FAQ, it might be good to update that to reflect this new feature.
It appears the time-to-wait is now even longer at 2 months. I understand the underlying reasoning, but I think the implementation is doing it wrong. If the goal is to protect against use of stolen bank accounts, then what’s to stop the user from opening a bisq account account and just waiting for two months before using such a bank account, or from placing a large® number of small(er) trades? It appears this restriction is placing an undue burden on legitimate users without actually solving an underlying problem it is aimed at addressing.
I would suggest using a combination of time and trade volume for lifting the trade restrictions. For example: 30 days OR 1.5 BTC traded. Granted one could trade 1.5BTC in a day by indiscriminately taking every offer, but that in itself would be a good indicator of a user doing something fishy, and the program could flag such behavior for further restrictions.
I’m not convinced. Obviously you don’t have to convince me, but I’m just saying… Nothing from what I read in that document addresses a situation where a fraudster just waits for two months before placing larger trades of .5BTC or a situation where (s)he places a large number of smaller transactions within a short time interval.
I mean look at this assumption: “We assume that the criminal who has access to the bank account intends to take out the funds of that account as quickly as possible…” - this assumption, while reasonable, is not necessarily correct. If one has access to another’s bank account why risk getting discovered by making a large number of small transactions? Why not just wait until the limit is lifted?
And then the next assumption: “… as well as that he intends to do that in a few large transactions because with each transaction the risk increases that the fraud gets discovered and the account gets frozen.” - a fraud is more likely to get discovered if there are appropriate limits and / or notifications set on the bank account in question (set at the bank). If they are set, then the number / amounts of transactions won’t matter, and the fraud will get discovered quickly anyway. If they are not set… well then they may only get discovered at the next statement cycle, which is probably too late, regardless of the limits imposed on individual trades.
It add considerable costs to him. A stolen bank account can be detected in the meantime thus adds risk to the scammer if he waits.
As in the doc state it is an assumption and there might be scammers who are waiting 2 months before they cash out their stolen accounts, but it is about to decrease the risk and I think that is accomplished.
I’ll agree that it may decrease the risk if the scammer gets itchy and wants to use the account before the two months, but my point is that it also may not if they are patient. Meanwhile, the legitimate users are forced to make a larger number or smaller transactions than they would otherwise, thus increasing the time spent and the total transaction costs for all.
Yes, it may and it may not. There is a balance here between risk and usability, there is no correct answer, it is just estimations.
Chances are that sooner or later, at least one scammer will be able to do limited damage because of this. The question is, how often will this happen and is it worth it. No one can answer that definitively, but devs think it is worth it and if you have some good new arguments why it is not, I am sure that they will be happy to hear it and change their mind if they think you are right.
Since I have been using Bisq I have noticed the limit reduce from 0.25 to 0.1875 to 0.125 and now 0.0625! One other observation, if a user has multiple accounts then this check need not be applied to every new bank account that user ads to his profile. If a user has held a reputable account for a number of good trades there is no need to apply this logic to subsequent newly added bank accounts by that trader, currently new account added by a reputable trader are treated as if they were a brand new trader
I don’t think reputability was the idea here. I think account age witness was implemented to make scammers wait until they can use a bank account of their victim, which increases the risk of them being discovered.
Reputability of traders is generally not something implemented in Bisq, due to it’s difficulty of implementation in a decentralized system.
Agreed, but once a trader has completed trades with a defined bank account on their profile then it is safe to assume they are not a scammer. Or do you want to try and protect against stealth scammers who will do some genuine trades and then turn into a scammer? My argument is the same, there is no need to provide these checks/restictions against new additional bank accounts added by a trader, if a trader has an existing bank account that has been achieved a verified status. This verified status should automatically be inherited to all new bank accounts added by that trader.
Also, why has the limit been reduced from 0.125 to 0.0625, this trade size has become too small in my opinion considering it used to be 0.25. Are you really seing so many scam instances to justify such a drastic reduction from 0.25 down to 0.0625? I have to admit, I think this trade size is too small for many and will result in more transactions and lots of extra fees.
Maybe, I don’t know, but it is very possible that this is the case, yes.
It seems to me like it would be even more likely that a trader is a scammer if he keeps creating more new bank accounts as he is tricking more victims.
It would take some time for a victim to find out their money has been stolen and some might not even initiate a chargeback due to it’s difficulty. But I guess that if a trader keeps getting complaints for chargeback risk, he could potentially be banned, at least from arbitrators not accepting his trades. We could look into the idea of people providing proof that the other trader did a chargeback and try to ban those traders best to our abilities, but this is not really common, so it would take some research on how to provide proof for such things I guess and it would complicate the protocol more. It is quite a difficult issue.
This is just for accounts that are younger than 30 days. It was always planned this way, it is just that Bisq didn’t have this account age witness two months ago. so devs didn’t want to limit everyone at the start. They gave traders some time for their accounts to age since this feature was implemented so they could keep their previous limits intact.
A scammer could use a normal account for doing valid trades then after he has reached the max limit he could add new fraudulent accounts (stolen bank accounts) and start cashing out those without need to wait.
The protection the account age witness provides is not based on the trust that a user is not a scammer but on the fact that a scammer who has access to a stolen bank accounts needs to wait 2 months to get the full trade limits and that creates some costs for him (risk that the crime gets detected and the account becomes inaccessible). Doing a lot of small transactions increases also his risk that it gets discovered and shut down before he could cash out the full amount.
Re limits:
When I implemented it BTC price was rising like crazy. Atm the 0.0625 might be a bit too low, but wait one week and we are back to 15-20k and then that is about 1000 USD. In future we might implement a exchange rate based limit so it floats with the BTC price. But dev resources are short and there is much other stuff to do.
Security and convenience are trade-offs. You don’t get both. Bisq takes security very serious and in fact if Bisq would get targeted by chargeback scammers as a preferred platform it would fail.