If money for sold cryptocurrency came to your card and then the account was restricted or you were summoned to the police, most often it looks like this: the transfer was made not by your buyer. The money was sent by an outside person who had been deceived: the fraudster gave them your card number as his own. You did not hand the card to anyone — this is not the situation the write-ups about money mules are about.
They came to you because the victim has exactly one identifier — the number of the card he sent the money to. He does not have the fraudster's name. From there the investigation follows the chain of accounts: as “Yurydychna Hazeta” describes it on 01.09.2026, an encumbrance is placed on every next account in the chain, regardless of whether its owner knew about the crime.
First of all find out what exactly happened to the account: did the bank suspend the transaction under financial monitoring, or did an investigating judge impose a seizure under Article 170 of the Criminal Procedure Code. These are different mechanisms with different consequences. For a bank suspension the periods are counted in business days, while for a seizure the Criminal Procedure Code has no maximum term at all — it holds until it is lifted and does not end by itself.
If the asset has not been sent yet — do not send it and open a dispute on the platform. If the money has already gone, keep the order, the correspondence and the statement: in the only decision found on such a scheme that is exactly what worked. Nothing gives a guarantee: good faith is no obstacle either to a seizure for the sake of physical evidence or to the victim's claim. We are an exchange service, not lawyers.
The black triangle, the white triangle and the English triangle scam are three different things
What specialist blogs call a white triangle is a legal arbitrage construction with three participants: an intermediary brings the sides together directly, bypassing his own card, and all three get what was agreed. This is a colloquial name, not a rule.
The black triangle is the same geometry, but two of the three do not know about the third. A seller on a P2P platform is sure that it is his buyer on the order who is paying him. The person who pays is sure they are buying goods. They learn about each other only after the money has gone.
The English-language Triangle Scam from the platforms' help pages means something else: two fraudsters open different orders with one seller and push him to release the asset twice. If you were looking for the answer in English, it was not about your case.
And the third distinction, the most important one. A money mule hands over the card knowingly, and the police materials are written precisely about such people. A seller on an order gives the card number to the buyer — an ordinary action on any platform. The difference is not in the moral assessment but in the elements of the offence: there is as yet no article in the code about handing over payment instruments, and in the bill adopted as a basis on 15.09.2026 the purpose of the handover is a constituent element.
How it looks from the seller's side
An advert appears for a sought-after item noticeably below the market, on condition of prepayment to a card. The buyer of the goods agrees. In parallel, an order to buy cryptocurrency for exactly the same amount is open on a P2P platform.
The cryptocurrency seller gives the counterparty the number of his card — as in any deal. That number is forwarded to the buyer of the goods as “his own” for payment, and the buyer transfers the money. The seller sees the required amount in the account, considers the deal performed and releases the cryptocurrency. After that the advert and the contacts disappear.
Who got what: the buyer of the goods — neither the goods nor the money; the cryptocurrency seller — money behind which there is a victim with a police report; the fraudster — cryptocurrency for free.
Why the substitution is not visible at the moment of the deal
One thing is written directly in the rules of the large platforms: the platform is not a party to the deal. Escrow holds the cryptocurrency until payment is confirmed — and there its role ends. The rest follows from that: it does not see the bank transfer and does not know whose it is.
The amount matches: the order is opened for exactly the amount that will arrive, and “has the required amount arrived” is the seller's main check.
The sender's name is not always visible. Whether the payer's name is displayed depends on the bank, the transfer channel and the settings, and one of the banks has an anonymous transfer mode. We did not find a clarification from the NBU or from a bank on this, so “you will always see the sender's full name” is untrue.
There is little time: the rules of the large platforms require the order to be closed within a quarter of an hour after payment is confirmed, that is, they themselves push you not to look into it. And the complaint arrives with a delay — the buyer of the goods is waiting for a parcel, and a noticeable amount of time can pass before the call from the bank.
The signs that are visible before you have released the asset
This is a list of what is visible on the screen, not a list of reproaches about the past. Some of the signs are noticeable in the deal itself, some in the payment.
- The counterparty asks you to accept payment “from a friend, a wife, a partner, from a company account”. That is a direct description of a payment from a third party.
- Suggests moving to a messenger and discussing the details outside the platform chat.
- The counterparty's account is new, it has few deals.
- Hurries you, presses with urgency, refers to “the deal being blocked”.
- The payer's name does not match the name of the counterparty on the order — the main sign, if the bank shows the name.
- The payment reference is not about the deal: repayment of a debt, a thank-you, an empty field.
- Instead of the money being credited, they send a screenshot or an SMS “about the incoming payment”.
- The amount arrived not in one payment but in several from different people.
There are three checks that work before the asset is sent. Compare the payer's name in the bank app with the counterparty's name on the platform — if the bank shows that name. Write in the advert that payments from third parties are not accepted: in a dispute that is a document.
The third is the cheapest and the most underrated: ask for the order number to be stated in the payment reference. A deceived buyer will not do that — he is paying for goods and knows nothing about any order.
What is set in motion next: three mechanisms that get constantly confused
The first is bank financial monitoring. Here the bank acts on its own initiative or at the regulator's demand, not on the victim's application. The mechanics are dealt with separately: what the bank does after P2P, and the criterion of payments from unrelated or unknown third parties comes from the risk signs of Order №465.
The second is the blocking of the amount under part 17 of Article 86 of Law №1591-IX (text checked on 19.09.2026). The law knows a mechanism under which the bank of an improper recipient blocks the amount for up to 30 calendar days, and in the case of an erroneous transaction the money is returned within three business days.
But the rule is written about an erroneous and an improper transaction, while the deceived buyer transferred the money himself, without an error by the bank and without an error in the details: he entered the number he was given. We did not find NBU clarifications or practice of applying this to such a situation. This is a frame, not a guarantee.
The third is a seizure under Article 170 of the Criminal Procedure Code, and this is exactly what happens in reality. The versions were checked on 19.09.2026: the Criminal Procedure Code — of 21.07.2026, Law №361-IX — of 26.06.2026.
Feature | Suspension, Art. 23 of Law №361-IX | Seizure, Art. 170 of the Criminal Procedure Code |
|---|---|---|
who decides | the bank itself, then the State Financial Monitoring Service | only an investigating judge |
basic term | 2 business days | there is no term |
extension | up to 7 business days | — |
maximum | 30 business days | none |
how it ends | expires by itself if there is no decision | by a court ruling or by a prosecutor's decree when the proceedings are closed |
Why the reservation about a good-faith acquirer does not work here
Part 10 of Article 170 of the Criminal Procedure Code (version of 21.07.2026) has a direct rule: the property of a good-faith acquirer may not be seized. And immediately an exception — except for a seizure for the sake of preserving physical evidence.
And part 1 of Article 98 of the Criminal Procedure Code classifies money obtained by criminally unlawful means as physical evidence. The exception covers exactly our case: the money on the card is seized precisely as physical evidence, and good faith is no obstacle to that. The popular texts about card blocking do not have this.
For comparison, part 4 of Article 170 of the Criminal Procedure Code — a seizure with a view to special confiscation from a third person — requires two conditions at once: a non-market acquisition price and knowledge of the origin. A seller at the exchange rate does not fall under the first condition by the letter of the Criminal Procedure Code — but Article 96-2 of the Criminal Code does include the “market price” in the list, and how this contradiction is resolved in practice is unknown. That still does not cancel a seizure for the sake of physical evidence.
Why the owner finds out after the fact: part 2 of Article 172 of the Criminal Procedure Code allows a motion for the seizure of property that has not been removed to be considered without notifying the owner. Money on a card is not physically removed, so as a rule the owner is not called, and he finds out about everything from the bank app.
What he does have all the same. Article 64-2 of the Criminal Procedure Code gives the status of a third person whose property the question of seizure is being decided about, with the right to counsel and to appeal. Next come two different instruments that get confused.
An appeal against the seizure ruling itself is filed within five days (Art. 395 part 2 clause 3 of the Criminal Procedure Code), and for someone who was not summoned the period is counted from the day the copy is received. A motion to lift it under Article 174 of the Criminal Procedure Code has no filing deadline, the number of attempts is not limited, and it is considered no later than three days.
But a refusal under Article 174 cannot be challenged on appeal — the position of the Joint Chamber of the Criminal Cassation Court of the Supreme Court of 20.05.2024; this is offset by the right to file repeat motions. The position may change: it conflicts with the logic of the Constitutional Court decision of 21.07.2026, and judges of the Criminal Cassation Court have a dissenting opinion.
The only decision where a court wrote “p2p triangle”
An investigating judge's ruling of a local court of 05.12.2023, case № 688/3758/23, read in the original on 19.09.2026. The seizure of the bank account held from 07.09.2023 to 05.12.2023. The term “p2p triangle” stands in the text of the ruling itself: the card owner realised that he had been used, without his knowledge, in a scheme with that name.
What worked. After the search the account owner voluntarily handed the investigator the items listed in the ruling and himself offered to give testimony. Then, at the cybercrime unit, on the phone that had been removed from him, he reproduced the whole sequence: logged in to the platform, found that same order, showed the correspondence and the details of the person who had written to him as the buyer.
The motion to lift the seizure was filed by a lawyer. No evidence of the account owner's involvement was obtained, the need for a further seizure fell away, and the prosecutor and the investigator did not object to the lifting.
The caveat is obligatory. This is one decision that was found, not a typical term and not a typical outcome. Full-text search in the register of court decisions is not available automatically, so “there is almost no practice” is the limit of our method, not a conclusion. Nobody keeps a separate record of such cases.
What can be charged and what has to be proved for that
What follows is a list of what the prosecution will have to prove. The version of the Criminal Code is of 18.09.2026, checked on 19.09.2026. We do not give the amounts of the sanctions.
Article 190 of the Criminal Code, fraud, is the offence of the fraudster, not of the seller: intent to take possession of someone else's property by deception is required. A seller who gave up cryptocurrency for the money received took possession of nothing by deception.
Part 6 of Article 27 of the Criminal Code stands directly on the reader's side: acquisition or disposal of property that was not promised in advance is not complicity. Someone who learned about the scheme after the fact cannot be an accomplice to fraud — by the direct instruction of the law.
Article 198 of the Criminal Code is acquisition, not promised in advance, of property obtained by criminal means. The key word in the provision is “knowingly”: reliable knowledge at the moment of receipt is required. Negligence does not make up the offence.
Article 209 of the Criminal Code, legalisation, has a weaker threshold: “knew or should have known”. This is the greyest zone of the topic: we did not find Supreme Court generalisations about what this means for a cryptocurrency seller, so this is our reading of the rule, not the position of a court.
Article 200 of the Criminal Code in the version in force concerns forged payment instruments. Handing over one's own genuine card does not fall under it.
And about what is moving right now. Bill №16013 was tabled on 02.09.2026 and adopted as a basis on 15.09.2026, the second reading is still ahead — as of the day of publication there is no separate article of the code about handing over payment instruments. The constituent element of the future Article 200-1 is a special purpose, so a seller who did not hand over the card does not fall under it even after it is passed.
There is no register in force of persons whose payment transactions require enhanced control either: bill №14161 has been lying in committee since 29.10.2025. Article 255-4 of the Criminal Code on fraudulent call centres has been in force since 18.09.2026 — the rule is one day old, practice under it physically does not exist. You are reading a snapshot of the state of the law as of 19.09.2026, and it is changing.
A civil claim: the acquirer's fault does not matter
This is the side of the topic that good faith does not cover at all. Article 1212 of the Civil Code is unjust enrichment: whoever acquired or saved property at the expense of another person without a sufficient legal ground is obliged to return it.
A Supreme Court ruling of 20.09.2024 in case № 628/1203/19: for unjust enrichment obligations proof of fault does not matter, what matters is the very fact of acquiring property at another's expense without a ground. The second condition is from the same place — the demand is brought against the person with whom the victim has no contractual relationship regarding the thing.
In the triangle both conditions are met. Money is a thing defined by generic features. There is no contract at all between the deceived buyer and the cryptocurrency seller: each of them had a contract with the fraudster.
Article 1215 of the Civil Code (text checked on 19.09.2026), which lists what has been acquired without a ground and is not returned, will not help here: it is about wages, pensions, maintenance and other funds as a means of subsistence. The limitation period is counted from the date of the transfer, not from the demand to return it — a Supreme Court ruling of 16.04.2026 in case № 946/4589/20, text read on 19.09.2026.
And honestly: we did not find claims by victims against P2P sellers specifically. The construction of the claim is obvious, the Supreme Court's position is published, but it cannot be asserted that “the courts recover from P2P sellers”. Recourse against the fraudster formally exists, and in practice it runs into the fact that there is nobody to recover from while the person has not been identified.
What to do now — and what makes it worse
If the asset has not been sent yet:
- do not send the cryptocurrency — this is the only action still entirely in your hands;
- open a dispute on the platform and describe the situation;
- record the order number, the counterparty's nickname, the correspondence in the platform chat, the statement with the date and time of crediting, the payer's details;
- do not mix this money with the rest, do not withdraw it and do not transfer it onward: transit is a risk criterion in its own right.
If the account has already been restricted, find out what exactly was triggered, and ask support in their own words: has a specific transaction been suspended, have debit transactions been restricted, has the amount been blocked under the payment law, or has a seizure been imposed by an investigating judge's ruling. Next you need the written ground — without a document there is nothing to challenge.
Then — to gather the confirmation of good faith: the order, the correspondence, the statements, the transaction history. Lawyers advise going to the investigator with a defence lawyer, having found out in advance the number of the proceedings and the status in which you are being summoned.
What does not help:
- “close the account and open one at another bank” — it removes neither the seizure nor the claim;
- “do not answer, it will sort itself out” — a seizure under the Criminal Procedure Code has no term and does not end by itself;
- “withdraw the cash before they block it” — a direct route from witness to person under investigation;
- “settle with the victim in cash” — it closes neither the proceedings nor the court's seizure;
- “the platform will return the money” — the rules disclaim the role of a party to the deal, and in the event of a court freeze they send you to the court;
- “run the card through the cyberpolice database” — out of date: checked on 19.09.2026, there is no form for checking a card number at the section's address, what is there is a form for reporting a cyber incident.
Separately — the advice to return the money to the sender. It is the most widespread and the most contested one. The help page of a large platform advises the seller to return the payment, after which the order is cancelled. The same platform on the same page warns: a request to cancel a payment creates compliance risks for both sides and can end in accounts being frozen.
Ukrainian lawyers object publicly and more harshly: their argument is that law enforcement officers are inclined to read a voluntary return as an admission of guilt. We were unable to obtain the full text of the argumentation, so this is a thesis, not an analysis.
There is no single answer, and we deliberately do not take a side: neither “return it” nor “on no account return it” is said on our behalf. This is not a gap. One thing is true on any approach: a return is one more transaction on the account, and the bank and the investigation will see it.
We are an exchange service, not lawyers, and everything above is a retelling of rules and of lawyers' public explanations, not advice. One of our exchange directions is selling USDT for hryvnia.
Short answers
Does a block mean that I am suspected?
No. According to the description by “Yurydychna Hazeta” of 01.09.2026, an encumbrance is placed on every next account in the chain regardless of what the owner knew. The status of a third person under Article 64-2 of the Criminal Procedure Code is not the status of a suspect.
Will it protect me that I am a good-faith acquirer?
From special confiscation — yes, from a seizure for the sake of preserving physical evidence — no: that is a direct exception in part 10 of Article 170 of the Criminal Procedure Code. Good faith does not save you from a civil claim either (Supreme Court ruling of 20.09.2024).
To return the money to the sender or not?
There is no single answer, and we do not give one. The platforms advise returning it and warn about compliance risks in the same breath, lawyers object. One thing is clear: it is one more transaction on the account, which the bank and the investigation will see.
How long will the seizure last?
The Criminal Procedure Code has no maximum term: a seizure holds until it is lifted and does not end by itself. Three months in case № 688/3758/23 is a single observation, not a term.
