Claiming no KYC is necessary, allowing deposits, then preventing withdrawals — claiming suspicious activity until the customer identifies themselves

This is particularly nefarious. Not everyone has identifying documents adequate to ID themselves. Maybe they’re under age. Maybe they’re not regular drivers or travelers. Maybe their home just burned to the ground. Maybe they value their privacy, knowing that many exchanges KYC documents have been pilfered by hackers.

So they sign up with a promise of “ID not required”. They set up their 2FA. They make a deposit, make a trade, then go to withdraw… As part of the withdrawal they verify their password by logging in. They verify their 2FA. They verify the request via email. and THEN they get a message “We’re sorry, we’ve detected suspicious activity.”

Unbelievable. Except it happens exactly like this on many of today’s top exchanges. It’s happened to me more than once. It’s a scary position to be in, not knowing if they’ll accept your documents, or if they’ll lay claim to your funds indefinitely.

How would a legitimate exchange designed to NOT f**k you handle this?

A legitimate exchange will ask for everything they need for a FULL AND COMPLETE transaction up front BEFORE allowing the deposit. Some examples:

If they need KYC, they will request these documents up front before they display any deposit addresses in their interface.

If they don’t need KYC, but they need a way to reject a transaction on the basis of blockchain analysis, they will request a refund address up front before they display any deposit addresses in their interface.

If they need a verified way to reach you, for instance, an email address, they will verify your email address before they display any deposit addresses in their interface.

If they value your safety, and require 2FA for withdrawals, they will have you setup 2FA before they display any deposit addresses in their interface.

If they don’t accept deposits from gambling or drug sites, they will have you establish a refund address before they display any deposit addresses in their interface.

Notice the pattern here?