BLACKHATMAPAffiliate & infrastructure forum

What each gateway ACTUALLY asks for at signup — running list, corrections welcome

Started 14 Feb 2025 · 09:12 · 29 replies · 2.4k views

Page 1 of 230 posts

MetricsOverMagic

Senior Member

14 Feb 2025 · 09:12#1

Every "no KYC gateway" list on the internet copies the same six lines off each other and none of them have opened an account. This is what happened when I did, with the date I did it.

Rule for this thread: one row per post, and say when. "They didn't ask me anything" from 2023 is not information.

Gateway Asked at signup Asked later Tested
BTCPayServer nothing — it's your server n/a 2025-01-19
NowPayments email, password not yet 2025-01-21
Plisio email, password not yet 2025-01-22
Coinremitter email, password not yet 2025-01-22
Cryptomus email, password not yet 2025-02-02
OpenNode email, company name, website, what you sell — 2025-02-04
SpicePay email, business info, category declaration — 2025-02-06

"Not yet" is doing a lot of work in that column and that's the part I want filled in. The signup form is the easy question. What I actually want to know is what they ask on day 90, at 20k, or the first time someone charges back.

I'll keep the table updated as long as people keep posting.

21 thanks

grindstone

Senior Member

14 Feb 2025 · 09:31↑ replying to #1#2

the column that matters is the one you left blank. everyone's signup is email

—

MetricsOverMagic

Senior Member

14 Feb 2025 · 09:44↑ replying to #2#3

Correct, which is why I said so. Fill it in then.

—

vlad_ptk

Member

14 Feb 2025 · 11:26↑ replying to #1#4

Cryptomus. Signup is email only like you say, February 2024 for me.

Then October 2024 they ask source of funds when balance is 3,100 USDT. Not big money. They want invoice or contract showing where it come from. I send, eleven day, they release.

So for your table: "asked later" = yes, at three thousand dollar, not at twenty thousand. Is lower than people think.

7 thanks

hana_v

Member

14 Feb 2025 · 14:03↑ replying to #1#5

Plisio, opened October 2024, still nothing asked. About 40k through it since.

Worth noting the thing they ask for isn't always ID — twice now they've asked me to confirm the destination address by email before a large withdrawal went out. That's not KYC but it is a human looking at your account, which is usually how the other thing starts.

6 thanks

Ravenstack

Senior Member

14 Feb 2025 · 14:20↑ replying to #5#6

40k over four months, or 40k in a week? The trigger is usually rate, not total.

—

hana_v

Member

14 Feb 2025 · 14:38↑ replying to #6#7

Four months, fairly even. Biggest single week was about 6k.

—

0xLumen

Member

15 Feb 2025 · 08:51↑ replying to #1#8

Row one is the only row where the answer is stable, because there's nobody to ask. Everything below it is a policy that can change on a Tuesday and you'll find out from a banner.

—

cashflowkid

Member

15 Feb 2025 · 13:07↑ replying to #1#9

This is going to be so useful, following

—

quietaccountant

Member

17 Feb 2025 · 10:44↑ replying to #1#10

One correction to the OpenNode row, which is a distinction worth keeping straight: what they ask at signup and what they ask for USD settlement are two different gates.

Signing up and settling in Bitcoin is the light version you listed. Electing to settle in dollars to a bank account triggers a full identity process — documents, address, the lot. Their own documentation says so. It is not a change of policy waiting to happen; it is the published design.

4 thanks

MetricsOverMagic

Senior Member

17 Feb 2025 · 11:19↑ replying to #10#11

Good distinction. Splitting that row on the next update.

—

nullroute

Senior Member

19 Feb 2025 · 22:37↑ replying to #1#12

Nobody in this thread has mentioned what they collect without asking, which is the column I'd want.

Every hosted gateway on that list logs the IP that created the account, the IP of every dashboard login, and the destination addresses you've ever set. None of that appears on a signup form and all of it exists. Two of them run analytics on the checkout page your customer loads, so your customer's IP is in there too.

"They didn't ask for ID" is a statement about the form, not about what they know. Your threat model is not the onboarding flow.

9 thanksopsec is a process, not a purchase

grindstone

Senior Member

20 Feb 2025 · 06:15↑ replying to #12#13

correct and irrelevant to the question he asked

—

nullroute

Senior Member

20 Feb 2025 · 06:52↑ replying to #13#14

It's irrelevant right up until the day it's the only thing that matters.

—opsec is a process, not a purchase

d_marchetti

Jr. Member

08 Mar 2025 · 16:22↑ replying to #1#15

Sorry if this is obvious — does "email, password" mean a throwaway email is fine, or do they check it resolves? I don't want to burn a real one.

—

You must be logged in to reply. Request an account — new registrations are reviewed by a moderator before approval.