Use case 07
Agent fraud
Cash-out points that behave unlike their cohort.
- syn_victim_c_0_0Victim pays a first-time recipient. Identity checks pass; the sender is genuine.victim
- syn_mule_1New account, ten unrelated senders in twenty minutes, almost nothing retained, device shared with two others.recipient 69mule 85
- syn_wallet_collectorCollector receives from two mules within minutes and forwards on.collector
- syn_agent_7Cash-out agent unlike its cohort: fast inflow to cash-out, high-risk wallet concentration.agent 85investigation priority
- MULE_PASS_THROUGH
- MULE_UNRELATED_SENDERS
- MULE_DORMANT_TO_EXPLOSIVE
- MULE_SHARED_DEVICE
The problem
Where cash leaves the system through agents, a small number of agents concentrate the proceeds. Judged in isolation an agent's volume means little; judged against its cohort and the wallets it serves, it is a strong signal.
How Cenvoriq approaches it
Agent Risk is assessed through the agent endpoint and the operator path, with a status such as investigation priority. Cash-out events also close the forward trace from a victim.
Status in the current release
Built and tested; shown in demo scenario C. Assessed per agent rather than on every transaction.
- Cash-out volume against the cohort
- High-risk wallet concentration
- Fast inflow to cash-out
- Splitting below thresholds
- After-hours cash-out
- Links to fraud-connected wallets
Deployment
Measured in SHADOW before it touches a payment
A design partner replays its own tokenised history first, then mirrors a live stream. The engine scores this pattern and records the recommendation; the applied action is always allow and the institution’s own systems keep every control.