Use case 01

Mule networks

Accounts that collect from strangers, keep almost nothing and pass it on.

Implemented, shown in the synthetic demo
TrustGraph · forward trace · 3 hops · 30 min to cash-outsynthetic
  1. syn_victim_c_0_0
    Victim pays a first-time recipient. Identity checks pass; the sender is genuine.
    victim
  2. syn_mule_1
    New account, ten unrelated senders in twenty minutes, almost nothing retained, device shared with two others.
    recipient 69mule 85
  3. syn_wallet_collector
    Collector receives from two mules within minutes and forwards on.
    collector
  4. syn_agent_7
    Cash-out agent unlike its cohort: fast inflow to cash-out, high-risk wallet concentration.
    agent 85investigation priority
  • MULE_PASS_THROUGH
  • MULE_UNRELATED_SENDERS
  • MULE_DORMANT_TO_EXPLOSIVE
  • MULE_SHARED_DEVICE

The problem

Mule accounts are recruited or opened to receive proceeds and move them on within minutes. Sender-centric controls see nothing unusual, because each victim's payment looks ordinary on its own. The pattern only exists on the receiving side and in the graph.

How Cenvoriq approaches it

Mule Risk and Recipient Risk are scored as separate dimensions and returned on the sender's decision, so the tenth victim's ordinary-looking transfer is scored against what the recipient has been doing. TrustGraph traces the flow forward through collectors to the agent or endpoint where it leaves the system.

Status in the current release

Built and tested; shown in demo scenario C, where three synthetic mules sharing one device are scored, the flow is traced three hops to cash-out and the agent is flagged for investigation priority.

See scenario C in the synthetic demo

Signals the engine uses
  • Many unrelated senders within an hour
  • Pass-through retention: inflow almost fully forwarded or cashed out
  • Dormant account then explosive inflow
  • Device shared with other mule-like accounts
  • Proximity to a confirmed fraud case
  • Forward trace from a victim to the cash-out point
Relevant components
Mule & Recipient IntelligenceTrustGraphSentinel Engine

Deployment

Measured in SHADOW before it touches a payment

A design partner replays its own tokenised history first, then mirrors a live stream. The engine scores this pattern and records the recommendation; the applied action is always allow and the institution’s own systems keep every control.

Apply to Become a Design PartnerHow it works
SHADOW MODE observing
Payment authorityNONE
Transaction impactNONE
IntelligenceACTIVE
Evidence recordRECORDING
Recommended · appliedMANUAL_REVIEW · ALLOW
← Rapid dispersal and cash-outAll use casesRecipient risk →