Use case 10

Rapid dispersal and cash-out

One source, many new recipients, minutes.

Implemented, shown in the synthetic demo
event stream · syn_wallet_alice · 14 transfers in 5 minsynthetic
  1. #06transfer to first-time recipient · NEW_BENEFICIARY_CONCENTRATION · risk 22ALLOW
  2. #07transfer to first-time recipient · NEW_BENEFICIARY_CONCENTRATION · risk 22ALLOW
  3. #08transfer to first-time recipient · RECIPIENT_FRAUD_PROXIMITY · risk 22ALLOW
  4. #09transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 53STEP_UP
  5. #10transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 55STEP_UP
  6. #11transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
  7. #12transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
  8. #13transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
  9. #14transfer to first-time recipient · RAPID_RECIPIENT_DISPERSAL · risk 57STEP_UP
first recommendation above monitor: transfer 92 connected to a confirmed case

The problem

Whether the source is a compromised account, a mule collector or a compromised integration, dispersal to many fresh recipients in minutes is the signature of proceeds being moved beyond recall.

How Cenvoriq approaches it

Transaction Risk rises across the sequence rather than on the first transfer; Network Risk connects the fan-out to confirmed cases; the trace shows how many hops and how long to cash-out.

Status in the current release

Built and tested; shown in demo scenario B, where the recommendation escalates by the ninth of fourteen transfers, and scenario C for cash-out.

See scenario B in the synthetic demo

Signals the engine uses
  • Unusual number of distinct recipients within ten minutes
  • Nearly every recipient never paid before
  • Value split into similar pieces
  • Recipients close to a confirmed case
  • Cash-out within the hour
Relevant components

Deployment

Measured in SHADOW before it touches a payment

A design partner replays its own tokenised history first, then mirrors a live stream. The engine scores this pattern and records the recommendation; the applied action is always allow and the institution’s own systems keep every control.

SHADOW MODE observing
Payment authorityNONE
Transaction impactNONE
IntelligenceACTIVE
Evidence recordRECORDING
Recommended · appliedMANUAL_REVIEW · ALLOW