Use case 02

Recipient risk

Score the account being paid, not only the account paying.

Implemented, shown in the synthetic demo
  Sentinel Engine 0.2.0 · decisionsynthetic
Scenario C
Mule network
Identity trustIdentity trust 85
Account takeoverAccount takeover 0
ScamScam 35
TransactionTransaction 10
RecipientRecipient 90
MuleMule 85
NetworkNetwork 0
IntegrationIntegration —
AgentAgent —
ControlControl —
RecommendedBLOCK
AppliedALLOW · SHADOW
Decisions2
ModeSHADOW
Reason codes
  • FIRST_TIME_RECIPIENT
  • MULE_DORMANT_TO_EXPLOSIVE
  • MULE_PASS_THROUGH
  • MULE_RAPID_CASH_OUT
  • MULE_SHARED_DEVICE
  • MULE_UNRELATED_SENDERS
  • RECIPIENT_FIRST_TIME_SENDER_CONCENTRATION
  • RECIPIENT_MANY_SENDERS_1H

The problem

On instant and account-to-account rails the sending customer is often genuine. What distinguishes a scam payment from a normal one is the recipient: a new account collecting from a dozen first-time senders in an hour, forwarding within minutes.

How Cenvoriq approaches it

Recipient Risk is computed for the recipient of every transaction and reported with its own reason codes. It feeds Scam Risk when a large first payment goes to a recipient that already looks like a collector.

Status in the current release

Built and tested; shown in demo scenarios C and F.

See scenario F in the synthetic demo

Signals the engine uses
  • Receiving velocity and unique senders
  • First-time-sender concentration
  • Account age
  • Rapid forwarding or cash-out after inflow
  • Decayed shared signals from other cases
  • Links to confirmed cases

Deployment

Measured in SHADOW before it touches a payment

A design partner replays its own tokenised history first, then mirrors a live stream. The engine scores this pattern and records the recommendation; the applied action is always allow and the institution’s own systems keep every control.

SHADOW MODE observing
Payment authorityNONE
Transaction impactNONE
IntelligenceACTIVE
Evidence recordRECORDING
Recommended · appliedMANUAL_REVIEW · ALLOW