Fraud prevention for payment apps and aggregators
Your rails move money in seconds, and scam money with it. Mule wallets, shell merchants, remittance rings and agent payments each look ordinary one transaction at a time.
Hold
HOLD · face reused · device shared · settlement mule-linked · payout account shared- Your customer sees
- Settlement paused. We’re checking something on your account. You don’t need to do anything now. If we need more from you, we’ll ask in your dashboard.
- Your FRM receives
- FACE_REUSEDSHARED_DEVICEPAYEE_MULE_LINKEDACCOUNT_SHARED
What payment firms face now.
- India made 49% of the world’s real-time payments in 2023, and UPI processed 24 billion transactions in September 2026. (ACI Worldwide (It’s Prime Time for Real-Time, via Business Wire, opens in a new tab), 2023 data, Apr 2024; Outlook Money (UPI processes 24.07 billion transactions worth ₹29.37 lakh crore in September, citing NPCI data, opens in a new tab), Sep 2026, press report)
- Merchant and wallet onboarding is a route for laundering rings.
- Agents and automation are starting to pay on people’s behalf.
- In the Philippines, AFASA lets financial institutions hold disputed funds and criminalises money muling. (Malaya Business Insight (Anti-financial scam law’s IRR to take effect June 25: BSP, opens in a new tab), 2025, press report)
Across the customer journey.
Where each attack appears for payment firms, what DeepID reads at that moment and the action it returns. Each moment is checked against what the one before it bound.
| Moment | The attack | What DeepID does | Decision |
|---|---|---|---|
| Wallet sign-up | Mule wallets opened in bulk | Emulators and device farms, and one face behind many wallets, read at the start. | Block |
| Merchant onboarding | Shell merchants and laundering rings | Business and bank account verification, the director’s face searched across merchants, and shared devices and settlement accounts on the graph. | Step up, or hold |
| Settlement and payouts | Scam money moving through collection accounts | Settlement held when the settlement account or the payers link to a mule ring. | Hold |
| Remittance | Mule senders and receivers on a corridor | The face behind the sender ID and the receiver paid by unrelated senders, decided together before payout. | Hold or block |
| Agent channels | Rogue agents and absent customers | The customer confirms a high-risk assisted action on her own bound phone; the agent device is read like any other. | Step up |
Where to start.
The journey most at risk: wallet or merchant onboarding, then the payout. Start at wallet or merchant onboarding, where the face, the business and the settlement account are verified and the device is bound, so that each payout can be checked against it.
- 1Sign-upThe face, the device and the bank account, verified and bound.
- 2PaymentOne decision before the money leaves, with its reasons in your FRM.
- 3Merchant launderingThe shell merchant ring, and the hold before settlement.
- 4Remittance mulesSender and receiver, decided together.
- 5Mule account detectionWallets that receive from many unrelated senders.
Your free first analysis.
A free retrospective on 30 to 90 days of wallet openings, merchant applications and payouts.
What it shows. The wallets and merchants linked by a face, a device or a settlement account, and the value that passed through them before each was offboarded. No figure is published for this; you count it on your own data, against what you see today.
Use cases for payment firms.
Each shows how the attack unfolds, what your checks saw at each step, what DeepID read and the decision it returned.
Digital arrest
Hold the coerced payment before it leaves the account.Hold, then call backMule accounts
Catch mule accounts before the money moves.Cool off, then holdAssisted channels
Prove the customer is there, on her own phone, before an assisted action.Step up, or holdVideo KYC deepfakes
A live person, in front of a real camera, on every video KYC call.Step up, hold or blockAccount takeover
Protect the account through recovery and the hours after.Step up, then cool offMerchant laundering
Hold the payout and find the whole merchant ring.HoldInvestment scams
Slow the scam payment and hold the mule trading account.Warn, then cool offRemittance mules
Read the sender and the receiver before the transfer leaves.Hold or blockAI agents
Tell the customer’s own assistant from automation that only looks like one.Allow, or step upVulnerable customers
Extra time, and a call back, for the customers most at risk.Cool off, then holdInsider fraud
Hold the takeover that starts with a contact change made from the inside.Step up, then hold
Rules that apply.
India first. Each rule is dated and sourced on its market page, and the rule map covers the six other markets.
- RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025In force 1 Apr 2026 (RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025; RBI (Authentication Mechanisms for Digital Payment Transactions Directions, 2025, opens in a new tab), Sep 2025)
- SIM binding: UPI apps today, messaging apps nextIssued Nov 2025 · deadline reported as 31 Dec 2026 (The Hacker News (India orders messaging apps to work only with active SIM cards, opens in a new tab), Dec 2025, press report; Angel One (DoT extends SIM-binding deadline for WhatsApp, Telegram and Signal till year end, opens in a new tab), 2026, press report; NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026)
- MuleHunter.AI and the I4C Suspect RegistryLive since Dec 2024 · MoU May 2026 (Outlook Business (Finance Ministry asks banks to use MuleHunter.AI to check digital fraud, opens in a new tab), Dec 2024, press report)
- Limiting customer liability in unauthorised electronic transactionsSince Jul 2017 (RBI (Customer protection: limiting liability of customers in unauthorised electronic banking transactions, opens in a new tab), Jul 2017)
DeepID supports compliance with these rules. It never claims to guarantee it.
The modules these use cases read with.
Open a module to see what it reads and the reasons it sends with each decision.
See DeepID on a real phone.
We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.