Scam money reaches an exchange through accounts opened by mules, turns into stablecoin and leaves for a wallet nobody can reach. DeepID links exchange accounts by face, device and funding account, so the exchange can hold the withdrawal while the money is still in reach.
Hold
HOLD · face reused · device shared · unrelated funding · scripted timingA retail account that passed identity checks receives deposits from bank accounts with no clear link to the holder. Within minutes the balance is converted to stablecoin and withdrawn to an external wallet. Nothing in the account looks wrong on its own. The same pattern repeats across many accounts, each opened by a different person or under a rented identity.
An illustrative scenario, not a real customer’s case.
A customer pays into a bank account held by a mule. The account exists to receive and forward, so the balance rarely rests.
Your checks saw
An inbound credit to a retail account.
DeepID reads
On the bank side, a payee receiving from many unrelated senders.
The mule sends the money on, often as several smaller deposits from different bank accounts. The exchange account is in a mule’s name, while the ring controls the login.
Your checks saw
A verified customer. Deposits within limits.
DeepID reads
Funding accounts with no link to the holder, a login device shared with other accounts, and a face seen on other accounts.
The balance is converted soon after it lands. The session is short and direct, with none of the browsing a genuine investor shows.
Your checks saw
A normal spot trade.
DeepID reads
Deposit to conversion within minutes, scripted navigation, and an emulator or remote-access app.
The stablecoin is withdrawn to a wallet the ring controls, then moved through further wallets. After this the exchange and the bank have little chance of recovery.
Your checks saw
A withdrawal to a new wallet address.
DeepID reads
One hold at withdrawal, with the face, device and funding reasons.
Each of these sees one part of the chain. Read together across the journey, they stop agreeing, and that is what DeepID reads.
Identity is verified once at opening, so a rented identity that passed then is not questioned again.
On-chain screening scores the destination wallet and has no view of the device, the face or the funding accounts behind the account.
Rings split value across many accounts and keep each movement inside the limits.
The bank sees a payment to a known exchange, which looks the same as a genuine customer buying crypto.
Each onboarding face checked for deepfakes and injected streams, then searched across your customers. The same face behind many exchange accounts marks accounts built for a ring.
A device ID that survives reinstalls, and emulators and remote-access apps read at every login. Several accounts run from the same device show one controller behind different names.
Each exchange account linked to the bank accounts that fund it, and those to the accounts and devices around them. Deposits from unrelated accounts already linked to mule rings show an off-ramp for scam money.
Deposit, conversion and withdrawal in one short, scripted session, unlike any genuine investor’s. Script and bot detection reads the input no hand produced.
One decision at deposit, conversion and withdrawal, with its reasons. The length of a hold and the release steps are your policy.
Step up a new withdrawal address from a new device, cool off deposits that arrive from several unrelated accounts, and hold the withdrawal when a reused face, a shared device or mule-linked funding appears. Restricting the account after review is your compliance team’s decision.
An established account, its own funding source, a known device and a usual withdrawal pattern. The withdrawal goes with nothing added.
A new withdrawal address from a new or changed device. The holder passes a face check with liveness before the withdrawal goes.
Deposits from several unrelated bank accounts, converted within minutes. Withdrawals start with a lower limit for a set time while the links are read.
A reused face, a shared device or mule-linked funding. The withdrawal waits, and your compliance team receives the case with every reason listed.
Your review confirms the account is controlled by a ring. Withdrawals do not go, the linked accounts are decided again and the account is restricted under your own procedures.
“Withdrawal paused. Your balance hasn’t changed. We may ask you for a short face check. We’ll update you here in the app.”
The same decision reaches your FRM, case manager or SIEM as an event, with one code per reason. The codes here are illustrative; real codes and their names are agreed in the sandbox.
Agreed in writing before the pilot starts, and counted on your own traffic against what you see today. Faces, devices and funding accounts can be measured on your own history first, in a free retrospective. Session behaviour is proved in a shadow proof on live traffic. We publish no figures for these.
Wallet analytics score where the funds go on chain. DeepID reads who controls the account before the funds leave, through the face, the device and the funding accounts. The two views work together, and the hold can use both.
Reused faces, shared devices and funding accounts that recur across your own customers need no bank data. Links on the bank side come from the bank’s own DeepID decisions, where it runs one; nothing is shared between the two.
That is your decision. DeepID returns the hold and the reasons, and your policy sets the length and the release steps. The shadow proof shows how many holds the agreed thresholds would create before any go live.
The controls below are the mule and risk measures on the rule map, dated and sourced on each market page. Licensing and registration rules for exchanges are not mapped yet.
A payee and mule graph across accounts and devices, with recipient risk scored before the payment is sent.
Device, behaviour, scam and payee signals read at login, new payee and payment, returned as one decision with its reasons.
DeepID supports compliance with these rules. It never claims to guarantee it.
A free retrospective on 30 to 90 days of your own transactions shows the payee and mule links in them. Session signals follow in a shadow proof, once the SDK runs.