Payment providers, EMIs and payment institutions
Money arrives in an account on your side and leaves within minutes. By the time the pattern is visible, the funds are gone. Money mules moved an estimated $284 billion of illicit funds in 2025 (Nasdaq Verafin, 2026 Global Financial Crime Report; money moved, not losses). WoWyrd runs in your own environment and scores each request before the payout leaves.
What WoWyrd flags, from sign-up to payout
Each stage below names the rules that fire there, and every flag shows its reason.
Sign-up
Many new accounts on one device or IP address, throwaway email domains, and a brand-new account that moves a large amount (new accounts). Scripted traffic from Tor, VPN, proxy or datacenter origins (bots).
Login
One session from several IP addresses, countries or networks, and impossible travel between countries (account takeover).
Payment and money coming in
Many first-time senders paying into one account, money that arrives and leaves at once, and a new account that receives a large incoming payment (money mules). Bursts of bank declines (card testing).
Payout
One payout destination shared across several accounts, and large sums split into many small payments (money mules). A payout right after a password reset or a contact-detail change (account takeover). A payout that takes most of the balance to a payee added minutes earlier (scams).
What data you need
Only the IP address is required; each optional field switches on the rules that need it, and comes from systems you already run.
| Field | Where it comes from | Mandatory |
|---|---|---|
ip | Your edge or load balancer (the real client IP) | Yes |
customer_id, account_created_at | Your account system | No. Needed for new-account and mule rules |
device_fp, session_id | Your app or web front end | No. Needed for multi-account and session rules |
beneficiary_id, amount, currency | Your payment or payout service | No. Needed for payout and mule rules |
preceding_event (e.g. password_reset, email_change, beneficiary_added) | Your login and account service | No. Needed for account-takeover rules |
sender_id_hash | Your incoming-payment records, hashed on your side | No. Needed for money-coming-in mule rules |
available_balance | Your ledger | No. Needed for the "safe account" scam rule |
How a pilot starts here
We start with your own history: WoWyrd scores past events next to the fraud you already confirmed. Then it observes one live stream, such as payouts or instant transfers for 30 days in shadow mode, and decides nothing.
Talk to us about one stream, one owner, one question.
In the UK? See how WoWyrd maps to the FCA's draft guidance CP26/38.