Payments, scams and platform abuse
You check payees once at onboarding. Who checks them on the day the money leaves?
A payout platform is the last stop before money leaves for good. Fraudsters open several payee accounts with borrowed identities, take over a real payee and change the payout destination, or recruit mules to receive funds and cash out through crypto or cards within hours. Onboarding checks see none of this, because each account looked fine the day it was opened. Small teams usually find out from a chargeback, a partner bank or a regulator.
Built for Payout platforms, contractor and creator payment firms, marketplaces and payroll providers that pay many payees across countries and rails; Head of Risk, Head of Payments, COO, CTO at smaller firms
The problem in numbers
What the public record shows
Every figure links to the page it came from, with its date.
78,000
account takeover cases reported to the UK National Fraud Database in 2025 (the report says more than 78,000), 18% of all filings; most involved phones, online retail and credit cards, not payouts
credit-connect.co.uk, 2026-03
22,000
money mule cases recorded by Cifas members in 2025 (the report says over 22,000), the first year of a separate money mule filing category
credit-connect.co.uk, 2026-03
69%
rise in UK money mule cases in the first half of 2026 against the first half of 2025, per Cifas
amlintelligence.com, 2026-08
What you get
The deliverables
You get a review of how a fraudster could open, take over or rent payee accounts on your platform and move money out through your payout rails, with the weak points ranked by exposure and plain fixes for each.
A map of your payout attack paths
How a fake, duplicate, taken-over or mule payee could get paid on your platform, step by step, from signup to cash-out.
A shared-identity check on your payee base
Payee accounts that share bank details, wallets, devices or tax IDs, and payees whose destination changed shortly before a payout.
A ranked list of fixes
The controls to add first, such as a hold after a destination change or a limit on first payouts to new rails, ranked by how much money each path can move.
A readout for your team and partners
A short written summary you can share with a partner bank or payment provider that asks how you control payout fraud.
How it runs
2 to 3 weeks, start to finish
2 to 3 weeks
Scope
We agree the payout rails, countries and payee types in scope, and what payee and payout data you can share.
Review
We walk the payee lifecycle from signup to cash-out and analyse the payee and payout records you share.
Readout
A ranked list of attack paths and fixes, walked through with your risk, payments and engineering leads.
Method
How the answer is produced
The payee side, not the payer side
Most payment fraud reviews look at who pays you. This one looks at who you pay, which is where payout platforms lose money.
Every account against its own history
A destination change, a first payout to a new rail or a sudden jump in payout size is judged against what that payee normally does.
Linked accounts, not single accounts
Fake and mule payees usually come in groups, so shared details across accounts matter more than any one account's checks.
Why Amir
Designed and led by someone who has built fraud models in production
The patents closest to this problem:
Amir is a named inventor on US 12,118,558 B2 (Estimating quantile values for reduced memory and/or storage utilization and faster processing time in fraud detection systems, filed at NICE Actimize; granted).
Amir is a named inventor on US 12,118,558 (Estimating quantile values for reduced memory and/or storage utilization and faster processing time in fraud detection systems, filed at NICE Actimize), which scores each account against its own history in real time, the kind of check that flags a payout to a newly changed destination as unusual.
View on Google PatentsAmir is a named inventor on US 12,541,721 B2 (Method for extreme class imbalance within fraud detection, filed at NICE Actimize; granted).
Amir is a named inventor on US 12,541,721 (Method for extreme class imbalance within fraud detection, filed at NICE Actimize), which addresses building fraud models when bad cases are a tiny share of the total, as fraudulent payees are on a payout platform.
View on Google PatentsThese patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.
Is this you
You probably need this if
- You pay out to thousands of payees across countries, currencies and rails such as bank transfer, card, wallet or stablecoin.
- A payee can change their payout destination and receive a payout in the same session.
- You have never counted how many payee accounts share a bank account, wallet address, device or tax ID.
- Payees can cash out to crypto or prepaid cards within hours of first being paid.
- Nobody on the team owns fraud or risk full time, and payout volume keeps growing.
Questions
Before you reach out
Is this the same as the Vendor Bank-Change Drill?
No. The drill tests whether an accounts payable team calls back before changing a vendor's bank details. This audit looks at the payees your platform pays: fake, duplicate, taken-over and mule accounts, and how money leaves through your rails.
Do you need our payee data?
The audit is most useful with payee and payout records, which can be pseudonymised before you share them. A lighter version works from a walkthrough of your flows alone.
Do you try to break into accounts?
No. Nothing is attacked and no money moves. The audit reviews your flows and your records.
Does this replace our KYC or AML program?
No. It looks at payout fraud paths that onboarding checks miss. Your KYC and AML obligations and decisions stay with you.
Scope Payout Fraud Audit with Amir
Tell Amir what you run and what worries you. He replies with a short scope outline.