Best practices
Fraud management
Detecting and preventing abuse across ramps, transfers, and webhooks
Fraud surfaces in tokenised finance
Attackers target the weakest leg: stolen cards on on-ramp, social engineering on off-ramp, API key theft for mass transfers, or webhook replay to fake confirmations. Defence spans product rules, monitoring, and operational response—across all assets and corridors on the network.
Layered controls
| Layer | Control |
|---|---|
| On-ramp | Velocity limits, 3DS, device fingerprint |
| Transfer | Balance holds, allowlists for new recipients |
| Off-ramp | Cooling period after large deposit |
| API | Key rotation, IP allowlists, anomaly alerts |
Platform-level protections complement tenant-specific rules in your own app.
Monitoring signals
- Deposit followed immediately by full withdrawal (classic mule pattern)
- Many accounts funded from the same source instrument
- Off-ramp spike to high-risk corridors
- Unusual Echo webhook volume from unknown sources
Automate alerts; do not rely on manual review alone at scale.
Incident response
- Freeze affected wallets or API keys
- Preserve audit logs for investigation
- Notify partners and regulators per local obligation
- Post-mortem covering webhook verification and retry handling