Who uses crypto scam and money mule detection?

Neobanks and consumer finance apps, payment service providers, banks and the fraud and transaction monitoring vendors that serve them.

Goldsky

Crypto scam and money mule detection data

Talk to our team

What is crypto scam and money mule detection?

Crypto scam and money mule detection is flagging customer payments to wallets linked to scams, and customer accounts that receive stolen funds and pass them on (money mules).

Neobanks, payment companies and banks that let customers send crypto run it because a scammed customer rarely gets the money back and a mule account keeps moving the proceeds; FinCEN tied about $12.7 billion in reports filed from September 2023 to December 2025 to digital asset investment scams, also called pig butchering.

Goldsky matches your customers’ payments against a scam list you can change while it runs, then records your risk provider’s verdict on each match; holding a payment or closing an account is your fraud team’s decision.

How crypto scam and money mule detection works

The diagram follows a payment from the moment a wallet joins your scam list to your fraud team’s decision to hold the payment or close the account. Your setup may differ.

Screening providerUpdate the scam listScam and mule wallets added as found

TurboWatch both listsCustomer wallets and scam list, no redeploy

Payment movesA customer pays a listed wallet

TurboPost the matchA webhook per match, to a Compose task

Hold or closeYour fraud team acts on the payment or account

ComposeGet a risk verdictYour provider’s answer, recorded with the match

Goldsky
Your provider

How to detect crypto scams and money mules

A pipeline checks every transfer against two lists, your customers’ wallets and the wallets linked to scams, and posts each match to a task Goldsky hosts. The task calls your risk provider about the match and records the answer for your fraud team.

What you’ll need

Goldsky Turbo
Goldsky Compose
A scam and fraud intelligence provider, or your own list of scam-linked wallets
A database for both watch lists and the matches
An HTTPS endpoint or task that receives each match
A fraud case system where your team acts

Keep the scam list current
Scammers open new wallets all the time, so a list from last month misses this week’s scams.
Your intelligence provider, your fraud team and customer reports add wallets linked to scams as they’re found. Each entry needs its source and date, because a wallet wrongly listed blocks payments to an innocent party.
Watch customer wallets against the scam list
Handled by Goldsky Turbo
You care about the transfers where one of your customers pays a scam wallet, or receives from one.
Both lists have to change while the check runs: a new customer wallet or a new scam wallet counts from the moment it’s added. A check that needs a release to pick up a new scam wallet misses the payments in between.
With Goldsky, each list can be a Turbo Pipelines dynamic table, and one SQL filter keeps transfers where dynamic_table_check() finds a customer wallet on one side and a scam wallet on the other. New rows apply without a redeploy.
Filter transfers with dynamic tables (opens in a new tab)
The customer’s payment moves onchain
The customer sends funds from their wallet, often believing the recipient is genuine.
The transfer is recorded in a block on the chain. Once it’s there, it can’t be pulled back, so speed matters most for the payments that are still pending in your own app.
Post each match to your fraud workflow
Handled by Goldsky Turbo
A match is only useful if it reaches someone who can act on it while the account is still open.
Each match goes out with the wallets, token, amount and transaction, and delivery can repeat after an error, so the receiver checks the transfer’s ID first. A match is sent when the transfer is seen, before it’s final, so the receiver also has to handle the rare correction when the chain rewrites recent blocks.
Turbo Pipelines’ webhook sink can send each match as its own request with one_row_per_request: true, retrying failed deliveries, to an HTTP-triggered task or your own endpoint.
Set up the webhook sink (opens in a new tab)
Get a risk verdict on the match
Handled by Goldsky Compose
A list match says two wallets met; your provider can say how strong the scam link is and what else the wallet has done.
The match is sent to your risk provider, and its answer is stored with the match before anyone acts on it. If the provider is down, the request has to be retried, and a match that still fails needs to reach someone instead of disappearing.
A Compose task calls your provider through ctx.fetch with the retry rules you set, and every run is traced with its inputs and outputs for later review.
Call your provider with fetch (opens in a new tab)
Hold the payment or close the account
Stopping a scam payment or a mule account is a decision your fraud team owns.
Your team holds pending payments to the wallet, contacts the customer or closes the account. Mule behavior, where an account receives stolen funds and passes them on within a short time, spans several transfers, so your fraud system checks that pattern across the matches it holds.