Skip to content
Shield
Open console

Risk console for payment gateways · India

Fake merchants hide in networks, empty boxes and drained accounts.

Looking at one payment at a time misses shops that work together. SHIELD maps who secretly runs them, weighs every parcel they claim to ship, and follows the payout into their bank account — then holds or freezes the money before it leaves.

Open the risk console How it works
Exhibit A · shared ecosystemPayout blocked
Coromandel MobilesGigaByte Laptops · newCA #247781Zenith Pharma · bannedLaptop 9f3a…A/c ••7024Director
GigaByte Laptops shares accountant CA #247781 and a laptop with a banned pharmacy. It starts in the sandbox tier: tiny, slow payouts until cleared.

Live demo workspace

Businesses watched
—
Frozen
—
On hold
—
Money protected
—
Parcels checked
—

Three independent checks.

Each one is cheap to fool on its own. Fooling all three at once — fake owners, fake parcels and a fake business bank account — is not.

  1. Collusion graph

    Who is connected to whom

    Owners, chartered accountants, company secretaries, laptops and bank accounts become one map. A new shop that shares an accountant and a laptop with a banned one is caught before its first payout.

    MATCH (m1)-[*1..2]-(shared)-[*1..2]-(m2:Merchant)
WHERE m2.status = 'TERMINATED'

    What it catches

    • Same accountant, director or device as a banned business
    • Money that loops through two companies and comes back within 72 hours
    • One person behind many “new” shops, recognised by typing rhythm
    • Tight rings of fake buyers and sellers trading only with each other

  2. Carrier telemetry

    Did a real parcel ship?

    Shipping labels are made inside the gateway, so every order has a courier scan. The weight on the courier's scale is checked against what the checkout said was sold.

    Deficit = (W_floor − W_dead) / W_floor
> 50% → freeze · > 30% → hold

    What it catches

    • A 50 g box sent for an ₹85,000 laptop
    • Parcel delivered to a different city than the order
    • Labels made outside the gateway
    • Same-area drops with no sorting-hub scan

  3. Open banking audit

    Where does the money go next?

    With the merchant's consent, SHIELD reads their bank statement. Real shops pay staff, rent and suppliers. Laundering shells send the money on to other accounts within minutes.

    V_drain = Σ non-vendor outflows (30 min) / payout
> 0.85 → freeze + nodal alert

    What it catches

    • 92% of a payout leaving in 27 minutes
    • ₹1 crore a month in sales, but no salaries or rent
    • Festival-season shops with no stock purchases
    • Higher limits requested using invoices from their own suppliers

Merchants earn faster payouts. Any red flag drops them back.

New shops start on small, slow payouts. Clean months move them up. A failed check moves them down the same day, and every move is written to an audit trail.

  1. T0

    Sandbox Onboarding

    $5,000 / mo (≈ ₹4 lakh)

    100% holdback on a strict T+14 delayed settlement ladder

    Drops on: Any DWS weight deficit > 30%, pin mismatch or shared rogue node

  2. T1

    Graduated Micro-Step

    $10k → $25k → $50k (2× / month)

    10% rolling reserve (90 days) + 90% released only on carrier DELIVERED

    Drops on: V_drain > 0.85 or conversion-rate anomaly (> 25%)

  3. T2

    Verified Scale

    $100k – $1M+

    5–10% rolling reserve + T+2 on ecosystem-scanned AWBs

    Drops on: Circular 3-hop round-trip in the graph or off-season velocity spike

  4. TS

    Seasonal Valve

    Dynamic calendar window

    Consumption-date tranche escrow (15% at booking, 85% after event / delivery)

    Drops on: Instant reset to $500 / mo outside the designated season

Red-team drills

Four real attack patterns. Fire them at the live engine.

Run a drill in the console

  1. Scenario A · Sunrise Bakers & Confectioners

    Aged sleeper bakery bust-out

    The attack
    A 5-year-old bakery is bought by a syndicate, runs a Friday-night electronics flash sale and drains 92% of the first settlement to mules and a P2P crypto desk.
    Caught by
    Hot-path challenge, then the 30-minute Account Aggregator drain poll freezes every later settlement.

  2. Scenario B · GigaByte Laptop World

    Fake laptop store · 50 g empty box

    The attack
    An ₹85,000 laptop order ships as a 50-gram box to unlock the 90% non-reserve payout.
    Caught by
    The sorting-hub DWS scan is joined to the checkout SKU floor; a 95.8% weight deficit freezes the ledger in milliseconds.

  3. Scenario C · Nimbus Agro Commodities

    Collusive 3-entity B2B round-trip ring

    The attack
    Navkar Traders pays Nimbus ₹6.2L; Nimbus pays 'supplier' Gujarat Agro Bulk, which wires ₹5.98L straight back to Navkar.
    Caught by
    Multi-hop cycle detection on Account Aggregator transfer edges, confirmed by Louvain community density.

  4. Scenario D · Jingle Joy Toys

    Fake holiday toy store

    The attack
    A 7-month-old store asks for a ₹4 crore December limit with almost no upstream inventory — bought from a supplier it secretly controls.
    Caught by
    Pre-season GSTR-2B coverage from independent, 3-year-old suppliers; anything under 0.05 stays clamped at $500 / month.