Extended Fraud Intelligence

Pig Butchering / Romance-Investment Scam Detection

Why This Check Exists

Pig butchering is the fastest-growing fraud category on earth. Revenue grew nearly 40% year-over-year in 2024, generating an estimated $12.4 billion globally. The mechanics combine romance or investment fraud with crypto transfers to fraudulent platforms. The critical distinction from existing APP scam detection is duration and pattern - pig butchering involves escalating payments over 30-90 days, each individually plausible. No single transfer triggers standard APP thresholds.

As The Payment Integrity Network, JIL cannot claim coverage of crypto-rail fraud without this check. It is the single largest unaddressed fraud vector in the current framework.

What This Check Does

• Wallet screen against Chainalysis, TRM Labs, and Elliptic blockchain intelligence databases via local Redis bloom filter
• Memo URL / domain age check - pig butchering platforms are almost always registered within 90 days
• Behavioral pattern detection: rolling 90-day history scoring for accelerating transfers to same wallet cluster
• OFAC sanctions screen for designated pig butchering infrastructure: Huione Group (§311 May 2025), Funnull Technology (May 2025), Karen National Army (May 2025)

Verdict Logic

TypeScript Reference

// pig-butchering.service.ts
const walletHash = createHash("sha256").update(tx.destinationWalletAddress).digest("hex");
const bloomHit = await redis.bf.exists("pig:wallets", walletHash);
if (bloomHit) {
  const result = await chainalysisKYT.getAddressRisk(tx.destinationWalletAddress);
  if (result.riskType === "scam") return { score: 100, hardBlock: true };
}
// Behavioral: 90-day rolling window, accelerating amount detection
const history = await getTransferHistory(tx.originAccountId, tx.destinationWallet, 90);
if (history.count >= 3 && isAmountAccelerating(history.amounts)) score += 65;

APIs and Data Sources

AI Voice Deepfake Detection at Authorization

Why This Check Exists

The CFO deepfake wire fraud vector is now an established attack pattern. In the most documented case (Hong Kong, January 2024), an employee was fooled by a deepfake video conference into transferring HK$200 million ($25.6M USD). AI voice cloning tools - ElevenLabs, Resemble AI, and similar - can clone a voice from a 30-second audio sample. An attacker with access to any executive's public appearances has everything needed.

This check applies only to transactions authorized via voice call. It does not add latency to digital-origin transactions.

What This Check Does

• Real-time voice liveness via Pindrop Phoneprinting - detects pre-recorded or AI-synthesized audio during active authorization call
• Voice biometric match against enrolled executive voiceprint (Nuance Gatekeeper or Azure Speaker Recognition)
• Call metadata anomaly - new VoIP number, number registered <30 days, origin mismatches claimed identity location
• Audio deepfake probability score returned as 0-1 confidence value. Hard block above 0.85

APIs and Data Sources

Fraud-as-a-Service (FaaS) Infrastructure Intelligence

Why This Check Exists

Dark web marketplaces now sell complete fraud toolkits for as little as $50 - BEC templates, credential stuffing bots, synthetic ID kits, phishing pages. A single campaign can be run by hundreds of actors simultaneously using the same underlying infrastructure. A transaction may pass every individual JIL check but still originate from known FaaS infrastructure - the IP, device fingerprint, and email domain together match a known campaign signature.

What This Check Does

• IP intelligence - Recorded Future queries for threat actor association and FaaS tagging
• Device fingerprint database - SpyCloud cross-reference against compromised device records (40B+ records)
• Email domain reputation - SEON fraud scoring for FaaS campaign association
• Coordinated campaign scoring - 2/3 signals = REVIEW; 3/3 = hard block

APIs and Data Sources

Digital Wallet Token Provisioning Fraud

Why This Check Exists

When a stolen card number is loaded into Apple Pay or Google Pay, the resulting DPAN (Device Primary Account Number) looks identical to a legitimate token at settlement time. The fraud occurred at provisioning - before JIL was in the payment path. In 2025, $10 trillion flows through digital wallets globally. Provisioning fraud has grown proportionally with adoption, and no existing JIL check currently covers this vector.

What This Check Does

• Token requestor validation - verifies Apple Pay (50110030273), Google Pay (50132049990), Samsung Pay (50161522034), and PayPal (50133911439)
• Provisioning path risk - GREEN (push provisioning, lowest risk) / YELLOW (manual OTP) / RED (manual no OTP, highest risk)
• MDES / VTS device score - Mastercard and Visa assign device risk scores at provisioning time, accessible via token detail API
• Cardholder verification method at provisioning - flags NO_VERIFICATION provisioning events

APIs and Data Sources

Magecart / E-Skimmer Compromised Merchant Detection

Why This Check Exists

Magecart attacks inject malicious JavaScript into e-commerce checkout pages to steal card numbers. Those stolen cards are then used in transactions that look completely legitimate - valid card, valid BIN, real cardholder. The fraud happened upstream of payment. In 2024, Magecart infections tripled due to the CosmicSting vulnerability, and over 1,200 scam merchant domains were identified. The check is a 30ms local database lookup - almost zero latency cost, and it catches a vector no other JIL check addresses.

What This Check Does

• Merchant MID lookup against locally cached Recorded Future Magecart-confirmed compromise list (refreshed daily at 03:00 UTC)
• Merchant domain lookup against scam merchant domain set (refreshed daily)
• BIN correlation - internal cross-merchant fraud spike detection (3+ fraud events from same BIN at same merchant in 24h)

APIs and Data Sources

Zero-Knowledge Proof (ZKP) Post-Settlement Attestation Artifact

Why This Check Exists

JIL's current attestation model reveals the full verdict record to authorized parties. For EU entities subject to GDPR and institutional clients who consider payment flow patterns commercially sensitive, JIL needs to prove all 69 checks were run and the verdict was correct without revealing transaction details. A ZKP proves: "This transaction was evaluated against all 69 checks. No hard blocks were triggered. The verdict was YES." - without revealing amount, parties, or individual check scores. This is a genuine competitive moat - no other pre-settlement attestation system offers ZKP-backed proofs.

Implementation Libraries

Real Estate Closing Wire Protection

Why This Check Exists

Real estate wire fraud is the highest average-loss fraud category in the United States. FBI IC3 2024 data identifies real estate as the top sector for wire fraud by dollar amount. A typical loss: $300K-$3M per closing. The attack is BEC applied to a one-time high-value workflow - the buyer receives fraudulent wire instructions days before closing. Three signals together are highly predictive: first wire to this title company, account number changed recently, large round amount. Low implementation complexity, exceptional ROI.

APIs and Data Sources

Trade-Based Money Laundering (TBML) Detection

Why This Check Exists

FATF estimates trade-based money laundering at $2 trillion annually. The three primary vectors: over-invoicing (inflating invoice value to transfer wealth), under-invoicing (under-declaring import value), and phantom shipments (invoices for nonexistent goods). This check is relevant only to JIL's cross-border treasury and institutional corridors. For transactions with trade finance reference data (LC numbers, B/L numbers, invoice numbers), a dedicated TBML check adds a material fraud prevention layer.

APIs and Data Sources

Bust-Out Credit Fraud Detection

Why This Check Exists

Bust-out fraud is the final phase of a synthetic identity scheme: 6-24 months of credit-building followed by drawing down all available credit simultaneously before disappearing. Total credit exposed to suspected synthetic identities in the US reached $3.3 billion in H1 2025. The bust-out behavioral pattern is distinctive - rapid credit utilization increase across multiple accounts in a compressed window, followed by a large outbound wire. JIL sees the wire. This check flags when the wire matches the bust-out signature.

APIs and Data Sources

CBDC-Specific Attestation Framework

Why This Check Exists

Central Bank Digital Currencies are moving from pilot to production. The e-CNY is in broad circulation across China. The ECB digital euro pilot involves 50+ institutions. The digital pound is expected by 2027-2028. CBDCs introduce fraud vectors that do not exist in traditional rails: programmable restriction bypass, CBDC wallet takeover (no issuer intermediary), and cross-CBDC bridge manipulation via mBridge. Designing this framework now, before CBDCs are ubiquitous, positions JIL as the only settlement attestation engine with CBDC-native coverage.

APIs and Data Sources

Consortium Intelligence Network

Why This Enhancement Exists

Every JIL-connected institution sees a slice of the fraud landscape. A consortium model - where participants share anonymized fraud signals back into the JIL verdict engine - makes every check more accurate over time. Model: Early Warning Services cooperative (Zelle), UK Fraud Sharing and Analysis Center. Signals are anonymized via SHA-256 of PII fields before sharing. GLBA Section 314(b) explicitly authorizes fraud information sharing between financial institutions. EU institutions require GDPR-compliant DPA; anonymization provides the legal basis.

Adversarial ML / Model Drift Detection

Why This Enhancement Exists

Sophisticated fraudsters probe detection systems to map thresholds. Model drift detection monitors the statistical distribution of check scores over time using KL divergence. If Check 7 (BEC) suddenly returns scores clustered suspiciously near 29 - just below the REVIEW threshold of 30 - that is a signal that attackers have mapped the threshold. Action: rotate thresholds plus or minus 5 points with human approval.

Tooling

HNDL Quantum-Safe TLS Upgrade

Why This Enhancement Exists

Harvest Now, Decrypt Later (HNDL): adversarial nation-states record encrypted TLS traffic today for future quantum decryption. JIL already implements Dilithium/Kyber for verdict signing and storage - that is correct. The remaining gap is TLS between JIL's API endpoints and client systems, which still uses classical ECDHE (X25519). Upgrading to hybrid X25519Kyber768 (NIST FIPS 203 / ML-KEM) in TLS 1.3 closes this using the Open Quantum Safe (OQS) OpenSSL provider. This is the final piece of JIL's post-quantum architecture.

Implementation

# nginx.conf - add to ssl_ecdh_curve parameter
ssl_ecdh_curve X25519Kyber768:X25519:P-256;

# Node.js API server - OQS OpenSSL provider
# npm install @openquantumsafe/oqs-node
ecdhCurve: "X25519Kyber768", minVersion: "TLSv1.3"

References

Explainability Layer (XAI) - Natural Language Verdict Explanations

Why This Enhancement Exists

JIL's current verdict output is correct for machine consumption. It is insufficient for compliance officers who must explain rejections to regulators, customer service teams explaining holds to account holders, enterprise buyers evaluating JIL, and court or regulatory proceedings requiring evidence of why a payment was blocked. The XAI layer converts the machine verdict into a deterministic natural-language explanation. Deterministic template engine, NOT LLM-generated. Deterministic and auditable - a regulatory requirement.

Sample Output - REVIEW Verdict