Anti-fraud rules

Anti-fraud rules

Operator reference — how we detect and handle abuse.

Enforcement layers

1. Edge: datacentre ASN and known proxy ranges are flagged on first request.
2. Rate limiting: per-IP and per-account request quotas.
3. Human verification: Cloudflare Turnstile on registration, login and claims.
4. Business rules: cooldown, daily caps, device and IP reuse detection.
5. Payout circuit breaker: automatic pause when ledger reconciliation fails or when payout volume exceeds configured caps.

Identity resolution

Accounts are linked by a SHA-256 hash of currency|payout_destination. Two accounts that withdraw to the same FaucetPay destination collide on a unique index and are surfaced to operators immediately.

Scoring

Each request is scored by a rule engine whose rules are stored in the database and editable from the admin console. Scores drive actions: allow, challenge, hold, or deny. The engine is fail-closed — if scoring itself errors, the request is denied.

Handling

• Hold: withdrawal stays queued for manual review; the user is not charged.
• Suspend: claiming and earning are blocked; existing balance preserved pending review.
• Ban: account terminated and unpaid balance forfeited per section 7 of the Terms.

Appeals

Users may appeal through the Support tab. Operators should re-check the risk event evidence attached to the account before reversing any enforcement action. All operator actions are written to an immutable audit log.