IOSOR Learn
Fraud burn rows on the prepaid ledger
Mark blocked and abusive OTP attempts so finance sees prevented burn beside real debit — without fake Delivered or silent wallet holes.
Abuse stops are not invisible. When velocity caps, spike trip wires, or destination denials block an OTP attempt, the prepaid ledger must show a fraud burn row — prevented spend — next to settled debits for real attempts. Finance cannot treat “nothing charged” as “nothing happened,” and product cannot paint blocked traffic as Delivered.
Related: Debit rows vs delivery status ledger, OTP delivery vs verify two debits, Abuse spike: stop without fake success, Fraud ops when OTP volume is real.
IOSOR is white-label prepaid. USD 20 funds a pilot that proves burn rows join to stop events; soft review near USD 1,000/month prices missing burn classes as recon debt. Clients see white-label money and status macros only.
Prevented burn is not a free debit
A blocked attempt may leave zero settled debit and still need a ledger-visible burn class: capped, denied, spike-stopped, allowlist-miss. That row answers “how much wallet risk did we avoid?” without inventing a charge. Settled debit remains for billable attempts that left the hold. Mixing the two invents fake savings or fake spend.
Happy-path money↔outcome join: Debit rows vs delivery status ledger. This page owns blocked/abusive classes, not DLR join.
Row classes finance can filter
| Class | Money | Product honesty |
|---|---|---|
| Settled attempt | Debit settled | Outcome may lag — never fake Delivered |
| Cap blocked | No settle (or release) | Velocity limited — not Delivered |
| Spike stopped | No settle | Spike stopped — not Delivered |
| Destination deny | No settle | Destination blocked |
| Prevented burn rollup | Aggregate avoided USD | Ops/finance night view |
OTP delivery vs verify still two money moments when both fire: OTP delivery vs verify two debits. Burn rows must not collapse those into one fake “saved” line when both units charged.
Join stop events without fake success
Every burn row needs a correlation key to the stop event: identity class, destination, window, trip reason. Product UI and ledger share vocabulary (Shared status language for product and finance). Spike path: Abuse spike: stop without fake success. UI stopped + no burn class — finance cannot prove wallet saved. Ledger burn + UI Delivered — you lied twice.
Export columns for burn vs spend
Exports need: burn class, avoided amount (or zero-settle flag), settled amount, correlation ID, UTC window, stop reason. Soft USD 1,000/month treats missing burn filters as recon risk; USD 20 proves one corridor with settled and blocked rows in one file. Reading rhythm: Fraud ops when OTP volume is real.
Buyer checklist for fraud burn rows
- Blocked OTP attempts leave a burn class, not silence?
- Settled debit never paired with fake Delivered on stops?
- Check named owner + UTC export for this control?
Start with IOSOR
Trigger one named stop on a live OTP intent — cap, spike, or destination deny. Export that same UTC window. Finance must see settled debit rows beside burn-class rows: capped, spike-stopped, denied. Product UI and the ledger share the stop reason. A silent wallet is not proof that nothing happened.
IOSOR takeaway
A blocked OTP is a burn row on the prepaid ledger, not a free debit and not a missing event.
Do: keep burn class, avoided amount or zero-settle flag, correlation ID, and stop reason in one file finance can filter.
Don't: hide prevented spend, or paint the stop as Delivered so the ledger looks clean.
Was this guide helpful?
Related guides
- Transferring Fraud Threshold Rules During Engineering Team Handovers
Audit operational velocity thresholds and alerting contacts during platform team transitions to maintain continuous abuse protection.
- Setting Destination Traps to Detect Automated Pumping in Pilot Phase
Deploy dummy destination triggers during initial pilot volume testing to catch automated scripts and prevent fraudulent pumping before full production launch. Protect your platform with strategic honeypots.
- Restoring Safe Traffic Volume Through Granular Prefix Allowlist Rules
Learn how to safely ramp SMS traffic after a fraud incident by implementing strict prefix allowlists, JIT number assignment, and monitoring USD thresholds within IOSOR.