Hey Hunters 👋 I'm Kapil, & today we're open-sourcing Krediwall.

The problem.
In India, banks now fund UPI payments from credit lines. UPI is push-&-final: once a payment completes, it can't be recalled. So when a fresh credit line gets drained by a mule ring, the loss lands on the lender's own capital.

Generic fraud tools can't see what makes these attacks obvious:
the sanctioned limit, how fast it's being burned, & how old the credit line is. Only the lender holds that.

What Krediwall does.
It runs in-process inside the bank's payment switch and returns ALLOW, REVIEW or BLOCK on every credit-funded UPI authorization, in microseconds. It combines lender-only signals with India's DoT fraud-intelligence feed (FRI). It makes no outbound calls & stores identifiers only as keyed-HMAC digests, so nothing leaves the bank's perimeter.

What's in the box (Apache-2.0):

Rules for 6 patterns: velocity spray, mule drain, first-payee large, structuring, dormant reactivation, odd-hours activity
Every verdict ships with the evidence behind it, ready for a review queue or an FMR filing
HTTP gateway, Prometheus metrics & Grafana dashboards
A replay harness, so your fraud team calibrates thresholds on your own labelled traffic
npm install @krediwall/*, zero runtime dependencies

Try it in a minute:
npm run demo shows the engine stopping a mule drain step by step.

I'd love feedback from anyone who's worked on a payment switch, a fraud team or a credit product.

What signal would you add?
What would stop you from running this in shadow mode next week?