Most economy abuse on a game server leaves a trail in the money log. Alt accounts farm starter money and send it to one main. Duped money gets moved around a group until it looks like trade. A player about to be banned empties their account into a friend's. A staff member gives money to a player, who quietly pays some of it back. None of this needs IP tracking to spot: it needs the list of who paid whom, how much, and how new the accounts were.
This guide covers the patterns worth watching, how to check them by hand, and how ServerStats raises them as explainable abuse flags.
The patterns
Alt funnels
An alt funnel is several accounts paying one account. Alts are cheap on most servers: a new account gets starter money, a daily reward, a vote reward or a first-join kit, and all of it can be /payed to a main. The tell is not the payment itself; it's several new, low-playtime accounts paying the same player within a short window.
Transfer rings
A transfer ring is money that leaves an account and comes back through one to three other players: A → B → C → A. It is how duped money is made to look like normal trade, and how groups hide who really earned what.
Dumping before a ban or before leaving
A player who expects a ban, or who is quitting, often sends most of their balance to friends first. Compare their outgoing payments in the last day before the ban or the last session with their usual daily volume.
Staff self-dealing
Staff self-dealing is a staff member using admin powers to benefit themselves: an /eco give or a spawned item to their own account, or to a friend who pays them back soon after. A related pattern is a staff member revoking a punishment for a player who paid them shortly before.
Wash trading and gamble laundering
Wash trading is two players buying and selling the same cheap item between themselves at an absurd price, such as one dirt for $250,000, to move money through an auction house or player shop so it looks like a sale. Coinflips and other player-versus-player gambles can do the same thing when one side wins almost everything.
Checking by hand
Without tooling, you can still check the obvious cases:
- Sort your payments by amount and read the top of the list against your money supply. A payment worth several percent of all money on the server deserves a look.
- Pick a suspicious player and list who paid them in the last day. Check the payers' first-join dates and playtime. Five accounts that joined this week all paying one player is a funnel.
- Check admin gives against later payments. For each staff give, see whether the recipient paid the staff member within a day.
- After each ban, check the banned player's last day of outgoing payments.
This is slow, and it depends on having a searchable log in the first place. See Minecraft payments and FiveM money logs for how to get one.
Abuse flags in ServerStats
ServerStats checks the money and punishment logs every 5 minutes and raises a flag when a rule matches. Each flag is explainable: it has a one-line sentence and the exact rows that triggered it, and the log explorer can filter to flagged rows only.
| Rule | What it catches | Example sentence |
|---|---|---|
| F1 Large transfer | One payment at or above the largest of your own threshold, 1% of the money supply, and the top 0.1% of payments over 30 days | "Steve paid Alex $2.1M, 3.4% of all money on the server." |
| F2 Funnel into one account | 4 or more payers to one player within 24 h, at least 75% of them young (first seen under 7 days ago, or under 2 h of playtime), adding up to 0.5% of the supply | "5 accounts with under 2 h of playtime sent $840k to #a91f3c in 6 hours." |
| F3 Transfer ring | Money going round 2 to 4 players within 72 h and mostly coming back | "$500k went A → B → C → A within 3 hours." |
| F4 Dump before leaving | Outgoing payments in the 24 h before a ban, or before a last session followed by 7 days away, over 5× the player's usual daily volume | "Before being banned for cheating, #77c2 sent $1.3M to 2 players." |
| F5 Staff self-dealing | A staff give or spawn to themselves, a kickback of half or more within 24 h, or gives over your daily cap | "Mod_Jen gave $1M to Alex; Alex paid Mod_Jen $900k 20 minutes later." |
| F6 Velocity spike | A player moving more than 10× their usual daily volume | "Kai moved $3.2M today; normally about $40k a day." |
| F7 Wash trading | 3 or more auction or player-shop sales between the same two players at 5× the item's usual price | "Alex bought 1 dirt from Steve 4 times at $250k each (median $2)." |
| F8 Gamble laundering | 5 or more gambles between the same pair in 24 h where one side wins 80% or more | "Coinflips between A and B: B won $600k of $650k over 9 games." |
| F9 Crate odds drift | A crate reward dropping far more (or less) often than configured, over at least 500 opens | "Legendary drops at 4.1% vs the configured 1%." |
| F10 Revoked by a friend | A staff member revoking a punishment for a player who paid them in the previous 7 days | "Mod_Jen revoked #77c2's ban 1 hour after receiving $200k from them." |
Thresholds scale with your economy. The floors are a share of the money supply, so a flag means the same thing on a small SMP and on a large network. You can set your own large-transfer threshold and a daily cap on staff gives, and switch individual rules off per server.
Reviewing. Owners and moderators can dismiss or confirm a flag, with a note. A dismissed pattern stays quiet for the rule's cooldown, so the same funnel isn't raised every 5 minutes.
Which plan
| Plan | Abuse flags |
|---|---|
| Free | F1 (large transfer), shown in the dashboard |
| Operator | All ten rules per server, with alerts by email and Discord |
| Network | All ten, plus webhook alerts and cross-server funnels and rings across your own servers |
Cross-server flags are on by default on Network. They only look at your own organisation's servers, and they join a person's accounts across games only through links you already have (Discord /link or manual links). They need at least two servers or some player links.
What we deliberately don't do
No IP-based alt detection, ever. ServerStats agents never send IP addresses, so there is nothing to compare, and we keep it that way. Shared IPs are also a poor signal on their own: siblings, dorms, cafés and mobile carriers share addresses, and VPNs hide them. Behaviour in the money log catches the alts that matter, the ones used to farm and move money, without collecting anything more about your players.
Flags use the same pseudonymous handles as the rest of the dashboard. Names appear only if you turned them on, and never for members with the staff role. When a player is erased, they are removed from flags and from other players' payment rows as well.
Minecraft
FiveM
RedM
Garry's Mod