FiveM frameworks tell you that money moved, not who it moved between. ESX, QBCore and Qbox fire an event every time a player's cash or bank balance changes, with an amount and a reason string. A transfer from one player to another is two of those events: a removal on the payer and an addition on the payee. To get a real money log, with "Marcus paid Lena $12,000", you have to put the two legs back together.
This guide explains where FiveM money events come from, how transfers are paired, what you can do with free tools, and how the ServerStats money log works on ESX, QBCore and Qbox.
Where FiveM money events come from
- ESX Legacy fires
esx:addAccountMoney,esx:removeAccountMoneyandesx:setAccountMoneywith the player, the account (money,bank,black_money), the amount and a reason. Forset, the amount is the new balance, not a change. - QBCore and Qbox fire
QBCore:Server:OnMoneyChangewith the player, the money type, the amount, the action (add,removeorset) and a reason. - Banking resources mostly don't fire their own events. qb-banking and Renewed-Banking call the framework's remove and add functions, one for each side, with the same reason text. pefcl fires one event with both accounts.
- ox_inventory turns cash into an item on ESX and Qbox. A cash hand-over is an inventory give, and the framework only sees a "sync"
setafterwards.
The reason strings are the key. The frameworks' own resources use fixed strings: Paycheck, Gave to and Received from on ESX; paycheck, paid-fine and vehicle-bought-in-showroom on QBCore. Other scripts can pass any text, including player names, so a reason must never be stored as-is.
Pairing the two legs of a transfer
The ServerStats agent buffers money events for one server frame, since both legs of a payment fire back to back, and pairs them in this order:
- Known pairs first. ESX
Gave toandReceived from; qb-phone transfers; ESXBank transfer; qb-banking'scash transfer. - An identical reason on opposite legs. This is how qb-banking and Renewed-Banking transfers show up.
- Same account, same amount, opposite directions, different players, but only if there is exactly one candidate.
Anything that doesn't pair stays as money flow with its cause and never becomes a transfer. A cash-to-bank move by one player is a bank move, not a transfer. Payments to a job or society account show up as a team bank movement or a bill, since there is no player on the other side.
Logging transfers with free tools
A common starting point is a Discord webhook per money event. It works for a small server and breaks down quickly:
- You get two messages per transfer and have to pair them by eye.
- Reason strings with player names end up in a Discord channel forever.
- There's no search by player, amount or date beyond Discord's own search.
If you build it yourself, pair legs within one frame, key rows by both players' license identifiers (hashed if you share the data), drop free-text reasons, and keep set events out of your totals: a set is a new balance, not a change.
How the ServerStats money log works
The FXServer agent detects your framework and banking resources and sends each paired payment as one row: time, payer, payee, amount, account (cash, bank or your own currency) and the resource it came from. Everything else goes into the money-flow charts by cause.
| Resource | What is logged | Status |
|---|---|---|
| ESX Legacy | Gives, bank transfers, salaries, admin money, vehicle and property deals, police confiscations | Verified |
| QBCore | qb-phone transfers, salaries, admin money, fines, bills, vehicle and house purchases | Verified |
| Qbox | The same as QBCore, plus paychecks labelled by onPaycheck | Verified |
| qb-banking | Bank and cash transfers between players; deposits and withdrawals | Verified |
| Renewed-Banking | Bank transfers between players (the comment is never sent) | Verified |
| pefcl | Bank transfers when both owners are online | Verified |
| ox_inventory | Cash handed over (money, black_money) as a transfer; other items as item gives; shop purchases | Verified |
| esx_billing, esx_addonaccount | Bills issued and paid; society account deposits and withdrawals | Verified |
| ND_Core | Transfers, bank moves, staff money actions | Verified |
| txAdmin | Bans, warns, kicks and revokes, with a category instead of the reason text | Verified |
| vRP (vRP 1, vRPex, ZIRIX, Creative, vRP 2) | Balance changes as flow, and job changes. No transfers: no vRP fork fires a money event | Beta |
| lb-phone, okokBanking | — | Not wired (paid) |
Verified means every event, argument and reason string was read in the resource's public source and is covered by the agent's tests. Beta means it is built on the public API but not exercised against the real resource.
If two resources could report the same transfer, the Data sources page lets you pick which one counts, or leave it on auto. Each banking resource has its own ledger, so qb-banking transfers and QBCore phone transfers don't compete.
What is never sent
- Payment comments and memos, bill labels, and any free-text reason.
- Citizen ids, character names, bank account numbers and phone numbers. Some are used in memory to pair the legs of a transfer, then dropped.
- Plates, house addresses, IP addresses and hardware ids.
Characters are the player's pseudonymous id plus a slot number. Players show as handles such as #a91f3c unless the agent sends names and you turn names on for your account; members with the staff role always see handles only.
Searching and exporting
Filter by player (as payer, payee or either), counterparty, amount range, account, resource and time. The log explorer is on every plan, as far back as your plan's history: 24 hours on Free, 90 days on Operator (with CSV export) and 2 years on Network (with JSON Lines, the log API and one log across all your servers).
What to look for
- Money supply rising faster than your player count usually means a job or a sell price is too generous. The flow chart shows which source it is.
- Big transfers right before a ban. A player about to be banned often empties their account into a friend's.
- Several new characters paying one player, or money going round a small group and coming back. These are raised as abuse flags.
- Admin money is logged apart from player transfers, so a generous staff member is visible.
On RedM, RSG Core uses the same pairing engine; VORP balances are read every 60 seconds and show as flows only. See the FiveM and RedM pages for everything the agent collects.
FiveM
RedM