Blacksec

Administrator
Staff member
ROOT
VIP
A bank drop is a real account at a real institution built to receive value and move it out — the load-bearing wall under every cashout chain. Opening discipline, funding behavior, withdrawal patterns, and the closure lifecycle: how drops get built, run, and retired without taking the operator down with them. Full playbook hidden below.

THE OBJECT (KID VERSION)

Money arrives through rails (Zelle, WU, ACH, wallet withdrawals) and exits through rails (withdrawals, transfers, bills). A "drop" is the bank account sitting in the middle — the entity both ends point at. Two kinds exist: own-name drops (you're the account holder — cleanest, but your identity absorbs everything) and third-party drops (someone else's identity/account — mule territory, relationship-dependent, legal exposure shared). Everything downstream inherits whatever the drop's identity says.

OPENING (ACQUISITION)

  • Traditional account: SSN + government ID + address at branch or online. Every modern bank runs ChexSystems/early-warning-style checks — prior closures for cause kill new openings.
  • Online-only banks: fully digital onboarding, selfie + SSN, faster, fewer branch questions, same KYC databases underneath.
  • Credit unions: smaller data-sharing footprint, relationship-based, slower to burn accounts with small activity — historically more drop-tolerant.
  • Business accounts: LLC formation + EIN opens a second category — higher limits, different monitoring (merchant/ACH patterns), useful when volume outgrows personal rails.
  • Fullz-opened accounts: opening with someone else's identity = fraud account from bank's view once discovered — usable window exists but discovery windows have tightened with real-time identity verification (name/SSN/DOB/address cross-checks + device checks).

RUNNING (BEHAVIOR PROTOCOL)

PhaseBehaviorWhy
Age (first 2-4 weeks)small in/out, payroll-like deposits, bills, card spendbuilds normal transaction history baseline
Receivemoderate credits from consistent sources, 24h+ between wavesvelocity matching against account age
Holdbalance sits 1-3 days before exit movessame-minute in/out = mule signature
Exitstandard ACH out, single ATM pulls, bill payments, debit spenddiverse exits beat ATM-only structuring
Scalegrow volume WITH account age, never a step-function jumpscore models track delta from baseline, not absolute alone

Cash handling: banks file CTRs at $10,000+ cash (per transaction, aggregated same-day) and monitor structuring below it — multiple $9,000 deposits are the textbook pattern. Cash-in through retail rails (prepaid loads) or non-cash rails avoids teller-level cash attention; when branch cash is necessary, infrequent and organic.

DEATH CONDITIONS (AND CLOSURE LIFECYCLE)

  • Account restricted overnight: outbound frozen, incoming sometimes still lands — the "restriction" phase before closure. Move nothing, contact nothing until understanding state.
  • Closure for cause: funds often mailed by check weeks later, account reported to early-warning databases — future openings elsewhere get harder.
  • SAR territory: bank files internally without tipping you; law enforcement timing is unrelated to your awareness.
  • Document requests: proof-of-funds/source requests — documentation story must exist before producing it (invoices, platform statements).
  • Operator exposure: account holder's SSN is on everything — a drop's failure implicates the identity behind it. Third-party drops shift that exposure but not the graph.

WORKING SEQUENCE

Bash:
open: matched-name account, institution with sane risk profile (CU/online tier)
  -> age: 2-4 weeks organic baseline, direct deposit if possible
  -> receive: consistent sources, moderate amounts, waves not floods
  -> hold: 1-3 day balance sits
  -> exit: mixed rails (ACH + spend + occasional ATM), never same-day patterns
  -> scale with age; retire before restriction (volume declining weeks before = clean exit)
  -> retire: wind down gradually, close on YOUR terms with balance zero voluntarily

Age before volume, waves before floods, retirement before restriction — a drop's life is a curve you design: quiet birth, steady middle, deliberate wind-down. The ones that die as closures leave fingerprints; the ones that retire as ordinary customers close themselves.

— RELATED GUIDES —

Aged, warmed, mixed exits, deliberate retirement — the drop is infrastructure, and infrastructure gets maintained on a schedule. The account that closes itself out at zero on a Tuesday afternoon never reports anything to anybody.
 
Last edited: