Why "low risk" does not mean "clean address"

How the score is calculated

Every finding has a weight: serious 90, warning 45 or 15, observation 0. The total is the heaviest finding plus 15% of the rest, capped at 100. Levels: 0–34 low, 35–69 medium, 70–100 high.

What "low" means

Within the checked scope (sanctions, freeze, counterparties, behaviour) nothing of medium or high risk was found. Minor warnings are possible. It is not an assessment of the owner or of the legality of the funds.

Three cases where "low" misleads

1. A new address. A scammer always has a fresh wallet with no history. There is nothing to check, so the score is low. The tell: address age in hours or days and almost no transfers.
2. A pass-through address. Funds arrive and leave at once. The address itself is clean but serves as a hop. The service flags pass-through movement as behaviour.
3. Source lag. Sanctions lists update with a delay; service labels update on import. An address may have been listed yesterday and not be in the database yet.

What to do when the score is low but you have doubts

• Look at the address age and number of transfers: "new and empty" is a reason for caution with a large amount.
• Send a test transfer and wait for the recipient's confirmation.
• Re-check right before sending: the report may have come from the cache (up to 5 minutes).
• For a deal with a stranger, use escrow or a platform with buyer protection instead of a direct transfer.