Many mobile mining projects say they must remove 100% of bots before opening mainnet, migration or reward payments.
That is not a realistic security standard. No large system can guarantee zero fraud.
HUMAN SOCIETY ALSO MANAGES RISK
In 2024, about 11.6 million people were held in detention worldwide. That was 145 people per 100,000, or about 0.145% of the global population.
This is a detention rate, not the total crime rate. Nearly one-third of these people were still waiting for trial.
However, the basic principle is clear:
Society investigates suspected offenders separately. It does not lock an entire city while searching for the last offender.
Technology is not exempt from this principle.
Sumsub reported an overall identity fraud rate of about 2.2% in its 2025 platform data. This is data from one identity verification provider, not a universal global rate.
Bots must be removed. Real users must not become hostages of the anti-bot process.
THE REAL ENGINEERING PROBLEM
The problem is not whether fraud exists. The problem is how the system handles exceptions.
A secure system needs measurable risk, separate review queues and fixed response deadlines.
If a user passes identity, face and behavior checks, release that account.
If an account shows signs of duplication, automation or identity fraud, move it into enhanced review.
Do not hold every verified user until the final suspicious account is resolved.
That does not create perfect security. It creates a 100% service failure for legitimate users.
Good engineering controls exceptions.
Bad engineering turns the exception into the rule.
MILESTONE-BASED KYC
KYC should open automatically after a public milestone, such as:
- 30 valid mining sessions
- A published period of real activity
- A defined number of voluntary rewarded-ad views
Clear applications should receive a result within 48 hours.
Unclear photos or incorrect information should receive a clear reason and a chance to resubmit.
Suspected bot or duplicate accounts should enter a separate review queue.
No case should remain pending for more than seven days without a new status or explanation.
AD REVENUE CAN HELP PAY FOR KYC
Many mobile mining projects earn money from advertising.
Part of that revenue can pay for identity verification, security and monthly reward settlement.
Users may voluntarily watch rewarded ads. Projects must never require advertisement clicks or artificial engagement.
The rule should be simple:
The community helps create revenue. The project uses part of that revenue to verify and pay the community.
SECURITY CAN CONTINUE AFTER MIGRATION
KYC is not the final security layer.
After migration, projects can monitor onchain activity, detect suspicious wallet clusters and investigate unusual transfers.
If fraud is confirmed, act against the account involved. Do not freeze every user.
Shared devices, family accounts and shared internet connections can create false signals. Every enforcement system needs an appeal process.
THE KYCFIRST STANDARD
Open KYC after a clear milestone.
Give every application a fixed deadline.
Separate suspicious cases from normal users.
Migrate verified balances.
Pay rewards on a published monthly schedule.
Do not confuse zero-fraud marketing with good engineering.
Fraud prevention protects a network.
Endless delay destroys it.
Sources: United Nations SDG Goal 16, Sumsub Identity Fraud Report 2025–2026 and Google advertising policies.
