A behavioral fraud layer for the crypto on-ramp.

It watches the checkout session, not the destination address — because by the time the address matters, the money is already gone.