How does a self-custody Neobank legally rug its users? This is a WARNING.

How does a self-custody Neobank legally rug its users? This is a WARNING. 200+ Neobanks were made this year, and Whop just built the pumpfun version of a Neobank. That means abuse will be easy. I've tried and tested and ranked over 30 of them on my website. Let me tell you the reality of where we're at. You don’t need to hack a smart contract or disable the withdraw button to steal funds. You just need quick architecture, aggressive marketing, and a single configuration tweak. Here's what could theoretically happen to get a Neobank rugpull. 1. On-Ramp Bait (Massive Rewards & Frictionless Setup)

After using a pre-built neobank template the scammer will needs to pull in fast liquidity, they launch hyper-aggressive incentives:

Unrealistic Cashback: 10% to 20% flat back on all spend. (Unlocked after 60 days)

Pyramid Referrals: $20 per invite with tiered commission overrides.

Zero Fees: Zero FX conversion fees, zero maintenance, free top-ups. Pay some people to market your product. Users register, test a $50 transaction, get their instant reward, and start depositing real money. 2. Self-Custody illusion

The app advertises "self-custody," but the seed phrase management is intentionally obscured. Some Neobanks already force you to delete your account before you can see your keys. This is a RED FLAG. Users feel safe because they log in with FaceID or Passkeys, assuming they own the wallet. In reality, access exists solely through that specific application client. 3. The Liquidity Peak

Driven by viral referral links and high-yield promises, total user balances across the platform pass $1,000,000. Deposits are rolling in continuously, and users are actively using their virtual cards for daily purchases. 4. The 99% Trap. Instead of shutting down the API or running off with keys (which triggers immediate police reports and fraud alerts), the platform simply pushes an update to their fee schedule and backend router. FX Fees: Increased from 0% to 99%.

Withdrawal / Transfer Fees: Set to 99%. Because users cannot export their private keys to an external wallet like MetaMask or Phantom, they are trapped inside the app's ecosystem. Maybe they make it 80% to incentive people to actually put the effort in to recover some funds. This is a worrying reality. In the end, users try to move their funds or spend their balances:

A $1,000 withdrawal returns $10 to their destination address.

The remaining $990 is routed directly to the neobank’s fee collector address as a standard, legal-looking protocol fee. By the time users realize what happened, the liquidity is drained into the deployer's treasury under the disguise of "platform service charges." This is technically not illegal, and non-custodial banks don't actually get regulated. I know that usually the self-custody wallets are issued by somebody like Privy, and therefore still accessible if the user is wise enough. But realistically, most won't be aware of this. Am I missing something?