An account freeze notice citing "unusual activity" tells the customer almost nothing about what actually happened, which is by design. Exchanges deliberately keep these notices generic to avoid describing the exact triggers a bad actor could learn to avoid. The freeze itself, though, is rarely arbitrary. It comes out of a risk-scoring system doing exactly what it was built to do.
What the risk-scoring systems are actually looking at
Most regulated exchanges run a layered, largely automated risk engine in the background of every account, scoring activity against a baseline built from the account’s own history and against patterns known to correlate with fraud, account takeover, or money laundering across the exchange’s wider customer base. Without naming any specific vendor or platform, the recurring signals these systems weigh tend to include a sudden change in transaction velocity, deposits or withdrawals that deviate sharply from an account’s established pattern, counterparty risk scoring against wallet addresses linked to known illicit activity, login attempts from a new device or an inconsistent geographic location, and behavioral shifts such as a long-dormant account suddenly becoming highly active. None of these signals alone is proof of anything. A freeze is usually the product of several signals firing close together, which is also why a routine change in someone’s own habits, a new phone, a trip abroad, a larger than usual sale, can occasionally trip the same system as genuine fraud.
The appeal and review process
Nearly every exchange running this kind of freeze provides a formal review path, typically opened through a dedicated compliance or account-security support queue rather than general customer service. The process usually starts with identity re-verification, followed by a request to explain the specific activity that triggered the review. A case then sits with a human analyst who either clears the account, requests further documentation, or escalates it if the review surfaces something more serious than the original trigger.
Automated systems generate the freeze, but a human reviewer almost always clears it. Understanding that a person, working through a queue of similar cases, will eventually read the response is the most useful mental model for how to write it.
Why patience outperforms escalation
The instinct to call repeatedly, open multiple tickets, or post publicly about a frozen account is understandable, but it tends to work against the customer rather than for them. Compliance queues are generally worked in order, and duplicate tickets on the same account often get merged or deprioritized rather than expedited, since each new contact typically has to be manually reconciled with the existing case before review can continue. A calm, complete, single response to whatever documentation was requested, submitted once and followed up on a reasonable schedule, consistently resolves faster than an aggressive multi-channel escalation. The exception is a case that has genuinely stalled well past the exchange’s stated review window, at which point a single, clearly worded escalation referencing the case number is appropriate rather than a return to first principles.
The underlying lesson is not that these systems are always right, false positives are common and frustrating, but that the fastest route through one is rarely a louder complaint. It is a complete, accurate answer to the specific question the review actually asked.