Sort:  

Yup the one mistake was enabling 'withdraw' in the API...will never happen again that is 100% for sure.