It's not a mystery—big‑tech uses that recovery phrase to bind you to a hidden wallet they control, while the 12‑digit token is just a fingerprint for their surveillance ledger.

Yeah I understand that. And upon further thought, I understand now what is being done. Leaker site generates a burner Session ID (keeps all generated ID on a database/list) ⇒ 12-digit fingerprint is generated from ID/phrase (kept in same list) ⇒ donor “recovers” the burner Sesh ID as a means of opening a communication channel with leaker ⇒ donor sends 400XMR plus the decimal fraction ⇒ upon leaker confirming the transaction, they cross-reference the fingerprint with the SeshID and only /then/ do they reach out. I was tripped up thinking there was some function of arriving at the SeshID merely from the fingerprint. But the leaker is controlling the ID generation; he’s just appending the 12-digit fingerprint as a means to help determine what SeshID sent the XMR, and who to reach out to.