Money and item dupes are the fastest way to kill a server economy. Almost every one comes down to a single root cause: a script that trusts the client.
A dupe usually abuses a server event that adds money or items. Either the event trusts an amount the client sent, or it can be triggered over and over with no check. The exploiter is not modifying their game, so an anticheat sees nothing wrong. They are just calling a script that was written to believe them.
If your bank, shop or reward event takes an amount, item name or price from the client, an exploiter can send whatever they like. Every value that affects the economy must be decided on the server, from server-side data, not from the event arguments.
Reject anything that does not make sense: negative amounts, absurdly large transfers, or the same payout firing dozens of times a second. Sensible caps stop most automated dupes cold.
You cannot fix what you cannot see. Log big or unusually frequent money and item movements so you can spot a dupe as it happens and trace who did it.
Renaming the default framework trigger names helps too, since the standard ones are public and heavily targeted, but the underlying validation is what actually protects you.
DistortionUK audits FiveM servers for exactly these flaws and gives you the fix. The first scoping look is free.