# The sleeper: the attacker who builds a spotless history and the freelancer who just got paid leave the same trace An attacker who holds back and watches their own risk, and a mid-range customer who buys much the same every month, leave the same trace: nothing but normal purchases, none that stands out on its own. What actually separates them, and how the attack mutates once you block it. 2026-09-07 · https://frauddi.com/en/blog/el-durmiente/ --- ## How it attacks They have a stolen card that looks clean, and they decide not to use it yet for what they actually want. For weeks they buy groceries, petrol, a cheap dinner. Always with the CVC. Always clearing the bank check when it is asked for. Paying on time whatever needs paying. Every purchase of theirs, in those weeks, is one you would approve without a second thought. What they are doing is building you a history. They want your system to look at that card and see a customer with age, with habits, with a quiet average. So that the day a different purchase arrives, your system compares it against that past and lets it through. They pick the day. It might be after ten days or after a month. And on that day they take everything they can in a few hours: several large purchases in a row, the same card, the same device as always. Then they vanish. They never try anything with that card again, because they already took what they came for. ## Who looks like it and is honest The freelancer who just got paid for a project. Two or three weeks buying almost nothing, because there was nothing to buy with. The payment lands and in three days they catch up on everything: rent, the groceries they put off, the bills, a meal out. Then back to silence until the next invoice clears. The one buying the appliance they had been planning. Months of small purchases and one large purchase the day they had the money together. The card has been behaving for a long time because the customer is real. The one going on a trip. Normal weeks, and suddenly three days of flights, hotel and restaurants, all at once and all expensive. Then back to the usual routine. All three have the same shape: a long calm, a short spike, and silence again. ## What actually separates them - What gets bought on spike day. - The freelancer: pays for things that were pending, and it shows in the kind of merchant: rent, the supermarket, the month's bills. - The sleeper: buys what resells, and all of it on the same day. - What happens after the spike. - The freelancer: slows down, but keeps showing up: a coffee, the pharmacy, transport. - The sleeper: cuts off dead. The card that bought something every week stops existing overnight. - Where the quiet purchases come from. - The freelancer: buys from where they live, and their merchants sit close to one another. - The sleeper: their small purchases land at merchants that never add up to a routine: no neighbourhood, no time of day, never the same place twice. - How much the spike resembles the calm. - The freelancer: on spike day they buy at the same places they bought at before, just more often. - The sleeper: on spike day they turn up at merchants that card had never visited. - How flawless the calm was. - The freelancer: in those lean weeks something got declined for funds, a cart was abandoned, something was mistyped. - The sleeper: their quiet weeks come out without a single stumble, with the CVC and the check cleared on every one. - What the spike has to do with the calendar. - The freelancer: their spike falls when they get paid, and that repeats with a certain rhythm month to month. - The sleeper: their spike falls on the day they chose, with nothing around it to explain it. ## How it mutates once you detect it - You stop the large purchase that breaks with their history. They slice the spike into several mid-range purchases across the day, each one close enough to what they had been doing. - You look at how much a day's spending rises against the previous weeks. They stretch the spike over two or three days, so the rise gets spread out. - You ask for verification on spike-day purchases. They clear them, because they have the details. What they do afterwards is bring the spike forward: the shorter the calm, the less of your history they have to spend. - You start looking at the calm instead of the spike. They stretch the quiet weeks and add variety to them: repeated merchants, a steadier time of day, the odd purchase failed on purpose. - You flag the card that goes dark right after spending hard. They leave small purchases trickling for a few more days, so the card does not die on spike day. That last step is the expensive one for them, because it forces them to hold the disguise after they have already cashed out. Every day they keep buying to cover themselves is another day you can tie them to what they already took. ## Closing The awkward thing about the sleeper is that the visible part is the good part. The weeks you would use to trust that card are the weeks they paid for so you would trust it. The decision on spike day comes down to whether your system reads that history as backing or as something to be looked at too. ### So how do you solve it? Tuning this by hand takes days, and every day costs chargebacks and good sales. That is what we are solving at Frauddi. We will show you on your own data. Next: synthetic identity, the customer who never existed and behaved well for weeks, and the genuinely new customer who also starts small (8 of 9). Written by Elio Rincón, founder of Frauddi. He writes about AI, security and fraud at e1i0.com.