The patient one: the attacker who holds back so as not to draw attention and the regular customer leave the same trace

How it attacks

They have two stolen cards that look clean, and they alternate between them. No single purchase, on its own, is worth a second look.

The amounts sit just above normal for that card, never close to a cap. A few purchases a day, at normal hours, at normal merchants. Sometimes one goes through without the CVC, sometimes with it, like someone in a hurry one day and calm the next.

What makes them different is that they measure themselves. They are testing the same system you have. If a purchase goes through easily, they push a little more. If something snags or they get asked for an extra check, they go quiet for a few days and come back gentler.

They do not rush. Rushing is what draws attention. The total they are after is large, but it arrives sliced into many small purchases spread across weeks.

Their whole plan is to be boring. So that each purchase, looked at alone, has nothing to it.

Who looks like it and is honest

The regular customer. They buy much the same every month: the grocery store, the pharmacy, the odd thing online. This week looks just like last month.

The one who changed jobs and now earns a bit more. They start spending a little more, steadily, with no spikes. Each purchase one step above the last, and none of them surprises.

The small business that pays for everything with the same card. Repeated expenses, mid-range amounts, several on the same day. Boring on purpose, because that is what an operating expense looks like.

All three look the way the attacker wants to look: without a single spike, without a single purchase worth a second look.

What actually separates them

• How they react to friction.
  • The regular customer: if you ask for an extra confirmation, they do it, annoyed, and move on.
  • The patient one: the moment something gets harder, they disappear for a few days and come back lower.
• Where the money comes from.
  • The regular customer: spends from one account.
  • The patient one: splits across two cards that take turns, but from the same device and at the same pace.
• How close to the line they buy.
  • The regular customer: their spending is all over the place, a bit more one month, a bit less the next, sometimes near the cap, sometimes far from it.
  • The patient one: they sit just below where you would start looking, and never drift from there.
• The CVC that goes missing now and then.
  • The regular customer: the CVC is missing when they genuinely do not have it handy, and that lands when they changed phones or are buying on a new site.
  • The patient one: it goes missing in scattered bursts, on purpose, from the same device where other times they did enter it.
• The weak signals together. Each thing they do, on its own, explains itself. What does not explain itself is that they all land on the same card, the same device and the same week.
  • The regular customer: trips a weak signal once in a while.
  • The patient one: they light up little by little, all pointing the same way.

How it mutates once you detect it

1. You raise the level where you start looking. They drop the amounts below the new one, spread them out more often and stretch the calendar, until the average stops touching the line. They reach the same total, slower.
2. You ask for an extra confirmation on a purchase. They clear it with no trouble, because they have the details, and they learn that purchase was on the edge. The next one they keep lower.
3. You block one of the cards. They carry on with the other without changing anything else. The pace is the same because the device is the same.
4. You see that both cards come from the same device. They split them onto two, one per card, and lower the frequency so neither of them looks busy.

At the end of that staircase is someone who looks like a boring customer. One thing gives them away: they react to you. Every time you move a control, they adjust. A real customer almost never does that, because almost none of them knows they have a score.

Closing

The work is in letting the regular customer buy and stopping the one who dresses up as a regular customer, when none of their purchases, looked at alone, is the least bit odd. That comes down to whether you can add up many weak signals across weeks, or only review the purchase that just came in.

So how do you solve it?

Tuning this by hand takes days, and every day costs chargebacks and good sales. That is what we are solving at Frauddi. We will show you on your own data.

Book a free demo

Next: the sleeper, the one who builds a spotless history for weeks and one day empties it all at once, and the freelancer who gets paid for a big project and catches up in three days (7 of 9).