First big purchase: the attacker with a single shot and the customer who just moved leave the same trace
How it attacks
This attacker shows up with a stolen card and an identity they finished building a few hours ago. They know they get a single shot.
So they go straight for the big one. A single purchase, at the highest amount they think you will approve, on something that resells whole: a TV, a high end phone, a console.
They almost always ask for a round figure. It is easier to remember when you are juggling several cards at once.
Whatever they buy has to leave your platform and reach somewhere they can collect it without showing their face. A borrowed address, a pickup point, a house they walk away from the same day.
If you decline, they come back once with a slightly different amount, to see whether the number was the problem. Then they disappear.
New account, no history, and the largest purchase of the day right out of the gate. That is the signature.
Who looks like it and is honest
And that is exactly how three serious customers look.
The one who just moved. They opened the account a while back and barely used it. This week they buy a fridge, a mattress and a washing machine. Their first purchase with you is also the most expensive one they will make in years.
The one who has been saving. They have been eyeing the laptop for months. The day the money comes together they make a small purchase first, to confirm the card responds, and right after that they send the full amount.
The one buying a gift. They buy the TV for their father and ship it to an address where they have never received anything, in another city. They pay for delivery and ask for gift wrapping.
All three are a thin account, a high amount and no earlier pattern to compare against.
And that small purchase from the saver, looked at on its own, is the same test used to confirm a stolen card is still alive, which is the first fraud type in this series. In one case it comes before the purchase of that customer's life. In the other it comes before the card changes hands.
Blocking that case blindly costs you the largest sale of the month, and with it the customer who spent months saving to make it.
What actually separates them
- The shape of the amount. A real price carries tax, shipping and cents. The figure the attack asks for tends to come round and closed.
- The security code. The attacker often does not have it, so they avoid the step or get it wrong. The one who has been saving is holding the card.
- What happens after a decline. The honest customer retries the same thing, calls their bank and comes back. The attack returns with a different amount, hunting for one that goes through.
- When the account was built. The one who moved opened theirs years ago and left it quiet. The attack identity was finished the same day as the purchase.
- What happens the next day. The one who moved comes back for the microwave and the curtains. The attack never comes back.
A new shipping address separates nothing on its own, because the one buying a gift also ships to a house where they have never received anything. It takes several of these signals landing on the same case at once.
How it mutates once you detect it
Every decline teaches the attacker which part of their purchase looks wrong.
- You block round figures. They build the total with cents, as if it came from a price with tax and shipping.
- You block purchases without the security code. They get the code. They pay for card batches that already include it, or they ask the victim for it while posing as the bank.
- You block the large purchase on an account with no history. They buy something small first, wait a few days, and only then send the big one.
At that last step they stop looking like the attacker in a hurry and start looking like the customer who has been saving. What is left between them is time: the saver's account had been sitting there for months.
Closing
The work is in approving the fridge for the one who moved and stopping the other purchase, which on the checkout screen looks the same. That depends on what you knew about that account before it reached the payment.
So how do you solve it?
Tuning this by hand takes days, and every day costs chargebacks and good sales. That is what we are solving at Frauddi. We will show you on your own data.
Book a free demo