Fraud playbooks
One attack per post: how it is run, why the usual control misses it, and where the check goes. Written for the person who has to ship the fix.
Articles
How can a marketplace detect fake accounts without adding CAPTCHAs?
Detect marketplace account abuse with live visitor checks, server-verified review and safeguards for listings, messages and referral rewards.
Fake dating profiles: how the farm runs and where to stop it
One machine behind fifty verified profiles: why photo and email checks pass a profile farm, and the device-linking check that goes before the profile is shown.
Aged Accounts: Fraud That Registers Months Early
Account farms register months before they strike, so signup checks see nothing. What a farm cannot change afterwards is how those accounts were created.
Gift Card Fraud: Draining and Code Enumeration
The three gift card attacks that actually happen, why balance-check endpoints are the softest target you own, and where to put the checks without punishing real recipients.
How to Detect and Stop Web Scrapers
Why User-Agent blocking and per-IP rate limits fail against modern scrapers, which signals separate a scraper from a customer, and how to respond by cost not by block.
Click Fraud Detection and Invalid Traffic
How invalid traffic bills you for clicks no human made, why platform credits arrive late and partial, and the signals that filter it at the landing page.
Credential Stuffing Detection at the Login
Why rate limits and CAPTCHAs push credential stuffing onto residential proxies, which signals still separate a replay from a real login, and what to do.
Account Sharing Detection: One Login, Too Many Devices
Counting IPs finds households and misses resale. What separates a shared family login from a credential being sold — and how to act without banning customers.
SMS Pumping: The Fraud That Bills You for Your Own OTPs
Artificially inflated traffic bills you for messages you sent yourself. How to spot it in your own OTP metrics, and where to stop it before the send.
Referral Fraud: Catching Self-Referral Before You Pay It Out
Why email and IP checks miss modern referral farming, which signals separate a real invite from a second browser profile, and where to put the check.
Risk Score Thresholds: Route on the Decision, Sort on the Score
Why picking a number to block at is the wrong first question, what the score is actually made of, and the routing shape that survives contact with real traffic.
Disposable Email Detection: Flag It, Don't Block On It
What burner-domain lists actually catch, why masked-email relays land on them, and how to use the signal without refusing real customers.
How to Detect and Prevent Free Trial Abuse
Detect free trial abuse at signup: the four signal layers that separate a serial abuser from a real customer, in the order you should apply them.
Account Takeover Prevention: Lookup, Evaluate, Then Compare
Evaluate after the account lookup and before the hash compare: the only point where linked_accounts exists and no bcrypt round has been spent.
Card Testing Attacks: How Bots Drain Stripe Accounts in 2026
Card testing bots verify stolen cards with micro-charges before selling them. Learn how they evade Stripe Radar and how to stop them in under 150ms server-side.
iGaming Bonus Abuse Detection: Stopping Multi-Account Fraud in 2026
Bonus abuse and free-bet farming cost iGaming operators 4–7% of GGR. The device, ASN, and behavioral signals that catch professional bonus hunters in 2026.
Tor Exit Node Detection in Real Time
Match the address your edge saw against the Tor Project's observed exit list, refreshed hourly, and step up on account routes instead of blocking reads.
Ticketing Bot Detection: Stop Scalpers in 2026
Sneaker drops, concert tickets, and limited releases vanish in seconds because bots beat humans to checkout. Here's how to actually stop them.
How to Prevent Multi-Accounting and Fake Signups in 2026
One person, hundreds of accounts. Why IP blocking and CAPTCHAs fail against multi-accounting — and what actually stops fake signup abuse.
OAuth Signup Fraud: Detecting Fake Google & Apple Sign-Ins
Google and Apple Sign-In feel safe — but fraudsters exploit them daily. How fake OAuth signups actually work and why verified email isn't enough.
How to Detect Residential Proxies in 2026
A rotating pool gives every attempt a fresh address, never a fresh machine: detect residential proxies on device continuity, clock and velocity, not the IP.
Bot Detection Without CAPTCHAs: A 2026 Guide
A solved CAPTCHA proves a token was bought, not a person: run the bot check on the server, on the POST, reading automation, network and device signals.
The VPN, proxy and bot patterns we saw this month
One email a month with what changed in the traffic we check — new VPN and proxy networks, new bot tooling, what our lab runs turned up. Written for engineers. Unsubscribe in one click.