Playbooks
Fraud
playbooks
One attack per post: how it is built, why the usual controls miss it, and what to do about it in the order that costs least. Written for the person who has to ship the fix.
14 Articles
August 2026 Last updated
Guide
Guide
SMS Pumping: The Fraud That Bills You for Your Own OTPs
No accounts stolen, no goods shipped, no chargebacks. The loss arrives as a telecom invoice, which is why it usually runs for weeks before anyone in the fraud team hears about it…
Guide
Guide
Referral Fraud: Catching Self-Referral Before You Pay It Out
A referral programme is the one place where your fraud problem has a price list. Why email and IP checks miss the farm, and the two signals that separate a real invite from a second browser profile…
Guide
Guide
Account Sharing Detection: One Login, Too Many Devices
Multi-accounting is one device wearing many accounts. Sharing is the mirror image, and it needs the opposite query — plus a much better answer than a ban, because most of the accounts you flag are paying you…
Guide
Guide
Disposable Email Detection: Flag It, Don't Block On It
Disposable email detection is the cheapest fraud signal to add and the easiest one to over-trust. What the list actually contains, why masked-email relays land on it, and the shape we settled on after…
Guide
Guide
Risk Score Thresholds: Route on the Decision, Sort on the Score
Every integration asks the same question within ten minutes: what score should I block at? It is the wrong first question, and the sandbox proves it in five calls…
Guide
Guide
Account Takeover Prevention: A Practical Guide for 2026
A spike in successful logins should be good news. If chargebacks, support tickets, password reset volume, and user complaints rise with it, you are probably looking at account takeover, not growth.
Guide
Guide
How to Detect and Prevent Free Trial Abuse
Free trials usually fail for one boring reason: the same user keeps coming back with a new email, a fresh browser profile, and a different IP. If you're figuring out how to prevent trial abuse, start there.
Guide
Guide
How to Reduce Chargebacks Without Friction
A chargeback problem usually shows up after the real failure already happened.
Attack
Attack
Card Testing Attacks: How Bots Drain Stripe and Square Accounts in 2026
Card testing bots verify stolen cards with micro-charges before selling them. How they evade Stripe Radar, the economics ($5–$50/card), and how to stop them in under 40ms server-side.
Industry
Industry
iGaming Bonus Abuse Detection: Stopping Multi-Account Fraud in 2026
Bonus abuse, free-bet farming, and self-excluded re-registration quietly drain operator GGR. The device, ASN, and behavioral signals that catch professional bonus hunters.
Guide
Guide
How to Prevent Multi-Accounting and Fake Signups in 2026
One person, hundreds of accounts. Why IP blocking and CAPTCHAs fail against multi-accounting — and what device-layer signals actually stop fake signup abuse at scale.
Industry
Industry
OAuth Signup Fraud: Detecting Fake Google & Apple Sign-Ins
Google and Apple Sign-In feel safe — but fraudsters exploit them daily with automated account creation. How fake OAuth signups actually work and why verified email alone isn’t enough.
Industry
Industry
Ticketing Bot Detection: Stop Scalpers in 2026
Concert tickets and limited releases vanish in seconds because bots beat humans to checkout. Headless browsers, antidetect tools, residential proxies — here’s how to actually stop them.
Deep Dive
Deep Dive
Bot Detection Without CAPTCHAs: Block Bots Without Annoying Users
CAPTCHAs hurt conversion and modern AI bots solve them faster than humans. How to block bots invisibly using device and network signals — zero friction added to the user journey.