Payments
The payment account closed ten days after launch
Situation. A small shop selling digital goods, delivered the moment a payment cleared. Ten days after real orders started, the payment provider closed its account.
What was wrong. Someone was testing stolen cards through the checkout. The shop recorded only successful payments; the rest of the evidence lived in the provider's dashboard and closed with the account.
What I found. The shop's own data was still enough to see the attack: one device behind 57 accounts in a week. A rule tested against the shop's real history would have raised the alarm four days before the last payment went through.
Read the case