Notes from the gate
What we learn running an abuse firewall for software businesses: the attacks, the numbers, and the mistakes we made so you don't have to.
- 15 Oct 2026explainer14 min read
What Is Device Fingerprinting and How It Stops Fraud
Learn what is device fingerprinting, how it works, and why it's essential for stopping account cycling, trial abuse, and payment fraud in modern products.
- 14 Oct 2026explainer16 min read
Prevention and Detection of Fraud Playbook
Master the prevention and detection of fraud across signups, trials, and checkouts. Learn inline screening strategies to block abuse
- 13 Oct 2026explainer14 min read
Fraud Prevention and Detection: A Practical Framework
A practical guide to fraud prevention and detection for SaaS and online products, covering inline screening, review queues, abuse graphs, metrics, and tooling.
- 12 Oct 2026explainer12 min read
Retail Fraud Prevention: In-Store and Online Strategies
Master retail fraud prevention with strategies for payment abuse, returns, POS attacks, and detection signals. Protect your business
- 11 Oct 2026explainer18 min read
E-Commerce Fraud Detection Strategy
Master e-commerce fraud detection with inline screening. Learn to block abuse at signup and checkout while protecting conversion and reducing friction.
- 10 Oct 2026explainer16 min read
AML Fraud Detection: How Modern Systems Catch Dirty Money
Learn how AML fraud detection works: regulations, red flags, graph-based monitoring, and investigative workflows that cut false positives.
- 9 Oct 2026explainer15 min read
Payment Fraud Detection: A Complete Guide for SaaS Teams
Master payment fraud detection for your SaaS product. Learn techniques, architectures, metrics, and implementation guidance to stop fraud before it happens.
- 8 Oct 2026explainer14 min read
Online Banking Innovation: What It Means for Your Business
Explore how online banking innovation is reshaping digital payments and fraud control, and what it means for your product and business strategy.
- 7 Oct 2026explainer19 min read
8 Money Laundering Red Flags to Investigate
Learn 8 money laundering red flags across onboarding, behavior, and transactions, with practical investigation tips for AML and Trust & Safety teams.
- 6 Oct 2026explainer19 min read
7 Fraud Detection Case Study Examples
Explore 7 fraud detection case study examples showing how teams detect, triage, and mitigate fraud with metrics and lessons for SaaS products.
- 5 Oct 2026explainer24 min read
10 Fraud Prevention Software Options for 2026
Compare 10 fraud prevention software options for features, use cases, limitations, implementation needs, and product security decisions.
- 3 Oct 2026explainer21 min read
8 Fraud Detection Example Scenarios That Work
Explore 8 fraud detection example scenarios covering trial abuse, card testing, bot signups, login attacks, and practical responses.
- 2 Oct 2026explainer16 min read
Payment Fraud Analytics: A Practical Guide
Master payment fraud analytics with a practical guide covering signal collection, dashboards, KPIs, alerting, and gating workflows for subscription businesses.
- 1 Oct 2026explainer18 min read
Fraud Data Analysis: A Practical Guide for Product Teams
Master fraud data analysis with practical methods, feature engineering techniques, and tooling recommendations for product and analytics teams.
- 30 Sept 2026explainer16 min read
What Is Account Takeover Fraud and How It Works
What Is Account Takeover Fraud. Learn what account takeover fraud is, how attackers steal logins, common warning signs, and how SaaS teams detect and stop ATO
- 29 Sept 2026explainer21 min read
10 Buy Now Pay Later Companies Compared
Compare 10 buy now pay later companies by repayment models, merchant fit, integration paths, costs, and practical limitations.
- 28 Sept 2026explainer17 min read
Password and Fingerprint Auth Compared
Compare password and fingerprint authentication for SaaS. Analyze security tradeoffs, UX friction, attack vectors, and inline screening strategies
- 27 Sept 2026explainer14 min read
Payment Fraud Prevention: A Practical Guide for 2026
Master payment fraud prevention in 2026 with proven strategies for blocking card testing, account abuse, and checkout attacks before they cost you revenue.
- 26 Sept 2026explainer15 min read
Que Es Fraude: Modern SaaS Abuse Explained
Searching for que es fraude? Discover how modern SaaS fraud goes beyond stolen cards to include AI abuse, trial farming, and first-party policy exploitation.
- 25 Sept 2026explainer14 min read
How to Prevent Account Takeover Across Your Product
Learn how to prevent account takeover with proven defenses, MFA strategies, session controls, and a clear incident response playbook for SaaS teams.
- 24 Sept 2026explainer14 min read
Ticket Scalping Laws: A Practical Compliance Guide
Ticket scalping laws explained across U.S. states and beyond. Learn resale caps, BOTS Act rules, and compliance moves for platforms and event operators.
- 23 Sept 2026explainer17 min read
7 Gift Card Scams and How to Stop Them
Explore 7 gift card scams, real-world tactics, warning signs, and practical prevention and response steps for consumers and merchants.
- 22 Sept 2026explainer16 min read
Fraud Detection Software Explained How It Stops Abuse
Learn what fraud detection software does, how screening, rules, ML and review queues work, and how to evaluate inline solutions for trials and payments.
- 21 Sept 2026explainer21 min read
7 Best Fraud Detection Software Options in 2026
Compare the best fraud detection software for SaaS and commerce teams, with features, use cases, pros, cons, and buyer guidance.
- 20 Sept 2026explainer19 min read
What Is Synthetic Identity Fraud and How to Stop It
What is synthetic identity fraud? Learn how fake identities are built, why they evade checks, and how SaaS and payments teams detect and stop them.
- 19 Sept 2026explainer20 min read
Fraud Prevention E Commerce
Fraud prevention e commerce. A practical fraud prevention e-commerce guide for 2026. Inline checkout checks, device and payment fingerprinting, review
- 18 Sept 2026explainer14 min read
Gmail Reverse Lookup How to Investigate an Address Lawfully
Learn Gmail reverse lookup methods that work, lawful limits, and how to verify a Gmail address without violating privacy or Google policies.
- 17 Sept 2026explainer17 min read
9 Fraud Prevention Tools for Smarter Risk Decisions
Compare 9 fraud prevention tools for screening, device intelligence, bot defense, and payment risk, with integration notes and practical limitations.
- 7 Sept 2026how-to13 min read
x402 middleware fraud: screening the payer wallet in Hono
x402 middleware fraud screening in Hono: decode the payer wallet from PAYMENT-SIGNATURE, score velocity, and block bad payments before they settle on Base.
- 7 Sept 2026how-to10 min read
WorkOS AuthKit in Next.js 15: middleware, callback, and the cookie error
WorkOS AuthKit Next.js 15 setup: env vars, authkitMiddleware, the /callback route, sign-out, and the exact fix for the cookies-can-only-be-modified error.
- 7 Sept 2026explainer10 min read
Subscription fraud: stolen cards, trial churn, shared seats
Subscription fraud is three attacks with one name. How stolen-card trials, trial-to-chargeback and shared seats differ, and which event exposes each one.
- 7 Sept 2026how-to13 min read
Stripe webhook signature verification without the raw-body bug
Stripe webhook signature verification fails when a body parser rewrites the bytes. Raw-body fix for Express and Next.js, plus replay and retry handling.
- 7 Sept 2026how-to10 min read
Stripe test mode: cards, clocks, disputes, and webhooks
A working sequence for Stripe test mode: which test card fires which decline, how to land a dispute, advance a trial with a test clock, forward webhooks.
- 7 Sept 2026how-to12 min read
Stripe SetupIntent trials and the $0 auth that leaks
Save a card at trial start with a Stripe SetupIntent, charge it off-session when the trial ends, and stop the card testing a card-on-file form invites.
- 7 Sept 2026how-to13 min read
Writing Stripe Radar rules for a small SaaS
Stripe Radar rules syntax, evaluation order, and the traps that make a rule match nothing, with paste-ready block and review rules for a SaaS product.
- 7 Sept 2026how-to10 min read
Stripe metadata: link every PaymentIntent to your records
Stripe metadata is the join key between your database and Stripe. Write your ids at creation time, read them back in webhooks, and refund the right charge.
- 7 Sept 2026how-to12 min read
Stripe idempotency keys: what they dedupe and how to derive them
A Stripe idempotency key dedupes one request for 24 hours, not one order. Derive it from the attempt, handle the mismatch error, and stop double charges.
- 7 Sept 2026how-to10 min read
Turn a Stripe dispute webhook into fraud feedback
A Stripe dispute webhook that becomes fraud feedback: verify the signature, resolve the charge to a user, report the chargeback, and stop the next signup.
- 7 Sept 2026reference13 min read
Stripe decline codes, and which ones mean card testing
A lookup table of Stripe decline codes, what each means, what to show the customer, and the code mix that signals card testing rather than plain bad luck.
- 7 Sept 2026explainer10 min read
Return fraud: why the same person returns as a new account
Return fraud is an identity problem dressed as a policy problem. How wardrobing, empty-box claims and serial returners work, and how to link the repeaters.
- 7 Sept 2026how-to12 min read
Resend API from Node: verify, send, don't send twice
Wire the Resend API into Node: DNS records that verify a domain, a raw fetch send, idempotency keys so retries don't duplicate, and signed bounce webhooks.
- 7 Sept 2026explainer12 min read
Refund abuse in SaaS: write the policy first
Refund abuse in SaaS is usually a policy problem, not a detection one. How to bound a money-back guarantee and spot the same person on their second pass.
- 7 Sept 2026explainer12 min read
Real time fraud detection: what fits in 100 ms at checkout
Real time fraud detection is a latency budget plus a fail-open policy. What you can compute in under 100 ms, what belongs in a queue, and how to wire it.
- 7 Sept 2026explainer11 min read
Promo code abuse: why single-use codes don't stop it
Promo code abuse is a multi-account problem: why single-use codes, per-email limits and card gates fail, and how to link the accounts behind the farming.
- 7 Sept 2026how-to12 min read
Hono middleware: the onion model, with a screening example
How Hono middleware works: what await next() does to the response, where per-request state lives, why a Map counter lies on Workers, and safe timeouts.
- 7 Sept 2026explainer12 min read
First-party fraud: when the fraudster is your real customer
First-party fraud is your own customer abusing your product with their real name, real card, and real device. Why fraud scores miss it and what stops it.
- 7 Sept 2026explainer12 min read
Fake accounts: mostly one person, many identities
Most fake accounts are not bots. They are one person on their eleventh identity. How the three populations separate, and the queries that tell them apart.
- 7 Sept 2026how-to11 min read
Express rate limit: from the memory store to Redis
Set up an express rate limit in five lines, move the counter to Redis so it survives multiple instances, and key it on the API key instead of the raw IP.
- 7 Sept 2026how-to11 min read
Drizzle migrations on Railway Postgres, from generate to deploy
How drizzle migrations really work, where to run drizzle-kit migrate on Railway, why a redeploy skips your new SQL, and how to roll back with no down file.
- 7 Sept 2026how-to11 min read
How to detect card testing on Stripe before the PaymentIntent is created
Detect card testing on Stripe with a server-side check on the card fingerprint before you create the PaymentIntent, plus the webhook that refunds a deny.
- 7 Sept 2026how-to11 min read
Detect account takeover at login without locking users out
Detect account takeover at login with a Node risk check that steps up MFA on suspicious sign-ins and blocks only high-confidence attempts, not travelers.
- 7 Sept 2026how-to13 min read
How to add Cloudflare Turnstile to a signup form (and what it won't stop)
Add Cloudflare Turnstile to a signup form in an hour: widget modes, React render, siteverify in Node, the error codes, and the fake signups it cannot see.
- 7 Sept 2026explainer11 min read
A chargeback for fraud usually isn't: what Visa 10.4 means
A chargeback for fraud means the cardholder tapped 'I didn't authorize this.' What Visa 10.4 lets you argue, and the logging that decides it months ahead.
- 7 Sept 2026teardown9 min read
A card testing attack example: 75,000 cards, 28 days, zero sales
A card testing attack example from a public Hacker News thread: 75,000 tokens created in 28 days, no sales, no alert, and where the Radar bill comes from.
- 7 Sept 2026how-to12 min read
How to add device fingerprinting to a signup form
Add device fingerprinting to a signup form: collect a short-lived token in the browser, pass it through on the server, and prove the device key landed.
- 6 Sept 2026how-to12 min read
How to stop free trial abuse in a Next.js app
Stop free trial abuse in a Next.js app: screen the signup in an App Router route handler, collect a device token, and revoke denied accounts by webhook.
- 6 Sept 2026how-to11 min read
Handle a fraud review webhook and revoke an account
A fraud review webhook denies an account: verify the signature over the raw body, find the user, revoke idempotently, and answer 200 before the retry.
- 6 Sept 2026how-to10 min read
Express signup fraud middleware that fails open
Build Express signup fraud middleware that screens every signup in under 100 ms, fails open on timeout, and hands allow, review or block to your route.
- 5 Sept 2026explainer13 min read
Stripe chargebacks: what happens after the dispute lands
How Stripe chargebacks run from early fraud warning to lost funds, what the $15 fee covers, when evidence is worth it, and how to keep the disputer out.
- 5 Sept 2026explainer13 min read
Shopify chargebacks: what the fraud analysis saw, and what it didn't
How Shopify chargebacks work: the fee and when it comes back, which disputes you can win, what Shopify Protect covers, and how to stop the repeat offender.
- 5 Sept 2026explainer12 min read
PayPal chargebacks: what a seller can fight, and what they can't
PayPal chargebacks for software sellers: dispute vs claim vs issuer chargeback, the $15 and $20 fees, Seller Protection for intangibles, and repeat buyers.
- 5 Sept 2026explainer12 min read
Friendly fraud: why the customer disputes and how to win
Friendly fraud is a customer disputing a charge they authorized. What Visa CE 3.0 requires, which logs win a SaaS dispute, and how to stop the repeat.
- 5 Sept 2026checklist8 min read
Before you launch a free tier: the abuse checklist
Free tier abuse checklist for launch: meter expensive endpoints, capture identity keys, review before you block, fail open, and plan for the first attack.
- 5 Sept 2026explainer12 min read
Ecommerce fraud detection: match the signal to the attack
Ecommerce fraud detection is six different attacks. Name yours from the first loss, learn which signal catches it, and decide whether to build or buy it.
- 5 Sept 2026explainer13 min read
What credit card fraud detection datasets can't teach you
The public credit card fraud detection datasets model the bank's problem, not a SaaS checkout. What is in each one, and how to build the dataset you need.
- 5 Sept 2026explainer13 min read
BIN attacks: when card testers bring their own numbers
A BIN attack is card testing with generated numbers. How the Luhn check makes it cheap, why your decline codes help the attacker, and what stops it early.
- 5 Sept 2026explainer13 min read
Behavioral fraud detection: what a session can and can't prove
Behavioral fraud detection scores what a session does, not what it says. Which signals are cheap, which need a script, where behavior stops being proof.
- 3 Sept 2026explainer12 min read
x402 and the abuse problem nobody has priced in yet
x402 lets any script with a wallet pay your API per request. What the protocol does, what sellers lose without the card, and how to count abuse per wallet.
- 3 Sept 2026explainer13 min read
Velocity checks: what to count, and what to key it on
Velocity checks are counts per key per window. Which keys to use at signup, checkout, and login, why per-IP can only review, and a Redis sliding window.
- 3 Sept 2026explainer13 min read
Stripe Radar: what it catches, what it misses, what to add
What Stripe Radar screens by default, what the paid tiers add, the rules worth writing, and the signup, trial, and login abuse it structurally cannot see.
- 3 Sept 2026explainer12 min read
Free trial abuse: why blocking emails fails and what works
Free trial abuse explained from the abuser's side: why email blocklists, IP limits and card gates each fail, and how identity linking stops repeat trials.
- 3 Sept 2026explainer13 min read
Free tier abuse: how credit farming works and how to stop it
Free tier abuse explained: how scripted signups farm AI credits for resale, what each fake account costs you, and why to meter new clusters, not the door.
- 3 Sept 2026explainer13 min read
Fraud detection API options for SaaS: Radar, Sift, Fingerprint, and the self-serve gap
A fraud detection API landscape for small SaaS: what Stripe Radar, Sift, Fingerprint, Castle, hCaptcha and WorkOS Radar cover, what they cost, and the gap.
- 3 Sept 2026explainer12 min read
Disposable email domains: what a blocklist misses
Blocklists of disposable email domains catch the lazy tier and miss $1 catch-all domains and Gmail alts. Score email quality without blocking customers.
- 3 Sept 2026explainer13 min read
Device fingerprinting for fraud: what it can and can't do
How device fingerprinting works, where browsers break it, what the law requires, and why the device key lets you block card testing at ordinary amounts.
- 3 Sept 2026explainer12 min read
Chargeback fraud in SaaS: three kinds, one repeat offender
Chargeback fraud in SaaS: true fraud vs friendly fraud vs first-party abuse, Stripe fees, network thresholds, evidence that wins, and stopping repeats.
- 3 Sept 2026explainer12 min read
What is card testing? The fraud behind the $1 charges
Card testing is how criminals validate stolen cards on your checkout. How the probes work, what they cost in fees and disputes, and how to detect them.
- 3 Sept 2026explainer12 min read
Agent payments: abuse control when your customer is a bot
Agent payments break bot detection because the buyer is a bot. Use identity, reputation, velocity and price to tell paying agents from abusive scripts.
- 3 Sept 2026explainer12 min read
Account takeover detection that doesn't lock out real users
How account takeover happens at a SaaS login, which signals separate a stolen credential from a traveling customer, and why a challenge beats a block.
- 2 Sept 2026explainer13 min read
Card testing on Stripe: how the attack works and how to stop it
Card testing on Stripe explained from the attacker's side: why your checkout is the target, what declines and disputes cost, and what to change tonight.