How these attacks
are actually built

Stolen cards routed through residential proxies arrive from a real consumer ISP near the billing address. IP reputation is clean, AVS matches, geolocation agrees — and the disputes land six weeks later.

A signup bonus is a published price for a fake account. Antidetect browser, residential proxy, catch-all email, scripted fill — each layer defeats one control, and together they leave nothing for a rules engine to count.

A new email, a new IP, a cleared browser, and the fourteen days start again. Every trial is individually unremarkable, which is exactly why the cohort never shows up in a per-account check.

Hundreds of plausible backers, no shared card, email or address. What they share is infrastructure — and the payout usually clears before the disputes arrive.

Rented identities pass onboarding truthfully, and an antidetect profile per account means the fingerprints never repeat. A fully compliant KYC process is not an obstacle to this attack.

Direct API calls, one residential IP per session, solved CAPTCHAs at a fraction of a cent. Every control aimed at the bots lands hardest on your customers, who are the ones least able to pay the toll.