Payments

The Short Life of a Stolen Card

What 18.8 million tested payment cards reveal about how fraudsters validate stolen card data, and how little time defenders actually have.

Executive Summary

Four out of five stolen payment cards are tested on a single day and never touched again. For most cards, the first sighting is the only warning anyone will ever get.

Card testing sits between a card being stolen and a card being spent. Before anyone buys anything with compromised card data, they need to know it works, so they push it through a payment endpoint and read the response. Every one of those attempts is observable, and across millions of them a consistent operating pattern emerges.

When Fraud Detection Works Too Late

The Wall Street Journal’s investigation into Polymarket, by Katherine Long, Caitlin Ostroff and Neil Mehta, is a useful case study in where fraud controls sit rather than how well any individual control performs. One detail stands out. At the peak of a February attack, according to the Journal, Polymarket’s payment processor was rejecting more than 80% of the deposits it handled as fraudulent, against an industry norm of roughly 1%. The processor appears to have been working well at the point in the stack where it had visibility. The larger problem was how much bad activity had already reached that point.