Anatomy of a scheme.
Six schemes taken apart the same way: what each needs, what it leaves in your export, what innocent thing leaves the same marks, and where it is usually caught.
Each part follows one skeleton: the preconditions a scheme needs, seen from the defender's chair; the observable pattern in an ordinary export, with a synthetic illustration; the honest alternatives that produce the same marks; where the scheme is usually caught; and a desk card. The six parts run in the order the money moves, from finding live cards to turning a balance into someone's bank account. OWASP's automated-threat names are used where they fit. Nothing here describes how a scheme is run, only how it looks to the person whose job is to notice it.
Fictional scenarios, synthetic data. All instalments available. Follow at your own pace; progress stays on this browser.
Enumeration.
Many cards, one endpoint, and a merchant whose answer is the product. What a BIN attack needs, what it leaves in your export, and what else leaves the same marks.
Begin readingTriangulation fraud.
A stolen card pays for goods that a real customer ordered from someone else. The merchant ships to an honest address and gets the dispute anyway.
Begin readingRefund fraud.
The quietest way money leaves a merchant is through the door marked customer service. What a refund scheme needs, and which column of the export nobody is watching.
Begin readingBust-out.
A merchant, or an account, that behaves well for exactly as long as it takes to be trusted. What a bust-out needs, and why the chargebacks arrive after the money has gone.
Begin readingBonus rings.
One welcome offer, forty welcomes. What a multi-accounting ring needs from an operator, what it shares in the data, and why the referral code is the loudest field in the export.
Begin readingMule cash-out.
Every scheme in this series ends at the same place: money that has to become someone's money. What a cash-out needs, who the mule is, and why the destination field is the one that connects everything.
Begin reading