Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
Three weeks in, the new senior analyst at Northbank Pay has learned two things: where the good mugs are kept, and which of the two dashboards is telling the truth. Ines, the risk lead, works standing up with a paper notebook. Tomas, in his second year, works from the alert queue. On Tuesday morning the queue holds one item, which Tomas has annotated with a single word and a question mark. Pondside?
Pondside Gifts sells digital gift cards, delivered by e-mail within a minute of approval. It is the kind of merchant that gets tested, and Northbank has a rule for it: more than 200 authorisation attempts in any thirty-minute window after midnight raises a flag. The flag went up at 02:31. Nobody was awake to see it, which is its own note for later.
The analyst pulls the export and lays the window out the way the desk was taught: observation first, inference second, alternative kept alive.
The export.
- Between 02:10 and 02:50, 412 authorisation attempts reached the Pondside web checkout. A quiet night carries about thirty.
- 381 were declined. 31 were approved, for gift cards between EUR 10 and EUR 20, total EUR 446.
- The attempts came from three BINs, which the desk labels B1, B2 and B3 so that nobody has to keep typing six digits. B1 alone carries 260 attempts.
- 96 distinct card numbers. Most appear more than once; the median card was tried four times. The desk refers to them by BIN and last four: B1 ···· 0427, B2 ···· 8810, and so on.
- Two device references across all 412 attempts: dev-7f3a on 377 of them, dev-c21e on 35.
- Three IP addresses, all in 203.0.113.0/24: .17, .18 and .44.
- 96 checkout e-mail addresses, every one a first name, a dot and four digits at example.com. lena.0412. marco.0891. No two alike, none seen before.
- Decline reasons: 61 per cent "do not honour", 24 per cent "insufficient funds", 9 per cent "invalid card", the rest assorted.
Two readings.
The first reading takes ten seconds. Automated attempts, cheap digital goods, the small hours: card testing. Tomas has already drafted the rule to block the three BINs and is waiting, politely, for someone senior to say yes.
The second reading takes ten minutes, and it is the distinct-card count that does it. An enumeration run walks through card numbers looking for ones that exist. The declines it produces are mostly of the "no such card" kind, and distinct cards run close to the number of attempts. Here, 412 attempts share 96 cards, and only nine per cent of the declines say the card is invalid. The other ninety-one per cent say the card is real and the issuer said no.
The inference, and the analyst writes the word inference in the margin so that it cannot be mistaken for anything else: this is not a search for cards that exist. It is a check on cards someone already holds. The question being asked of each one is not "are you there" but "are you still good".
The alternative, which Ines insists is written beneath every inference: a retry storm. A badly configured checkout can resubmit a declined payment several times without the customer touching anything, and that would also give a low distinct-card count. It does not explain two devices, three addresses in the same range, ninety-six e-mail addresses from the same mould, or the hour. The alternative is kept alive out of habit, and because habits are what the desk is for. It is not convincing.
What the 31 approvals are for is the open question. They are small. They were delivered. As of 09:40 they are unreported and undisputed. Ines, reading over the analyst's shoulder, says the thing she says most: "What does it cost if we are wrong each way?"
Block the BINs and every genuine cardholder of those issuers is interrupted at Pondside for as long as the block stands. Do nothing and the 96 cards go on being checked somewhere else, with Northbank's authorisation fees paying for the exercise. Whatever sits in between has to be scoped, owned and dated.
Tomas asks the question that will not go away for six weeks: why would anyone check a list at Pondside rather than simply use it? The analyst does not have an answer, and writes the question down, which is the next best thing.
Before next week.
Read A thousand cards, one question. and look up enumeration. If you want to test the shape of this before the next episode, the Volume 01 case Card testing takes twelve minutes.
Fictional scenario. Synthetic data. No real customer records.