Small payments. A larger question.
Investigate a burst before widening a control.
You are reviewing a fictional digital merchant. In twelve minutes, payment attempts rise from a usual 80 to 640. Most are declined. The merchant released a checkout update this morning. Decide what to do during the next fifteen minutes.
Fictional scenario · Synthetic data · No real customer records- attempts / 12 min
- 640
- declined
- 79%
- most amounts
- €1–€3
What would
you look at?
Open at least two files before making a decision. You can read every file.
0 of 3 files opened
A useful definition01 / Transaction logPayment pattern+
512 attempts use 470 distinct card references. Those attempts come from six device references and concentrate on small amounts. The remaining 128 attempts have the merchant’s usual mix of values and returning customers.
The concentration across many cards is more informative than a low amount by itself. Device references are investigation leads, not verified identities.
02 / Engineering noteRelease & retries+
Engineering confirms a cosmetic checkout release. Server logs show no new retry loop. The repeated attempts in the concentrated group have different card references, rather than one payment being retried. These logs do not prove who initiated them.
Test an operational explanation before assuming an attack. Here, the retry hypothesis fits the evidence poorly.
03 / Customer journeyImpact & scope+
The six-device group began at 14:08. Returning customers outside it have their usual approval pattern. The incident runbook allows temporary, scoped rate limits and additional checks, with monitoring and rollback. Forty successful payments in the suspicious group still need investigation.
There is a basis for a limited response. Successful payments and legitimate customer impact both need follow-up.
Make the call.
Leave your reasoning.
Choose what you would do under this scenario’s assumptions. Your notes stay in this browser. Do not enter real customer information.
The trade-off
Still unknown
Which successful payments were authorised by their cardholders? Device attribution and actual customer outcomes are still unverified.
A useful handoff
Record the affected cohort, the control owner, the next review time and rollback criteria. Monitor legitimate completion alongside suspicious attempts.
Completion records participation, not competence or certification. You can change your answer and compare again.
Further reading
OWASP / Automated threatsReference checked 5 November 2026. The scenario, runbook and debrief are original Antifrog teaching material; the source does not endorse them.