https://antifrog.com/fieldnotes/library/Original fintech learning. Manually edited releases.https://antifrog.com/fieldnotes/library/affiliate-traffic-quality/https://antifrog.com/fieldnotes/library/affiliate-traffic-quality/CPA pays for an event. Revenue share pays for a relationship. The quality of an affiliate's traffic is only visible in what the cohort does after the commission has been paid.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/ato-signals-session-device-behaviour/https://antifrog.com/fieldnotes/library/ato-signals-session-device-behaviour/Session, device and behaviour each tell part of the story. A takeover is only visible where the three disagree with the customer's past.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/bin-attacks-and-enumeration/https://antifrog.com/fieldnotes/library/bin-attacks-and-enumeration/How to read an enumeration burst as a defender, what it costs the merchant and the acquirer, and what to do in the first hour that you will not regret in the second.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/bonus-abuse-and-multi-accounting/https://antifrog.com/fieldnotes/library/bonus-abuse-and-multi-accounting/A bonus is a price the operator pays for a player. Multi-accounting is the same price paid forty times for one. The evidence is in the deposits, not the sign-ups.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/case-notes-someone-can-audit/https://antifrog.com/fieldnotes/library/case-notes-someone-can-audit/A case-note template that separates what was seen from what was concluded, and survives a representment, an acquirer query or an audit.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/compelling-evidence-in-practice/https://antifrog.com/fieldnotes/library/compelling-evidence-in-practice/What Visa's Compelling Evidence 3.0 asks a merchant to hold, checked against the applicable pathway, and what matching records still do not prove.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/deposits-withdrawals-and-cash-out/https://antifrog.com/fieldnotes/library/deposits-withdrawals-and-cash-out/A deposit tells you where money came from. A withdrawal to a different method tells you where it wants to go. The closed-loop rule, its exceptions and the source-of-funds question all live in the gap between the two.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/dispute-lag-and-cohorts/https://antifrog.com/fieldnotes/library/dispute-lag-and-cohorts/Disputes land weeks after the sale they belong to. Measure by the month of sale, or the ratio you report will describe the wrong month.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/first-party-misuse/https://antifrog.com/fieldnotes/library/first-party-misuse/A fraud dispute raised by the person who made the purchase is a different problem from theft. How to tell them apart without deciding too early.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/link-analysis-from-attributes-to-rings/https://antifrog.com/fieldnotes/library/link-analysis-from-attributes-to-rings/How to move from 'these accounts share something' to 'these accounts are one operation', and how to say which is which.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/merchant-underwriting-for-psps/https://antifrog.com/fieldnotes/library/merchant-underwriting-for-psps/Underwriting is a forecast with a review date. The PSP is deciding what one merchant will do to a portfolio ratio it does not control, and which terms make that forecast safe to be wrong about.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/payment-attack-runbook/https://antifrog.com/fieldnotes/library/payment-attack-runbook/A runbook for the moment an authorisation burst appears: confirm, scope, act narrowly, write it down, and only then widen.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/reading-decline-codes/https://antifrog.com/fieldnotes/library/reading-decline-codes/A decline is a message from someone who saw something you did not. Learn who sent it, what they saw, and when a retry is a kindness and when it is a cost.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/reason-code-families/https://antifrog.com/fieldnotes/library/reason-code-families/Why the first digits of a reason code tell you what the issuer is asking, and what a reply would have to prove.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/refund-abuse-defence/https://antifrog.com/fieldnotes/library/refund-abuse-defence/Refund abuse hides inside a process that exists to keep customers happy. How to see it without punishing the customers who are simply unhappy.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/rules-you-can-explain/https://antifrog.com/fieldnotes/library/rules-you-can-explain/A four-part template for fraud rules that a colleague, an acquirer or an auditor can read, test and switch off.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/spike-detection-baselines-and-seasonality/https://antifrog.com/fieldnotes/library/spike-detection-baselines-and-seasonality/Building a baseline by weekday and hour, reading a z-score or a ratio in plain words, and keeping the denominator in the room.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/subscription-and-trial-risk/https://antifrog.com/fieldnotes/library/subscription-and-trial-risk/Subscriptions turn one risk decision into a recurring one. How to read trial abuse, rebill disputes and the cohort that tells you which is which.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/synthetic-identity-and-kyc/https://antifrog.com/fieldnotes/library/synthetic-identity-and-kyc/A KYC pass answers narrow questions about documents and data. Whether one real person sits behind the account is a different question, and it is answered over time and in company.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/three-ds-exemptions-decision/https://antifrog.com/fieldnotes/library/three-ds-exemptions-decision/A working decision frame for SCA exemptions, liability shift and the customers in between.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/threshold-tuning-with-a-cost-matrix/https://antifrog.com/fieldnotes/library/threshold-tuning-with-a-cost-matrix/How to choose where a rule fires by pricing both kinds of error, with a worked matrix you can rebuild in a spreadsheet.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/vamp-and-ecp-ratios-explained/https://antifrog.com/fieldnotes/library/vamp-and-ecp-ratios-explained/Visa's VAMP and Mastercard's ECP count different things over different months. A working guide to what moves each number.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/velocity-rules-that-age-well/https://antifrog.com/fieldnotes/library/velocity-rules-that-age-well/Count what, per what, over how long, against what number. Most velocity rules that go wrong are missing one of the four, or were written for a business that no longer exists.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/library/working-with-your-acquirer/https://antifrog.com/fieldnotes/library/working-with-your-acquirer/The five questions an acquirer puts to a PSP about a merchant near a monitoring threshold, and the records that answer them.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-01/https://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-01/Many cards, one endpoint, and a merchant whose answer is the product. What a BIN attack needs, what it leaves in your export, and what else leaves the same marks.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-02/https://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-02/A stolen card pays for goods that a real customer ordered from someone else. The merchant ships to an honest address and gets the dispute anyway.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-03/https://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-03/The quietest way money leaves a merchant is through the door marked customer service. What a refund scheme needs, and which column of the export nobody is watching.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-04/https://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-04/A merchant, or an account, that behaves well for exactly as long as it takes to be trusted. What a bust-out needs, and why the chargebacks arrive after the money has gone.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-05/https://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-05/One welcome offer, forty welcomes. What a multi-accounting ring needs from an operator, what it shares in the data, and why the referral code is the loudest field in the export.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-06/https://antifrog.com/fieldnotes/series/anatomy-of-a-scheme/anatomy-of-a-scheme-06/Every scheme in this series ends at the same place: money that has to become someone's money. What a cash-out needs, who the mule is, and why the destination field is the one that connects everything.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-01/https://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-01/A burst at Pondside Gifts looks like card testing for about ten seconds. Then the distinct-card count comes back.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-02/https://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-02/The list has been seen before, at a merchant that sells vitamins. The money there is flowing the wrong way.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-03/https://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-03/Hollow Oak had a bad batch in October and a goodwill budget to match. Most of the credits are honest. The desk has to find the ones that are not.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-04/https://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-04/The credits stop. Three weeks later the same cards appear at Lagoon Casino, deposit, barely play, and ask for a bank transfer.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-05/https://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-05/Under a 72-hour hold the desk rebuilds the timeline. One of the six bank accounts has been at Lagoon for fourteen months, and it belongs to a player called Dario.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-06/https://antifrog.com/fieldnotes/series/northbank-dossier/northbank-dossier-06/The desk closes what it can close, names what each action cost, and is left with seventeen cards and one IP address that were there before anything else.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-01/https://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-01/Week one. Observation and notes.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-02/https://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-02/Week two. Metrics and denominators.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-03/https://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-03/Week three. Disputes and schemes.Fri, 06 Nov 2026 00:00:00 GMThttps://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-04/https://antifrog.com/fieldnotes/series/thirty-days-at-the-desk/thirty-days-week-04/Week four. Operations, the acquirer, and other people.Fri, 06 Nov 2026 00:00:00 GMT