Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
What the team did, and what it cost.
Ines chose the second option, with an amendment she wrote on the rule itself: 48 hours, owner Tomas, review Thursday 10:00. Over those 48 hours the 3-D Secure challenge fired 23 times on Pondside web gift-card purchases from the three BINs. Fourteen of those were, as far as anyone can tell, genuine customers. Three of them abandoned the purchase. Pondside lost perhaps EUR 95 in sales, which is small, and real, and written down.
From the three BINs the attackers sent nothing further. Which tells you something, or nothing: a rule can stop an attack, or an attack can simply have finished. On Thursday morning one of the 31 approved gift cards came back as a pre-dispute alert. Tomas added it to the cohort and retired the rule on schedule.
That left the question from last week. Why check a list at Pondside rather than use it?
The wider view.
A PSP has one thing a merchant does not: it sees the same card at more than one shop. Northbank tokenises card numbers, so the desk can ask whether a token seen at Pondside has been seen anywhere else in the portfolio without anyone handling a card number. The analyst asks it for all 96.
- 61 of the 96 cards have been seen before at Northbank. None of the 61 had ever been used at Pondside before Tuesday.
- 58 of the 61 were seen at Hollow Oak Supplements, a subscription nutraceuticals merchant at EUR 39.90 a month. The other three were at Brightwater Tickets, buying ordinary tickets on ordinary evenings, and the desk sets those aside as probable noise.
- Of the 58 cards seen at Hollow Oak, only 12 had ever paid Hollow Oak anything.
- 44 of the 58 had received money from Hollow Oak in the previous 30 days.
- The money came as standalone credits, not refunds: a credit with no original transaction referenced. 44 credits, each between EUR 85 and EUR 149, total EUR 5,870.
- 32 of those 44 cards received a credit from a merchant they had never paid.
The analyst reads the last line three times. A refund is a reversal of a payment. A credit to a card that never made a payment is something else, and it has a direction: out of Hollow Oak's settlement, on to a card someone holds.
Inference, and what it rests on.
The inference, labelled as such: the same list of cards appears at two merchants, with money flowing on to it at one and being checked at the other. Tuesday's "are you still good" starts to look like "has the money arrived". The 24 per cent of declines that said "insufficient funds" fit a list of cards that are waiting to be funded. That last part is a guess built on a guess, and the analyst draws a box around it to say so.
The alternative is stronger than last week's. Merchants issue standalone credits for honest reasons. A goodwill payment after a complaint. A reissued card, where the original transaction cannot be referenced because the number has changed. A refer-a-friend reward paid to a card. Hollow Oak sells supplements on subscription; it is exactly the kind of merchant with a goodwill budget and a support team empowered to spend it. Thirty-two credits to cards that never paid is a lot of goodwill. It is not impossible.
Tomas points out that Northbank's own refund monitoring never fired. It counts refunds against sales by merchant and by month, and Hollow Oak's ratio is unremarkable. Standalone credits sit in a different column of the export, and nobody has ever written a rule against that column. The analyst writes that down too, under a heading that says things we were not looking at.
Ines asks the cost question again. Pause the credits and Hollow Oak's support team cannot do its job for however long the pause lasts, and every honest customer waiting on a goodwill payment waits longer. Call the merchant and the merchant may be the problem, or may have a person inside who is. Say nothing and widen the search first, and the credits continue while the search runs.
"Three days of looking costs about three days of credits," Ines says. "Price it before you choose it."
Before next week.
Read The refund that was never a return. and look up refund abuse. The Volume 01 note on shared signals is the short version of why a PSP's view is different from a merchant's.
Fictional scenario. Synthetic data. No real customer records.