Bots are testing stolen cards through your checkout.
Fraudsters fire thousands of tiny payment attempts to learn which stolen card numbers still work. Your processor sees the declines — and quietly downgrades your account for them.
Does this sound like you?
If even a couple of these feel familiar, it’s probably already happening on your platform.
A sudden flood of small, failing payment attempts you never planned for.
What it means: Your checkout is being used as a free card-validity tester.
Your decline rate jumped with no change to your product or pricing.
What it means: The new traffic is declines by design — that's the whole point.
Your payment processor has warned you about your authorization ratio.
What it means: Their risk model now treats your store as a liability.
Most of the failing attempts arrive and disappear within minutes.
What it means: It's scripted, and gone before a human could react.
How the attack actually works
No security background needed — here’s the whole play, start to finish.
The list
A ring buys a breached card list and finds the live ones on your checkout — one small attempt at a time, or zero-amount card setups that never reach a statement.
The hit
Each approval marks a card in the list as live — worth using, or worth selling on at a premium.
The fallout
Your decline rate climbs, issuers start scoring your checkout as risky, and your risk tier slips — long before any chargeback lands.
How SignalGate stops it
One call on your critical path. The verdict comes back before anything happens.
Per-device attempt velocity
Recognizes the burst signature of automated card-testing the moment it starts — long before per-IP rate limits would ever trigger.
Headless / automation detection
The tell-tale inconsistencies of an automated browser surface headless Chromium and remote-controlled stacks in real time — the seams that a scripted stack can't hide.
Mass-decline pattern detection
Recognizes the behavioral signature of a card-testing run against your own traffic and shuts it down automatically.
Fingerprinting catches one device pretending to be many. SignalGate catches the opposite — many genuinely different devices working as one operation — the fraud that device fingerprinting alone was never built to see.
Wire it in, in minutes
Start with two fire-and-forget calls to /v0/log — log the action and the target action. No blocking, no user impact, nothing on your critical path.
Log payment attempts and successes
from datetime import datetime, timezone
from signalgate import Client, Event, EncryptedPayload
client = Client(api_key="pk_live_...")
def sg_event(body: dict, method: str) -> Event:
# Each request carries its OWN "signalgate" envelope from the browser SDK
return Event(
user_id=body["user_id"],
ip=request.headers.get("X-Forwarded-For", request.remote_addr),
method=method,
timestamp=datetime.now(timezone.utc).isoformat(),
payload=EncryptedPayload(**body["signalgate"]),
)
@app.post("/api/payments/attempt")
def payment_attempt():
body = request.get_json()
# ...your charge logic (gateway call, decline handling)...
client.log(sg_event(body, method="payment.attempt")) # AFTER the attempt is processed
return {"ok": True}
@app.post("/api/payments/succeeded")
def payment_succeeded():
body = request.get_json()
# ...your approved-payment logic...
client.log(sg_event(body, method="payment.attempt_succeeded")) # its own fresh envelope
return {"ok": True}Within days the dashboard shows how much of your traffic is one coordinated operation — before you turn on blocking.
Stop fraud before it reaches your backend.
Free for everyone through 2026. Two lines of code. No demo required.