Bots are testing stolen cards through your checkout.
Fraudsters fire thousands of tiny payment attempts to learn which stolen card numbers still work. Your processor sees the declines — and quietly downgrades your account for them.
Does this sound like you?
If even a couple of these feel familiar, it’s probably already happening on your platform.
A sudden flood of small, failing payment attempts you never planned for.
What it means: Your checkout is being used as a free card-validity tester.
Your decline rate jumped with no change to your product or pricing.
What it means: The new traffic is declines by design — that's the whole point.
Your payment processor has warned you about your authorization ratio.
What it means: Their risk model now treats your store as a liability.
Most of the failing attempts arrive and disappear within minutes.
What it means: It's scripted, and gone before a human could react.
How the attack actually works
No security background needed — here’s the whole play, start to finish.
The sweep
A bot walks through ranges of card numbers, one low-value attempt at a time.
The hit
Each approval tells the attacker a card — and its CVV — is live and worth selling on.
The fallout
Your decline rate climbs, processor fees rise, and your risk tier slips — long before any chargeback lands.
How SignalGate stops it
One call on your critical path. The verdict comes back before anything happens.
Per-device attempt velocity
Recognizes the burst signature of automated card-testing the moment it starts — long before per-IP rate limits would ever trigger.
Headless / automation detection
The tell-tale inconsistencies of an automated browser surface headless Chromium and remote-controlled stacks in real time — the seams that a scripted stack can't hide.
Mass-decline pattern detection
Recognizes the behavioral signature of a card-testing run against your own traffic and shuts it down automatically.
Fingerprinting catches one device pretending to be many. SignalGate catches the opposite — many genuinely different devices working as one operation — the fraud that device fingerprinting alone was never built to see.
Wire it in, in minutes
Start with two fire-and-forget calls to /v0/log — log the action and the target action. No blocking, no user impact, nothing on your critical path.
Log payment attempts and successes
from datetime import datetime, timezone
from signalgate import Client, Event, EncryptedPayload
client = Client(api_key="pk_live_...")
def sg_event(body: dict, method: str) -> Event:
# Each request carries its OWN "signalgate" envelope from the browser SDK
return Event(
user_id=body["user_id"],
ip=request.headers.get("X-Forwarded-For", request.remote_addr),
method=method,
timestamp=datetime.now(timezone.utc).isoformat(),
payload=EncryptedPayload(**body["signalgate"]),
)
@app.post("/api/payments/attempt")
def payment_attempt():
body = request.get_json()
# ...your charge logic (gateway call, decline handling)...
client.log(sg_event(body, method="payment.attempt")) # AFTER the attempt is processed
return {"ok": True}
@app.post("/api/payments/succeeded")
def payment_succeeded():
body = request.get_json()
# ...your approved-payment logic...
client.log(sg_event(body, method="payment.attempt_succeeded")) # its own fresh envelope
return {"ok": True}Within days the dashboard shows how much of your traffic is one coordinated operation — before you turn on blocking.
Stop fraud before it reaches your backend.
Free for everyone through 2026. Two lines of code. No demo required.