How it works
Once a card or its details are confirmed live, the fraudster spends as much as possible before the cardholder notices or the issuer blocks it. Spending concentrates on goods that are easy to resell, such as electronics, gift cards, airtime, fuel and digital goods, or on cash withdrawals at ATMs.
Bursts happen card-present, with a stolen physical card or a cloned magnetic stripe, and card-not-present, with details captured online. Both often follow a single compromise event, such as a skimming device at an ATM or a breach at an online merchant, so many cards with a common point of purchase burst within days of each other.
Rules on per-transaction value miss bursts made of many mid-sized purchases, each normal on its own. The tell is the change against the cardholder's own pattern: new merchant categories, new geographies, card-present use in two distant places, and a pace of spending the card has never shown.
Red flags
- Several transactions at different merchants within minutes, out of line with the cardholder's habits
- Purchases of resalable goods, gift cards, airtime or prepaid vouchers on a card that rarely buys them
- Card-present transactions in locations too far apart to be reached in the time between them
- ATM withdrawals at the daily limit on consecutive days, or at hours the cardholder does not normally transact
- Spending on a card recently used at a merchant or ATM linked to other compromised cards
Signals the engine evaluates
- Transaction count, value and merchant diversity per card in short windows, against the cardholder's baseline
- Novelty of merchant category and geography for the card
- Travel feasibility between consecutive card-present transactions
- Earlier merchants or ATMs shared by cards with confirmed fraud, pointing to a common point of compromise
Investigation and response
- 01Decline or hold further transactions and contact the cardholder through a verified channel to confirm the activity.
- 02Block and reissue the card, and raise chargebacks on disputed transactions where scheme rules allow.
- 03Search for other cards that share the same point of compromise and assess them for proactive reissue.
- 04Report the compromise point to the card scheme or acquirer, and to law enforcement where losses or signs of organized activity justify it.