Stolen cards do not just cost a refund. They take a real SIM out of stock and leave a chargeback behind. So the decision is made before the money moves.
An eSIM is delivered in seconds, so by the time a chargeback arrives the product is gone. The SIM is out of stock, the carrier has been billed, and the fee is ours.
Bots try thousands of stolen numbers against any checkout that will answer them.
Every fake order claims a real SIM identity that then has to be recovered by hand.
Block at the door, challenge what is uncertain, and sweep for anything that slipped through.
No single control catches everything, so each one is placed where it can still do something useful.
Every page inherits a network and country block check before it renders a thing.
Stripe Radar scores the attempt and applies our own rules — block, challenge or allow.
Scheduled sweeps look for payment patterns our own checkout could not have produced.
Abused lines are barred and quarantined, and the number is held before it returns to stock.
Everything is written down. Radar's decisions are copied back into our own database and joined to the order, so “which rule stopped this customer, and what were they buying?” is a question with an answer.
A blocked attempt costs nothing: no order, no SIM taken, no carrier call, no chargeback.
Where it is uncertain, the bank is asked to verify the cardholder instead of guessing.
Anything that paid is still checked, because a rule that has never seen a pattern cannot block it.
A small, tuned set — not a wall of rules nobody understands.
More attempts are sent to 3-D Secure than are blocked outright, so genuine customers keep a route through.
Each decision is matched to the product, price, country and language of the attempt it stopped.
Our checkout creates payments one particular way. A charge that arrives by an older route was not made by our site — so an hourly job hunts for exactly that.
● Looks back 24 hours, every hour
● Groups every suspect charge into one email, not one per charge
● CRITICAL if any of them actually succeeded
● WARNING if they all failed — card testing, no delivery risk
● Drops a charge once refunds cover it in full
● Re-alarms if a charge changes status, deliberately biased towards telling you twice rather than going quiet
To: alarms@esim.net
Status: succeeded
Action: review the orders, refund if needed
Refusing every payment of this kind also refused long-standing customers on a saved card. It now only refuses when the customer and the card are both new — the pattern that actually signals fraud.
The blocking is rules. The AI layer is for the part that used to take an analyst an afternoon: working out whether a pattern is real, and acting on it once it is.
getrelatedcustomers links accounts that share a card, a device or an address — one fraudster, many names.
addradariprange and getblockedips add or review a whole address range on the block list.
quarantineline bars an abused line and holds the number; releasefromquarantine returns it when cleared.
getspendcaps surfaces lines running up cost before the bill does.
Deliberately not automated: no AI issues a refund or blocks a payment on its own judgement. It gathers, proposes and records — a person approves anything that touches a customer's money.
Rules, decisions and 3-D Secure challenges.
Pulls rules and decisions into our own database.
Investigation and containment tools, all audited.
Hourly checks on payments that already succeeded.
● Allow rules win — a trusted customer is not blocked by a broad rule
● Never label a customer a fraudster — refunds are never filed under a fraud reason, which would mark them permanently
● Alarm twice rather than never — suppression can repeat, but cannot silence
● Blocks are reversible — ranges and quarantines have a matching remove tool
● Every action is logged — tool, input, result, and who asked