8 fraud orders hit my store overnight

Thursday morning I woke up to 8 orders that looked great. New customers. Real products. $1,916 sitting there.

All of it was stolen cards.

Here is what gave them away. Instead of judging each order on its own, I had AI pull every order from the last 24 hours with the risk data attached and tell me what repeated.

Four things repeated:

1. Three different "customers" ordering from the exact same IP address.
2. Two different names shipping to the exact same house.
3. Brand new email addresses, all from the same free provider, all built the same way. First name, last name, four numbers.
4. One order that tried 5 different cards in 6 attempts before one went through.

Any one of those looks like nothing. All four together is a ring.

We cancelled and refunded all 8 before a single thing shipped. That part matters. A refunded order cannot come back as a chargeback. A shipped order becomes a chargeback plus a lost product plus a fee.

Then I did the part most people skip. I wrote the fingerprints down.

Emails, address fragments, IP addresses, all into one file. Now a script runs every 10 minutes, checks every new order against that list, and cancels and refunds a match before anyone on my team touches it. Anything that looks suspicious but is not on the list just emails me. It never cancels on its own.

I tested it against that Thursday before turning it on. It caught all 8 and flagged zero good orders out of the 42 that came through.

Here is the part you can copy today.

Stop looking at fraud one order at a time. Your fraud tool scores each order alone, so a ring splits into 8 orders that each look fine by themselves. Pull a full day of orders into AI as one batch and ask it what repeats. Repetition is the signal. Same IP, same address, same email shape, same card testing behavior.

Then write down what you find. A fraudster you caught but never recorded is a fraudster who comes back next week under a new name.