Catch new attack patterns before the chargebacks.
The attack started three weeks before your chargeback rate moved.
Rules and supervised models only know the fraud you already labelled. A new pattern matches no rule and appears in no training set, so you find out when the disputes settle. Fraud Drift watches the shape of ordinary behaviour per segment and flags the day it changed.
Fifteen behavioural series, one injected bot ring, detection computed live in your browser, including the chargeback rate that has not moved.
The problem
Every detector you own is trained on fraud that already cost you money.
A rules engine encodes attacks somebody wrote down after seeing them. A supervised model learns from transactions somebody labelled after the chargeback landed. Both are backward-looking by construction, and neither is wrong about that. It is just that the gap between a novel pattern starting and either one being able to see it is measured in weeks. The attacker knows this and sizes the run to fit inside it.
The insight
You cannot recognise a new attack. You can notice a population stopped looking like itself.
Recognition needs a label. Noticing does not. When a scripted ring enters an acquisition channel, it does not just add fraudulent transactions. It changes the distribution of dull, unlabelled signals nobody thinks of as fraud features. Session duration compresses because a script does not read the page. Device reuse rises because emulators are expensive. Time to first transaction collapses because the account exists to transact. Geo entropy shifts because the proxy pool is finite. Those moves are all present on day one, weeks before any dispute settles. This does not replace the supervised model, which is still the thing that adjudicates a transaction. It buys the model the weeks it needs to get labelled.
CUSUM on day-over-day percentage changes plus Bayesian Online Changepoint Detection (Adams & MacKay 2007) per behavioural signal per segment, then Benjamini-Hochberg FDR control across the whole run, then a corroboration rule: no alert unless several independent signals in the same segment changed regime within the same window.
How it works
Four steps, no data science team
Signup, session, and transaction events from your existing pipeline. No labels, no chargeback join, no model retraining. It reads the boring fields you never scored on.
Session duration, device and fingerprint reuse, time to first transaction, velocity, geo and ASN entropy, funnel timing, sliced by acquisition channel, product, geography, and payment method.
Every signal-by-segment series runs through CUSUM and BOCD. Benjamini-Hochberg then filters across the entire run, because thousands of simultaneous tests at α=0.05 produce alarms by arithmetic alone. What survives still has to be joined by other signals in the same segment before anyone hears about it.
Not "risk is elevated". The channel, the date the regime changed, which signals corroborate, and the cohort of accounts to label so your supervised model has training data before the disputes arrive.
Who it is for
The risk lead who explains last quarter to the board
Fintechs and marketplaces past the stage where one analyst can eyeball it: enough volume for distributions to be stable, enough channels for an attacker to pick a soft one, and a supervised stack already in place that keeps finding out late.
Pricing
- –Full detection engine
- –Six behavioural signals
- –Slack alerts
- –Backtest against your last incident
- –Unlimited signals and segments
- –Corroboration rules
- –Cohort export for labelling
- –Case-management webhooks
- –12-month history
- –VPC or on-prem deployment
- –Custom signals
- –SSO and audit log
- –Model-team support on tuning
Competition
What exists, and what it does not do
| Who | What they do | The gap |
|---|---|---|
| Sift | Supervised fraud scoring trained on a network-wide labelled dataset. | Strong on patterns the network has already seen and charged back. A pattern with no labels anywhere is not in the training data by definition. |
| Sardine | Device intelligence and behavioural biometrics scored per session. | Scores individuals against a threshold. A ring that keeps every session inside normal bounds is invisible per-session and obvious in aggregate. Different question, different math. |
| Unit21 | No-code rules and case management for risk operations. | Writing the rule is the step after noticing. Noticing is the part that takes weeks, and it is the part nothing in the category automates. |
| Arize / Fiddler | ML monitoring with feature-drift detection on deployed models. | Built to tell a data scientist when to retrain, not to alert an on-call risk team. Threshold-based, no multiplicity control across thousands of segment tests, no corroboration rule. It would flood the channel. |
The honest weakness: unsupervised drift tells you a distribution changed, not that fraud caused it. A marketing push into a channel changes session duration and time to first transaction too, and so does a checkout redesign. If early alerts are mostly campaigns, the risk team learns to ignore them inside a month and the product is dead. A fraud tool that cries wolf is worse than no tool. The mitigation is that precision is the roadmap rather than a feature: FDR control across every test in the run, and a hard corroboration requirement that several independent signals in the same segment moved together, since a campaign usually moves one or two and a scripted ring moves the whole behavioural profile. That will still miss slow, human-operated fraud that never changes a distribution. This is a detector for scaled attacks, and we should say so.
Market
Sold against the cost of one undetected ring, not as a line item
Mid-market fintechs and marketplaces already spend $50k to $400k a year on fraud vendors. This is an early-warning layer beside that spend, not a replacement for it. Two thousand accounts at the Team tier is $29M ARR, and a single ring caught three weeks earlier usually pays the year.