When a viral launch brings fraud with it: reading the warning signs
A surge of sales from one source can hide card testing and stolen cards. Spot the signs in your analytics early, because chargebacks arrive weeks later.
The video did something it has never done before, and by mid-afternoon your phone is buzzing at a rate you have only imagined. This is the good day. Nobody wants to spend it squinting at a payments dashboard looking for problems. But somewhere in a surge like this there is often a small pattern that has nothing to do with your product, and the cost of it will not arrive today. It will arrive in five weeks, as a set of disputes, at which point the money has already been spent and the excitement has long since worn off.
Two different problems wearing the same clothes
The first is card testing. Somebody with a list of stolen card numbers needs a cheap, instant, low-friction purchase to find out which of them still work. A $5 digital download from a creator with no fraud rules is close to ideal. You see a burst of attempts, many of them declining, some succeeding, often with odd email addresses and a rhythm no human buying pattern has. The purchases themselves are almost incidental to the attacker; you are being used as a validator.
The second is straightforward stolen-card spending, which is far harder to spot because it looks exactly like a sale. One purchase, sensible amount, plausible email. Nothing about it stands out on the day. The real cardholder notices in a fortnight, disputes it, and you lose the sale, pay a fee and have no defence, because they genuinely did not buy anything.
The honestly difficult bit is that both of these look most like fraud precisely when your business is doing best. A hundred sales in an hour from a video is normal on the day a video works. So the question is never "is this volume suspicious" — it is "does this volume behave like people". Analytics with traffic source per product is the tool for that question, because it lets you compare the shape of one wave against the shape of your ordinary weeks.
A sales counter, or a pattern
Most creators watch a single number on launch day, and the number only ever goes up, which makes it a poor early-warning system. What you want is the composition behind it.
| Watching one total | Watching the composition |
|---|---|
| Revenue for the day, with no idea what it is made of | Views, buyers and revenue per product, so a spike on the cheapest item stands out |
| No sense of where the surge came from | Traffic source alongside each product, so one bad referrer is visible as a cluster |
| Buyers are anonymous rows you never look at again | The customer list builds itself from every purchase, so odd sign-up patterns are inspectable |
| No baseline, so nothing can look abnormal | Your own previous months are right there to compare the shape against |
| Fraud is discovered when the disputes land | Fraud is suspected while you can still change something about the product |
What to do while the wave is still breaking
None of this needs to ruin your launch day. It is one fifteen-minute check somewhere in the middle of it, and a couple of decisions if something looks wrong.
- 1Look at your Stripe dashboard's decline rate for the day, not just the successes. A normal launch has some declines. A wall of them, clustered in minutes, is the signature of card testing.
- 2In your store.fan analytics, check which product the surge is landing on. Genuine viral traffic usually spreads across your page; card testing concentrates on the single cheapest paid item.
- 3Check the traffic source. Real attention from one video shows the source you would expect. A cluster from somewhere you have never posted deserves a second look.
- 4Scan the newest entries in your customer list. Sequential-looking email addresses, near-identical names, or many sign-ups within the same minute are worth pausing on.
- 5Review your Stripe Radar settings. Radar applies risk rules to payments on your account by default, and knowing what it is blocking, and what you have allowed, matters more on a big day than on a quiet one.
- 6If a specific cheap product is being used as a testing ground, unpublish it for a few hours in your dashboard. You lose a handful of genuine sales and remove the target entirely.
- 7Refund anything you are reasonably confident is fraudulent as soon as you spot it. A refund you issue costs you the sale; a dispute costs you the sale plus a fee plus a mark against your account.
- 8Write down what you saw and what you did. In five weeks, when disputes arrive, that note is the beginning of your response.
- Many attempts in minutes, mostly declining, all on the same low-priced product.
- A run of purchases where the buyer never opens the download or the order page afterwards.
- Email addresses that follow a pattern rather than looking like people.
- Billing details and purchase behaviour that do not sit sensibly together, such as a burst of orders in the small hours from a region you have never sold to before.
- A free lead magnet collecting hundreds of addresses in an hour with no matching rise in page views.
How a good day turns into a mixed month
Suppose a video sends 40,000 people to your page and you take 620 sales in two days, mostly a $12 preset pack. It reads as a spectacular week. Say twelve of those sales were made with stolen cards. Nothing on the day distinguishes them. Five weeks later a dozen disputes arrive, each carrying a fee that dwarfs the $12, and the fees plus the reversed sales come out of a month that felt like it had already been banked.
The lesson is not that viral launches are dangerous. It is that launch-day revenue is provisional, and treating it as final is how creators end up short. Leave a portion of a surge untouched for six weeks. Keep watching your customer list for the buyers who never came back, because that is often what fraudulent purchases look like in hindsight, and let the good days settle before you count them.
Selling from a link that goes to a checkout you cannot see the shape of? Move to a storefront that reports buyers and traffic source per product.
Start your storeThe mistake most people make
The mistake is refusing to look, because looking might spoil the day. It is an understandable instinct and an expensive one, since every hour a card-testing run continues adds attempts, declines and eventual disputes to your account. Processors watch dispute ratios, and a bad enough stretch puts your ability to take payments at risk, which is a far worse outcome than losing a few sales to a paused product. Fifteen minutes on launch afternoon is a small price. If you want the numbers behind that risk, the chargeback ratio guide explains where the thresholds bite.
If you are reasonably confident it is fraud, yes. A refund closes the matter with the loss of one sale. A dispute costs the sale, adds a fee and counts toward the ratio your processor monitors. Where you are unsure, contacting the buyer first is worth doing — genuine buyers reply, and the pattern that does not reply tells you something.
They can, in a different way: no card is involved, so the target is your email list rather than your revenue. Watch for a surge of sign-ups with no matching rise in page views. It is rarely urgent, but it does corrupt your list, and cleaning it is easier before you send anything.
Radar applies risk rules to payments on your account and blocks a meaningful share of clear fraud without you doing anything. It is not a guarantee, and it cannot know what is unusual for your particular store. Treat it as the first line, and your own knowledge of your normal patterns as the second.
Rarely the whole store. Card testing tends to concentrate on one cheap product, and unpublishing that single product for a few hours removes the target while everything else keeps selling. Reserve wider action for a situation that genuinely spreads across your page.
A launch that works is worth having, and it is worth protecting. The protection is not paranoia, it is one habit: look at what the volume is made of, not only how big it is. Do that once during the surge and once a month afterwards, and the fraud that reaches you will be the small residue rather than the story. You can see how analytics and the customer list fit together across the plans on pricing.
Put your products, your buyers and your traffic sources in one dashboard so a strange pattern is visible on the day it happens.
Open your storeTurn your knowledge into income
Launch your Store.Fan in minutes — sell digital products, courses, and calls straight from your bio. Free to start.
