Notes from the edge
Payments economics, edge detection, and card-testing patterns — from the Cardvera team.
-
In agentic commerce, 'is it a bot?' is the wrong question
The industry is treating cryptographically signed AI agents as the answer to bots at checkout. A signature proves who sent a request, not whether the session behind it is doing what it claims. The layer that judges conduct is still missing, and card testing lives in that gap.
-
CAPTCHA doesn't stop bots, it taxes your real customers
CAPTCHA is the reflex when automated abuse shows up. But it charges the wrong party: every real customer pays the friction continuously, while the attacker it targets pays almost nothing. The fix is a tax the bot pays and the customer never sees.
-
Card testing is a billing problem before it's a fraud problem
Everyone treats card testing as fraud to be scored. By the time your fraud tool weighs in, the network has already charged you. Here's where the money actually leaks.
-
Velocity detection alone is a trap
Rate limits feel like the answer to card testing. But every single-dimension defense names the exact thing the attacker should change next. The trap isn't that velocity is wrong — it's that it's alone.
-
Your payment gateway wasn't built to stop card testing
Merchants treat the gateway and its velocity rules as the line of defense against card testing. But the gateway is the meter the attacker is feeding. By the time traffic reaches it, the authorization is already being requested, and the network is already counting. Here's why the only place to stop the burst is in front of it.