cardvera
Request access →
Technology

No single signal is enough. Seven that learn from each other are.

Cardvera decides in under 15 ms by combining six independent detection layers across the browser and the edge — then closes the loop with an adaptive backstop that learns from what actually happened to each transaction.

01 — Request lifecycle

Where each layer fires.

One checkout request, start to finish: signals gathered in the browser, a verdict at the edge in single-digit milliseconds, a conditional silent challenge, a server-to-server pull before the card is charged — and the disposition flowing back to sharpen the next decision.

Browser SDK
signals collected
Cardvera edge
verdict · <15ms
Step-up
silent proof-of-work
Your backend
Gateway
authorize
blocked 0
rules learned 0
Inbound Card testing Step-up Gateway decline Approve / decline → edge
02 — Defense in depth

Six independent layers — and each one's blind spot.

No layer is perfect on its own; we say so. Each one narrows the field and hands the rest to the next — which is exactly why beating one or two gets you nowhere.

01

Network intelligence

Edge

Datacenter origins (AWS, GCP, DigitalOcean), residential-proxy networks, and IPs carrying prior abuse history — the rented infrastructure card testing runs on.

HowEach source IP is scored against reputation data and datacenter/ASN ranges at the edge, before anything else runs.
Blind spotClean residential proxies exist — so the network signal narrows the field, it doesn't decide alone.
02

Browser environment

Client

Headless browsers, Puppeteer / Playwright / Selenium automation, tampered runtimes, and spoofed or physically impossible device fingerprints.

HowThe SDK probes hundreds of runtime properties that automation frameworks and headless engines can't fully fake.
Blind spotA patched, fully-headed browser can pass — which is why environment is corroborated by how the session behaves.
03

Behavioral analysis UBA

Client

Robotic cursor paths and missing micro-corrections, instant paste, uniform inter-key timing, ghost clicks, and sub-human form-completion times.

HowMouse, keystroke, and timing telemetry are summarized locally and scored against human-interaction baselines.
Blind spotMotion can be replayed from real humans — which is where session consistency and velocity catch the reuse.
04

Session consistency

Edge

Scripted replays, token reuse across browsers, session hijacking, and signals that don't hang together across a single session.

HowEvery signal in a session is cross-checked for internal consistency and against the issued session token.
Blind spotA fresh, self-consistent session per attempt evades reuse checks — which velocity windows are built to see.
05

Velocity windows

Edge

High-velocity probing on shared BIN prefixes, low-amount enumeration, and coordinated bursts across cards, IPs, and devices.

HowSliding-window counters track attempt rates across BIN, IP, device, and merchant dimensions at once.
Blind spotA slow, distributed attack stays under thresholds — so the step-up makes even slow attacks pay.
06

Proof-of-work step-up

Step-up

Bot farms operating at scale — a silent background challenge that's free for one real customer but a real CPU cost per attempt for a farm running thousands.

HowAmbiguous sessions get a silent browser proof-of-work; humans never notice it, attackers pay it thousands of times over.
Blind spotA patient attacker can pay the compute — at which point the only thing left is what actually happened to the transaction.
03 — The adaptive backstop

When the perfect bot emerges, the loop closes.

The six real-time layers exist to make a bad first attempt rare. The feedback loop guarantees the second one fails: ground truth — what actually happened to the transaction — becomes the next block rule.

We ingest each transaction's real disposition and mine it for confirmed-bad patterns. A mimic that slips through once trains the edge to stop the next one — automatically, without a human writing a rule.

Verdict Transaction Disposition New block rule

Gateway signals

Auth declines, $0-auth outcomes, and decline-reason codes — the earliest tells that a tested card was never going to settle.

Settlement & refunds

What actually captured and shipped vs. what was immediately refunded — separating real orders from test traffic.

Chargebacks & representments

Confirmed fraud disputes, weeks later, that retroactively label a pattern as bad and feed the rule engine.

Merchant labels

Your own confirmed-fraud and confirmed-good flags, weighted highest — the model adapts to your traffic, not a generic baseline.

04 — The economics

Why beating all seven isn't worth it.

Card testing is a volume business with thin margins per card. Our job isn't to be unbeatable — it's to make beating us cost more than it returns.

The layers are independent, so an attacker has to defeat all six simultaneously on every attempt. The moment one succeeds, its transaction resolves — and the feedback loop turns that success into a rule that closes the gap. The attacker isn't fighting a fixed target; they're fighting one that rewrites itself from their own failures. Against thin per-card economics, that's a losing trade.

05 — Architecture & privacy

Built at the edge. Blind to the card.

Edge-native

Verdicts render at the edge in under 15 ms — in front of your gateway, never adding a round-trip to checkout.

No PII, no PANs

The browser library never reads card fields. We classify on behavior, network, and BIN prefixes — full card data stays between you and your gateway.

Gateway-agnostic

A simple allow / step-up / block verdict. Call Stripe, Adyen, Checkout.com, or anything else after.

SOC 2 in progress

Type II underway. Single-use, short-lived verdicts; secrets never leave your tenant.

06 — Integration

One script tag. One verdict call.

Drop the SDK on checkout, pull the verdict server-side before you charge. Median time-to-first-block in private beta has been under an hour.

<!-- 1. On the checkout page -->
<script src="https://edge.cardvera.io/v1/cv.js"></script>

// 2. Server-side, before you authorize the card
const verdict = await cardvera.getVerdict(sessionId);
if (verdict.action === "block") return reject();
if (verdict.action === "step_up") return challenge();
// otherwise → charge the card

Stop card testing before it's an authorization.