What you decide changes what the attacker does next and how the night ends.
You are on call when a card-testing attack starts at 02:14
A card-testing attack has started to light up the payments dashboard, and you are the only analyst awake. The next twenty minutes decide how much fraud gets through and how many genuine customers get blocked. They also decide what your lead thinks of your handling in the morning.
Find the pattern before you block anything, since the control has to match it.
The meters show fraud losses and customer impact side by side. A heavy block lowers the first only by raising the second.
Stop the attack first, then tell your lead what happened with numbers. Saying nothing costs trust, and so does alerting the whole company.
The night can end in six different ways, and the attacker changes tactics in response to what you do. Keys 1, 2 and 3 choose an option.
AGrade for the night
€0
Fraud losses
Low
Customer impact
Neutral
Leadership trust
How an experienced analyst handles this attack
Work out the pattern before you act. Micro-authorisations, one BIN range, datacenter ASNs and high velocity point to a rate limit plus a block on that range and those ASNs. Blocking everything in a panic swaps a fraud loss for a bigger revenue loss.
Do not chase IP addresses, since a bot rotates them in seconds. Aim at the BIN range and the velocity, which it cannot rotate away from.
Contain the attack first and then report it. A short note on what happened, what you did and what you recommend earns trust. Silence blindsides leadership, and paging everyone teaches people to tune you out.