Non-linear scenario. Your choices change the path and the ending.
Branching scenario · interactive HTML5
It's 02:14. You're on call.
A card-testing attack just lit up the payments dashboard. You are the on-call risk analyst, and the only one awake. What you do in the next twenty minutes decides how much money walks, how many real customers get hurt, and what your lead thinks of you in the morning.
ReadDiagnose the attack before you swing. The control has to match the pattern.
BalanceOver-blocking kills real revenue. Under-reacting bleeds fraud. Both cost you.
CommunicateContain first, then escalate with data. Silence and noise both burn trust.
The attacker adapts to your moves. Six possible endings. Keys 1/2/3.
Incident closed
Resolved
AIncident grade—
€0
Fraud lost
Low
Customer impact
Neutral
Leadership trust
How a strong responder runs this
Diagnose, then act. The signature (micro-auths, one BIN range, datacenter ASNs, velocity) tells you the control: rate-limit + block that BIN + those ASNs. Panic-blocking everything trades a fraud loss for a bigger revenue loss.
Don't chase IPs. A bot rotates IPs in seconds. Target the signals it cannot rotate away from, the BIN range and the velocity, or you spend the night one step behind.
Contain, then communicate. A short incident note earns trust: what happened, what you did, what you recommend. Going silent blindsides leadership. Paging everyone teaches them to tune you out.