12 min read
A Shopify seller posting as slugbutter on Reddit noticed a pattern his fraud software had missed. Single dollar items, nothing else in the cart, buyers with names that looked like random character strings, most shipping to addresses in and around Charleston, South Carolina. His catalog runs closer to fifty dollars an item. Whoever was placing these orders paid eight dollars in flat-rate shipping for a one-dollar product, sometimes two or three times a day, sometimes not for several days.
We reviewed the thread but could not independently verify the seller’s identity or store details. The pattern itself is well-documented. Mastercard describes card testing as an automated script that checks stolen card numbers to find which ones still work. The dollar purchase is the test. Once a batch of cards clears, the same numbers get used for larger purchases elsewhere, on sites the original merchant never sees.
The seller reported that the orders escaped the tools’ warnings. We cannot establish from that account why the checks did not flag them. Shopify scoring uses address verification, CVV matching, IP location and behaviour signals, then shows a risk level in the merchant dashboard. AVS matches the billing address; CVV checks the security code supplied with the transaction. Neither proves identity. Stolen credentials can still produce matching results, although other risk signals may flag the transaction. AVS began with mail and phone orders, not modern identity verification.
The orders looked wrong to the seller because the pattern made no commercial sense. The software saw valid card signals. The seller thought it was checking the buyer.
Transaction scoring and identity verification answer related questions. A merchant may assess a payment using card, device and behaviour signals, while a separate service checks an identity document or selfie. Flagged transactions can still require manual review, whose staffing cost rises with the workload.
A check that supports one decision does not settle the other. A valid billing address cannot prove that a buyer is the cardholder; a plausible credit history cannot prove that the person named in it exists.
| Platform | What it checks | What it cannot do |
|---|---|---|
| Shopify | AVS, CVV, IP location, device fingerprinting, velocity limits, network-wide scam signals | Confirms card data, not identity. Flags require human review. |
| WooCommerce | No native fraud scoring. Depends on payment gateway and plugin configuration. | Protection quality varies by store. Core platform provides no built-in transaction scoring. |
| Stripe Radar | Network-wide ML across hundreds of signals, device fingerprinting, behavioral patterns | Provider guidance for synthetic identity patterns is to require ID verification or block. Does not claim to confirm identity itself. |
Card checks depend on the gateway and store configuration. Establishing the buyer’s identity requires another layer. The shared assumption runs through the payments stack. Even Stripe’s Radar documentation directs merchants toward identity verification rather than claiming Radar can settle the question itself.
Generative tools have cut the labour needed for a convincing fraud attempt. Non-technical operators can rent fake documents, faces, voices and bot traffic. A LexisNexis report found synthetic identity fraud rose eight-fold year over year and accounted for 11% of reported frauds in its 2025 network data, covering more than 116 billion online transactions. The figures describe the provider’s dataset, not a census of all fraud.
Verification costs have fallen much more slowly. Juniper Research projected an average identity-check price of $0.20 in 2025, declining to $0.17 by 2029, a 15% decline across four years. Fuller verification flows combining document checks with liveness detection and biometric matching run between one and three dollars per verification in the market-pricing range reported for this article, with document and liveness layers pushing costs toward four dollars.
Those estimates suggest a reason to match the check to the risk, but do not measure the same service. The $0.20 average and a fuller one-to-three-dollar workflow should not be treated as interchangeable prices. Nor do these sources quantify the cost of launching an AI-assisted attack well enough to claim a tenfold fall.
The practical question is what additional evidence an expensive check buys, and whether it can detect the fraud the business faces.
The FTC reported more than $12.5 billion in consumer fraud losses in 2024, up 25% while report volume stayed flat. FTC testimony in March 2026 reported $15.9 billion in consumer-reported fraud losses for 2025. These totals cover many kinds of fraud and cannot be attributed to identity attacks alone. A Veriff fraud report found three quarters of merchants said fraud hurt their revenue, and three in four pointed to AI driven attacks as the cause.
A long history can still belong to a fabricated person
A 2019 Equifax whitepaper illustrates a different attack: building a credit identity over time. Its names are fictitious. “Helen Day” receives a credit file after an application using invented details, then gains history as an authorised user on a real cardholder’s account. After two months, she has five accounts at five institutions.
After eight months, four synthetic identities have opened 28 accounts at 13 institutions without delinquency. Over 22 months, the scheme expands to eight identities and 66 fraudulent accounts, causing $723,721 in losses across 26 creditors. Equifax describes the real cardholder collaborating with the fraudsters, rather than simply having an account stolen.
The paper also identifies warning signs: five times as many monthly credit-score checks, and address changes every 10 months for “bad” accounts against 70 for “good” ones. These are patterns in its analysis, not universal thresholds.
A Federal Reserve paper cited ID Analytics research finding that traditional identity-fraud models missed 85 to 95% of potential synthetic applicants. TransUnion research found the average charge off rate for likely synthetic identities in a lending portfolio runs under 30%, so most suspected synthetic accounts make payments on time for much of their life.
A payment history that looked creditworthy was therefore compatible with a fabricated identity. The paper’s behavioural warning signs also contradict the claim that the accounts were statistically identical to genuine customers.
Spend verification effort where it adds evidence
The industry is moving from one verification gate to several levels of checks. Returning customers with a clean history may need only a database check. A new account with unusual signals may need documents and liveness testing. Manual review is saved for the small group that clears neither level.
A full verification flow can cost several times more than a database check. Applying it to every customer wastes money and creates friction. Risk-based checks aim to spend more only when the signal justifies it. Mastercard’s research found 83% of industry leaders surveyed said AI driven fraud tools reduced false positives and customer churn, though that is a survey commissioned by Mastercard, not an independent trial.
The logic shows up at the mid market level too. Cherry Servers, a Lithuanian cloud hosting provider, moved from mostly manual checks to automated, risk weighted ones with iDenfy. The vendor’s case study reports a 65% cut in verification time and a 33% drop in fraud rate. Independent validation of tiering’s return remains scarce.
Tiering works when risk produces a signal, such as unusual speed, a mismatched device or a high-risk location. It struggles when the fraud is built to look ordinary.
Equifax launched an enhanced synthetic identity product in January 2026, followed by Credit Abuse Risk in April. Confirming creditworthiness and confirming the applicant is a real person need different tools and data. A strong credit score does not prove the person behind it is genuine, an admission from inside the credit industry that one check cannot do both jobs.
TransUnion’s H1 2025 report put total U.S. credit exposure to suspected synthetic identities at $3.3 billion, a 3% increase since end of 2023, and that is likely an undercount. Losses from synthetic identities are frequently booked internally as credit losses rather than fraud losses, since the accounts look, on paper, like normal customers who stopped paying. Fraud teams increasingly rely on lookback windows of 12 to 18 months and graph analytics mapping relationships across accounts sharing identifiers like phone numbers or device IDs. These relationship checks operate over time because synthetic identities are designed to survive a single signup decision.
This reporting found no published evidence establishing how attackers respond to the particular verification tiers described here. An incentive to avoid extra checks is plausible; its effect on these deployments remains unmeasured.
An agent needs authority as well as an identity
AI agents add a problem tiered verification was not designed to handle. Automated systems capable of independently completing logins and payments saw measured agentic traffic rise 450% between January and December 2025, according to LexisNexis. The source says this was mainly payments and logins at gaming and gambling sites, with no indication of malicious intent. It should not be read as a 450% rise in shopping fraud.
A verification system must now separate a shopping agent acting for its owner from a bot testing stolen cards. Both may show uniform timing and little human-like hesitation. Forrester’s Andras Cser points to behaviour signals such as typing rhythm and device sensors, which are harder for scripts to fake together.
Forrester’s Diane Deng argues that an agent acting for a customer must also be verified. The system now has to establish the person and the agent’s authority, a question most checkout fraud tools were never built to answer.
Fast card testing and patient credit-building are different attacks. The Equifax case does not show that AI can compress 22 months of credit history into seconds. A detection programme has to assess both transaction bursts and suspicious relationships that develop over time.
The meaning of verification is changing. A one-time gate, pass or fail at signup, made sense when identity was something to be confirmed once and trusted afterward. Continuous risk scoring re-evaluates trust at each meaningful interaction. The account that looked clean at signup can be a synthetic identity accumulating credit for eighteen months before it defaults. Or a real account taken over three transactions ago by a script no one at the company has looked at yet.
The Helen Day example leaves the payment-versus-identity distinction intact. A system needs to explain which evidence supports trust in a transaction, which supports trust in the person, and when either should be checked again.
TL;DR Tap to expand the short version
Automated attacks and synthetic identities test different weaknesses. Checking card details, a credit file and a person’s identity are separate jobs.
Shopify, Stripe and WooCommerce can validate a card. They cannot establish who is using it. Equifax’s case data shows synthetic identities building credit over 22 months before a $723,721 bust-out.
Federal Reserve research found that traditional fraud models missed 85 to 95% of potential synthetic identity applicants. Those models were checking whether an application looked normal. A patient fraudster could make it look normal for months.
FAQ
A small transaction acts as a low-cost method to confirm that a stolen card is active and functional before attempting bigger purchases. Because merchants are less likely to dispute a minor charge, this method allows thieves to verify card details while avoiding immediate detection.
No. These platforms use AVS, CVV and device signals to validate the card, not the buyer’s identity. While these tools provide fraud scoring, they don’t by themselves verify that the person making the purchase is the card’s legitimate owner.
Synthetic identities can go undetected for extended periods, sometimes spanning nearly two years, by mimicking the behavior of real customers building credit. During this time, fraudsters may open many accounts and pass standard security checks before eventually cashing out.
Tiered verification uses resources more efficiently by applying basic checks to low-risk transactions while reserving more expensive document or liveness verification for suspicious accounts. This avoids running expensive checks on every customer.
Tiered verification is often insufficient because synthetic identities and AI agents are built to appear unremarkable to standard risk signals. To counter these threats, fraud teams need deeper methods such as graph analytics and longer lookback windows to identify hidden relationships between accounts.
Recommended Reading
- Agentic checkout gap, on why the agent-verification problem this piece raises is still mostly theoretical at the checkout stage
- False order confirmations, a related failure mode where the trust gap sits downstream of purchase rather than at verification
- AI counterfeit scale, the same cost asymmetry playing out in counterfeit goods instead of stolen identities
- AI security incidents, on containment failures in systems built for a threat model that had already moved on
- AI product ratings, on how trust signals built for humans stop working once the buyer is an agent
Spotted an error? Contact the desk. Our corrections policy explains how we handle corrections and updates.