https://portreeve.com/blog Notes on abuse, fraud, and the gate: what Portreeve sees screening signups, trials, checkouts, and logins for software businesses. en https://portreeve.com/blog/x402-middleware-fraud https://portreeve.com/blog/x402-middleware-fraud x402 middleware fraud screening in Hono: decode the payer wallet from PAYMENT-SIGNATURE, score velocity, and block bad payments before they settle on Base. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/workos-authkit-next-js https://portreeve.com/blog/workos-authkit-next-js WorkOS AuthKit Next.js 15 setup: env vars, authkitMiddleware, the /callback route, sign-out, and the exact fix for the cookies-can-only-be-modified error. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/subscription-fraud https://portreeve.com/blog/subscription-fraud Subscription fraud is three attacks with one name. How stolen-card trials, trial-to-chargeback and shared seats differ, and which event exposes each one. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-webhook-signature-verification https://portreeve.com/blog/stripe-webhook-signature-verification Stripe webhook signature verification fails when a body parser rewrites the bytes. Raw-body fix for Express and Next.js, plus replay and retry handling. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-test-mode https://portreeve.com/blog/stripe-test-mode A working sequence for Stripe test mode: which test card fires which decline, how to land a dispute, advance a trial with a test clock, forward webhooks. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-setupintent https://portreeve.com/blog/stripe-setupintent Save a card at trial start with a Stripe SetupIntent, charge it off-session when the trial ends, and stop the card testing a card-on-file form invites. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-radar-rules https://portreeve.com/blog/stripe-radar-rules Stripe Radar rules syntax, evaluation order, and the traps that make a rule match nothing, with paste-ready block and review rules for a SaaS product. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-metadata https://portreeve.com/blog/stripe-metadata Stripe metadata is the join key between your database and Stripe. Write your ids at creation time, read them back in webhooks, and refund the right charge. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-idempotency-key https://portreeve.com/blog/stripe-idempotency-key A Stripe idempotency key dedupes one request for 24 hours, not one order. Derive it from the attempt, handle the mismatch error, and stop double charges. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-dispute-webhook-fraud-feedback https://portreeve.com/blog/stripe-dispute-webhook-fraud-feedback A Stripe dispute webhook that becomes fraud feedback: verify the signature, resolve the charge to a user, report the chargeback, and stop the next signup. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-decline-codes https://portreeve.com/blog/stripe-decline-codes A lookup table of Stripe decline codes, what each means, what to show the customer, and the code mix that signals card testing rather than plain bad luck. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/return-fraud https://portreeve.com/blog/return-fraud Return fraud is an identity problem dressed as a policy problem. How wardrobing, empty-box claims and serial returners work, and how to link the repeaters. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/resend-api https://portreeve.com/blog/resend-api Wire the Resend API into Node: DNS records that verify a domain, a raw fetch send, idempotency keys so retries don't duplicate, and signed bounce webhooks. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/refund-abuse https://portreeve.com/blog/refund-abuse Refund abuse in SaaS is usually a policy problem, not a detection one. How to bound a money-back guarantee and spot the same person on their second pass. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/real-time-fraud-detection https://portreeve.com/blog/real-time-fraud-detection Real time fraud detection is a latency budget plus a fail-open policy. What you can compute in under 100 ms, what belongs in a queue, and how to wire it. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/promo-code-abuse https://portreeve.com/blog/promo-code-abuse Promo code abuse is a multi-account problem: why single-use codes, per-email limits and card gates fail, and how to link the accounts behind the farming. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/hono-middleware https://portreeve.com/blog/hono-middleware How Hono middleware works: what await next() does to the response, where per-request state lives, why a Map counter lies on Workers, and safe timeouts. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/first-party-fraud https://portreeve.com/blog/first-party-fraud First-party fraud is your own customer abusing your product with their real name, real card, and real device. Why fraud scores miss it and what stops it. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/fake-accounts https://portreeve.com/blog/fake-accounts Most fake accounts are not bots. They are one person on their eleventh identity. How the three populations separate, and the queries that tell them apart. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/express-rate-limit https://portreeve.com/blog/express-rate-limit Set up an express rate limit in five lines, move the counter to Redis so it survives multiple instances, and key it on the API key instead of the raw IP. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/drizzle-migrations https://portreeve.com/blog/drizzle-migrations How drizzle migrations really work, where to run drizzle-kit migrate on Railway, why a redeploy skips your new SQL, and how to roll back with no down file. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/detect-card-testing-stripe https://portreeve.com/blog/detect-card-testing-stripe Detect card testing on Stripe with a server-side check on the card fingerprint before you create the PaymentIntent, plus the webhook that refunds a deny. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/detect-account-takeover-login https://portreeve.com/blog/detect-account-takeover-login Detect account takeover at login with a Node risk check that steps up MFA on suspicious sign-ins and blocks only high-confidence attempts, not travelers. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/cloudflare-turnstile https://portreeve.com/blog/cloudflare-turnstile Add Cloudflare Turnstile to a signup form in an hour: widget modes, React render, siteverify in Node, the error codes, and the fake signups it cannot see. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/chargeback-for-fraud https://portreeve.com/blog/chargeback-for-fraud A chargeback for fraud means the cardholder tapped 'I didn't authorize this.' What Visa 10.4 lets you argue, and the logging that decides it months ahead. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/card-testing-attack-example https://portreeve.com/blog/card-testing-attack-example A card testing attack example from a public Hacker News thread: 75,000 tokens created in 28 days, no sales, no alert, and where the Radar bill comes from. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/add-device-fingerprinting-signup https://portreeve.com/blog/add-device-fingerprinting-signup Add device fingerprinting to a signup form: collect a short-lived token in the browser, pass it through on the server, and prove the device key landed. Mon, 07 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stop-free-trial-abuse-next-js https://portreeve.com/blog/stop-free-trial-abuse-next-js Stop free trial abuse in a Next.js app: screen the signup in an App Router route handler, collect a device token, and revoke denied accounts by webhook. Sun, 06 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/fraud-review-webhook-revoke-account https://portreeve.com/blog/fraud-review-webhook-revoke-account A fraud review webhook denies an account: verify the signature over the raw body, find the user, revoke idempotently, and answer 200 before the retry. Sun, 06 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/express-signup-fraud-middleware https://portreeve.com/blog/express-signup-fraud-middleware Build Express signup fraud middleware that screens every signup in under 100 ms, fails open on timeout, and hands allow, review or block to your route. Sun, 06 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-chargebacks https://portreeve.com/blog/stripe-chargebacks How Stripe chargebacks run from early fraud warning to lost funds, what the $15 fee covers, when evidence is worth it, and how to keep the disputer out. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/shopify-chargebacks https://portreeve.com/blog/shopify-chargebacks How Shopify chargebacks work: the fee and when it comes back, which disputes you can win, what Shopify Protect covers, and how to stop the repeat offender. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/paypal-chargebacks https://portreeve.com/blog/paypal-chargebacks PayPal chargebacks for software sellers: dispute vs claim vs issuer chargeback, the $15 and $20 fees, Seller Protection for intangibles, and repeat buyers. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/friendly-fraud https://portreeve.com/blog/friendly-fraud Friendly fraud is a customer disputing a charge they authorized. What Visa CE 3.0 requires, which logs win a SaaS dispute, and how to stop the repeat. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/free-tier-abuse-checklist https://portreeve.com/blog/free-tier-abuse-checklist Free tier abuse checklist for launch: meter expensive endpoints, capture identity keys, review before you block, fail open, and plan for the first attack. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/ecommerce-fraud-detection https://portreeve.com/blog/ecommerce-fraud-detection Ecommerce fraud detection is six different attacks. Name yours from the first loss, learn which signal catches it, and decide whether to build or buy it. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/credit-card-fraud-detection-datasets https://portreeve.com/blog/credit-card-fraud-detection-datasets The public credit card fraud detection datasets model the bank's problem, not a SaaS checkout. What is in each one, and how to build the dataset you need. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/bin-attack https://portreeve.com/blog/bin-attack A BIN attack is card testing with generated numbers. How the Luhn check makes it cheap, why your decline codes help the attacker, and what stops it early. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/behavioral-fraud-detection https://portreeve.com/blog/behavioral-fraud-detection Behavioral fraud detection scores what a session does, not what it says. Which signals are cheap, which need a script, where behavior stops being proof. Sat, 05 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/x402 https://portreeve.com/blog/x402 x402 lets any script with a wallet pay your API per request. What the protocol does, what sellers lose without the card, and how to count abuse per wallet. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/velocity-checks https://portreeve.com/blog/velocity-checks Velocity checks are counts per key per window. Which keys to use at signup, checkout, and login, why per-IP can only review, and a Redis sliding window. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/stripe-radar https://portreeve.com/blog/stripe-radar What Stripe Radar screens by default, what the paid tiers add, the rules worth writing, and the signup, trial, and login abuse it structurally cannot see. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/free-trial-abuse https://portreeve.com/blog/free-trial-abuse Free trial abuse explained from the abuser's side: why email blocklists, IP limits and card gates each fail, and how identity linking stops repeat trials. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/free-tier-abuse https://portreeve.com/blog/free-tier-abuse Free tier abuse explained: how scripted signups farm AI credits for resale, what each fake account costs you, and why to meter new clusters, not the door. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/fraud-detection-api https://portreeve.com/blog/fraud-detection-api A fraud detection API landscape for small SaaS: what Stripe Radar, Sift, Fingerprint, Castle, hCaptcha and WorkOS Radar cover, what they cost, and the gap. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/disposable-email-domains https://portreeve.com/blog/disposable-email-domains Blocklists of disposable email domains catch the lazy tier and miss $1 catch-all domains and Gmail alts. Score email quality without blocking customers. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/device-fingerprinting https://portreeve.com/blog/device-fingerprinting How device fingerprinting works, where browsers break it, what the law requires, and why the device key lets you block card testing at ordinary amounts. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/chargeback-fraud https://portreeve.com/blog/chargeback-fraud Chargeback fraud in SaaS: true fraud vs friendly fraud vs first-party abuse, Stripe fees, network thresholds, evidence that wins, and stopping repeats. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/card-testing https://portreeve.com/blog/card-testing Card testing is how criminals validate stolen cards on your checkout. How the probes work, what they cost in fees and disputes, and how to detect them. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/agent-payments https://portreeve.com/blog/agent-payments Agent payments break bot detection because the buyer is a bot. Use identity, reputation, velocity and price to tell paying agents from abusive scripts. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/account-takeover https://portreeve.com/blog/account-takeover How account takeover happens at a SaaS login, which signals separate a stolen credential from a traveling customer, and why a challenge beats a block. Thu, 03 Sep 2026 00:00:00 GMT Portreeve https://portreeve.com/blog/card-testing-stripe https://portreeve.com/blog/card-testing-stripe Card testing on Stripe explained from the attacker's side: why your checkout is the target, what declines and disputes cost, and what to change tonight. Wed, 02 Sep 2026 00:00:00 GMT Portreeve