Friendly fraud — where a legitimate-looking customer purchases goods then disputes the charge — cost the e-commerce industry an estimated $25 billion in 2025. This brand was losing $340,000 a month to it.
The attacker group used a rotating pool of residential proxy IPs, making each transaction appear to originate from a unique, clean home connection. Traditional IP reputation tools scored them as low-risk. Stripe's built-in radar missed every single one.
What Sentinel Saw
Sentinel's client-side Edge SDK detected subtle hardware-level signatures shared across all the "different" accounts: identical WebGL renderer strings, matching TLS cipher suite ordering, and timing jitter patterns consistent with virtualized environments. Despite appearing to come from 400+ distinct IPs, Sentinel grouped them into a single fraud cluster within 6 hours of deployment.
The Block
A single rule was pushed: any checkout with a Sentinel cluster-match score above 0.85 required an additional step before payment was processed. The fraud group — unable to pass the check — abandoned the attack entirely. $0 in disputes were filed that month from the cluster.
Financial Impact
$340,000 in dispute fees and lost inventory saved in the first 30 days. Stripe's fraud risk flag on the merchant account was removed 45 days after deployment. The brand's chargeback rate dropped from 1.8% to 0.06%.