94% drop in fraudulent pledges

The Company

A creator funding platform handling payment pledges from backers to creators — a crowdfunding and ongoing patronage model. Creators publish projects or campaigns; backers pledge payments either one-time or recurring. The platform processes payments through Stripe and handles disbursements to creators.

The Problem

Over three months, the platform processed €280,000 in pledges that later became chargebacks. The attack was coordinated: a fraud ring had discovered that fraudulent pledges made with stolen cards via residential proxies served two purposes simultaneously.

The fraud was invisible to conventional detection:

• Each pledge came from a different residential IP address — no velocity pattern to flag
• Different device fingerprints per pledge — standard device deduplication had no signal
• Different card numbers per pledge — card velocity checks were useless
• Standard velocity rules were designed for individual bad actors, not coordinated rings

The consequences were severe. Stripe placed the account on their chargeback monitoring program — a serious warning that threatened the platform's ability to process payments. Three creator campaigns were suspended during fraud investigations. Creator trust in the platform deteriorated rapidly.

The Solution

Sentinel was integrated at the pledge form — every backer's network and device environment is evaluated before their payment is processed. Pledges from residential proxy networks, antidetect browser environments, or headless browser setups are held for manual review or rejected outright based on risk score.

The breakthrough came from Sentinel's ASN-level signal data. The fraud team could see that all fraudulent pledges — despite appearing to come from diverse residential IPs — shared a specific set of ASN combinations. These weren't flagged by IP reputation tools because each individual IP was "clean." But the ASN routing patterns were a behavioral signature of the fraud ring's proxy infrastructure.

Results — 30 Days Post-Implementation

Why Coordinated Fraud Rings Are Different

Most fraud detection is built for individual bad actors — one person, one stolen card, one IP address. Coordinated fraud rings exploit the assumption that each transaction is independent. They distribute their attacks across hundreds of IPs, devices, and cards simultaneously, staying below any individual velocity threshold.

What they can't easily hide is infrastructure. A fraud ring operating at scale routes through a limited set of proxy providers and ASNs. Individual IPs look clean. The ASN pattern — the routing infrastructure underneath those IPs — reveals the shared origin.

Sentinel's ASN-level signal data makes this pattern visible. It doesn't just check whether an IP is on a blocklist; it evaluates the network routing characteristics that reveal proxy infrastructure even when the surface IP looks legitimate.

Stripe Relationship Restoration

The chargeback monitoring program exit was the most immediate operational relief. Stripe's monitoring program comes with strict chargeback thresholds — exceeding them again would risk account suspension. With the rate dropping from 4.1% to 0.24%, the platform was comfortably within safe operating parameters.

Beyond exiting the monitoring program, Stripe's trust score for the account improved measurably — reflected in higher processing limits and better authorization rates for legitimate transactions.

Creator Trust Recovery

Three suspended creator campaigns were reinstated once the platform could demonstrate to Stripe that the fraud source had been identified and blocked. This was critical for creator relationships — suspension during an active campaign can permanently damage a creator's audience relationship and funding momentum.

The platform used the case to communicate proactively with creators about the new fraud controls, reinforcing platform reliability as a differentiator against competitor platforms.