Last month a friend who runs a small electronics store showed me a chargeback notice for $7,000. The order it referred to had been $19. The buyer used a stolen card, the real cardholder disputed six weeks of charges in one go, and the processor pulled the entire sum out of his account in a single morning. He had shipped the product the day after the order came in. "I thought the payment screen was the security check," he told me. "It said paid. What else was I supposed to look at?"
That is the most common fraud story on the internet, and it almost never involves anyone breaking into anything. It involves a screen that says paid and an owner who believed it too early. My friend lost $7,000 on a $19 sale because he treated one moment, the checkout confirmation, as if it were the entire security system.
Fraud is a timing problem
Here is the idea I want to defend: payment fraud is not primarily a technology problem, it is a timing problem. Money changes state in exactly three moments - before you take the payment, while the payment is being processed, and after it settles - and every fraud pattern I know attacks one of those windows. Card testing, where fraudsters run hundreds of small charges through a checkout to learn which stolen cards are still alive, attacks the first window, before you have any relationship with the buyer at all. My friend's chargeback attacked the third, long after the money had moved.
Build a fortress around one window and the fraudster walks through the other two, which is exactly what my friend did. He had SSL, a processor with a clean dashboard, and a checkout page that looked trustworthy. He had nothing at all happening in the other two windows. So when I think about how a small site should handle money, I do not start with "how do I make checkout safe." I start with "what gets verified at each of the three moments." The second question produces a very different site.
The three checks behind one listing
Bid Spotlight sells rank position for real money, so it lives inside this problem. An owner submits a site, bids an amount, the payment clears, and the listing climbs. For that last step to be true, something has to be verified at each of the three moments, and none of it is automatic.
Before checkout, a submission goes through a compliance review before any payment link exists, so a listing that fails the content policy never becomes a charge. Any fetch the app makes from a submitted site runs through an SSRF guard, so a hostile URL cannot point the server at its own internals. Small sites skip this kind of thing constantly. Small sites also assume a submitted URL is just a URL.
During checkout, Stripe holds the card and the leaderboard does not move. The success page a customer lands on is decoration, and that is deliberate. Redirects are trivially forgeable - anyone can load a URL with the word "success" in it. Trusting the redirect is how a stolen card turns into a sale you already shipped.
After payment, the state change comes from exactly one source: a signed webhook from Stripe confirming the checkout session completed. The signature is verified, and only then does the rank update. If the webhook never arrives, the rank stays put, which is annoying and correct. The listing is the receipt. The payment is the fact.
What I would steal from this
You do not need to run a payments business to use the pattern. The pattern is: find every moment your money or your data changes state, then put an independent verification at each one. What does your store confirm before it issues an invoice? What does it confirm while the processor holds the money? What does it confirm before the product leaves the shelf?
For my friend the answers were nothing, whatever the processor did, and nothing. The fix was not an expensive fraud-detection subscription. It was holding shipment for 48 hours on first-time customers, and treating the processor's settled webhook as the real confirmation instead of the checkout screen. $7,000 for that lesson. He tells me it was worth it... eventually.
Write down the three moments where your money changes state, and check what you actually verify at each one tonight - and if you want to see a leaderboard where rank only moves on a verified payment, it is live at bidspotlight.com.