E-commerce
Card testing, promo abuse and reshipping fraud all start with a signup or a checkout that looks slightly wrong.
What the problem actually is
Fraud reaches an online store before the payment does. Card testers create accounts to run stolen numbers in small amounts until one clears; promo abusers cycle identities to reuse a first-order discount; reshipping schemes use fresh accounts with mismatched geography. Every one of them is cheaper to stop at account creation than after a chargeback, where you lose the goods, the fee and the dispute.
Signals that carry the weight here
A mismatch is not proof of anything on its own — travellers exist — but combined with a new account and an expedited-shipping order it is a strong pattern.
A buyer who does not want a receipt is a buyer who does not expect to keep the goods.
Promo abuse is one person and many identities. The machine is the thing that does not change.
Where to start
strictness=2 (strict) — Strict at checkout, balanced at signup. The cost of a false positive is much lower on a review queue than a chargeback, but do not apply strict scoring to browsing.
A defensible starting point, not a guarantee. Strictness moves the verdict thresholds only; the risk score itself never changes, so you can re-tune without re-scoring anything.
The call
curl -X POST "https://www.layercall.com/v1/score/user" \
-H "X-Api-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"$IP","email":"$EMAIL","phone":"$PHONE"}'1,000 lookups a month free, no card. Get an API key.
Questions
Does this replace a payment fraud tool?
No, and anyone claiming otherwise is overselling. We score the identity — the address, the email, the phone, the device. We never see the card. Use this before the payment attempt to keep obvious abuse away from your processor, alongside your processor's own risk tooling, not instead of it.