CASE ID #541983726
Battery Level Divisible by Five, and Other Things Real Customers Don’t Have in Common
Investigator on the case
Daniel Gerhat
Senior Fraud Consultant
Daniel Gerhat works with SEON customers across fintech, payments, retail and iGaming on everything from coordinated fraud rings and card testing runs to registration bot attacks, promo abuse and multi-accounting. Much of his work sits where fraud meets AML: tuning rules for high-risk jurisdictions and enhanced due diligence, and pulling apart the shared devices, sessions and payment details that connect accounts a fraud team hasn’t yet linked.
What you will learn
- A single high-specificity anomaly, such as a device country that contradicts a stated address, is usually a symptom rather than a finding, and writing a rule against it would close the case prematurely.
- Ring behavior surfaces in the co-occurrence of weak signals across unrelated dimensions — identity, payment, device and relationships over time — none of which would justify a decline on its own.
- Anchoring on the shape of a cluster, rather than its specific values, carries an investigation past the first geography and into the rest of the operation.
- The shared infrastructure underneath it is what persists when the country, the bank or the setting changes.
I. The thread everyone could see
No single signal disqualified any of them individually — which is exactly what makes ring-level fraud different from opportunistic fraud. That’s usually where a review ends and a rule gets written. It’s also, more often than people expect, where the real work should start and where our investigation begins.
The one thread anyone could see was narrow: a group of accounts registering as U.S.-based, while the device itself resolved to a location in Bangladesh. Read on its own, that’s a single-dimension anomaly, the kind of finding that gets one rule written against it and gets marked solved by the end of the week.
For many of these accounts, the country mismatch was the only red flag in the transaction. Everything else about them looked like a normal customer. So the temptation was real: write the rule, catch the Bangladesh cluster, move on.
“I didn’t move on, because a single flag that specific is either the whole story or a thread hanging off a much bigger one, and there’s only one way to find out which.”
II. Not a flag, a signature
At the transaction level, the country mismatch was the only visible thread. The rest of the ring’s infrastructure was hiding in dimensions no single-transaction check would surface. When I started poking around to see what else showed up on the same accounts across dimensions unrelated to geography, the cracks began to appear. The identity layer turned up common name patterns, all claiming US residency, generic enough that none of them would look wrong in a crowd. The payment layer turned up something more specific: a repeatable two-step sequence, a card from one bank on the first transaction, a card from a different bank on the second, over and over, on accounts that had no reason to share a habit like that. The device layer added specific screen brightness settings, battery levels always divisible by 5 far too often, and biometrics that were never once turned on. And sitting underneath all of it, a relationship layer: card expiration dates that kept landing on the same values across supposedly unrelated accounts, and full names that kept reappearing inside other users’ email addresses.
None of those signals, alone, would justify declining an account. A shared card sequence occurs, and the battery level isn’t the sole cause for concern.
“What doesn’t happen by chance is all of them clustering together, repeatedly, across accounts with no other connection.”
That clustering is what turned a soft anomaly into something worth calling a signature.
III. The tell wasn’t geography
Once I had the shape of that signature, not the Bangladesh value specifically, but the pattern of identity, payment, device and relationship signals converging together, I could pull the thread across the wider account population instead of just the cluster that had first caught my eye. That’s where it got bigger. The exact same signature, card sequence, device quirks, and name-and-email overlap were also appearing on accounts with device locations in China during the same time window.
The shared infrastructure wasn’t a Bangladesh operation. It was one ring, routing through more than one geography, and the geography turned out to be almost incidental to the actual tell. Geography was incidental; the shared infrastructure was the tell. The other half of the same operation, routed through a different geography, would still be running today.
A single signal describes a symptom. It takes independent signals connected across multiple dimensions, identity, payment, device and relationships over time, to reveal that a scatter of small inconsistencies is actually one piece of shared fraud infrastructure. Rings rarely leave one clean tell. They leave a scatter of small inconsistencies across many accounts because operating at scale increases the odds that some dimensions slip.
“A rule catches the known-bad value. Signal depth catches the infrastructure behind it, even when the specific value — a country, a bank or a brightness setting — changes.”
One flag tells you where to look. It takes signal depth to see what’s actually there.