Week 1 of running a small travel eSIM site. Also accidentally learned what friendly fraud is.

So I launched a small site that sells virtual numbers for SMS verification and travel eSIMs. Been running it for about a week now. Revenue is $118.61 which is fine, its early.

The reason I'm posting is not really about the site. Its about what happened on day 3.

I thought I caught a card fraud attack. Three suspicious payment attempts, mismatched details, back to back. Felt pretty good about catching it. Told some people, they said good job.

Turns out I had no idea what I was looking at.

What actually happened: someone bought credits on May 15. Real card, real person, everything went through fine. Then on May 22 they went to their bank and filed a dispute to reverse the charge. Kept the credits. Just wanted the money back too.

Then on May 16, one day after their first purchase, the same person tried to buy again on a different account. Same card. Same billing address. Same product. Their bank blocked it because 3DS kicked in, which is the verification layer banks use when something looks off. Buying the exact same thing twice in two days on two different accounts apparently looks very off.

This has a name. Friendly fraud. Which is genuinely the most ironic name possible because there is nothing friendly about it. A real customer buys something, gets it, then tells their bank they never authorized it. They keep the product and get their money back. You eat the loss.

I always thought fraud meant stolen cards and hackers. Apparently 70% of card fraud is just this. Regular people lying to their bank.

Filed my chargeback response, submitted evidence, now I wait. We also auto flag duplicate card attempts across accounts now so this specific move doesn't work anymore.

Anyway happy to answer questions about the fraud stuff. Also built the site to solve the local number problem personally so if that's relevant to anyone feel free to ask.