$49/month
One app, one Stripe account.
- Up to 20,000 card attempts a month
- Alerts by email and in the app
- Attack timeline and costs
- Fix checklist with code to paste
A script runs stolen cards through your cheapest credit pack. Zevron sees the burst in your Stripe payments, aims to tell you within 2 minutes, and shows the fix for your stack.
For AI apps on Stripe · Read-only · No card to start · From $49 a month
Example data: a quiet day, then an attack, run through the real detector.
Fixes for the stack you run. Alerts where you already look.
Every charge and card save on your Stripe account, read against your own normal.
Email and the app on every plan. Slack and a text on Growth and up.
A rate limit, a CAPTCHA and Radar rules, written for your stack.
9 attempts in 2:30, 8 of them declined. That is how a script checking a list of stolen card numbers looks. We are watching, and we will tell you if it grows or stops.
The example: a quiet day, then 340 attempts in half an hour from 340 different cards. The cost is an estimate: processing fees Stripe keeps on a refund, plus the dispute fees if three in ten of the small charges that got through are reported as fraud.
Each of these is a test in our code, run against made-up traffic that looks like it. They do not alert. A real attack does, usually within a few minutes of the burst crossing the alert line.
If a claim here is wrong for your account, the page shows it as unknown and does not fill it in. Costs are estimates and the page marks which parts are assumed. The Visa reading is ours, not Visa’s.
import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
const limiter = new Ratelimit({ redis: Redis.fromEnv(), limiter: Ratelimit.slidingWindow(6, "10 m") });
export async function POST(req: Request) {
const ip = req.headers.get("x-forwarded-for")?.split(",")[0] ?? "unknown";
const { success } = await limiter.limit(`card:${ip}`);
if (!success) return Response.json({ error: "Too many attempts. Try again in a few minutes." }, { status: 429 });
// ...create the PaymentIntent or SetupIntent.
}Block if :card_count_for_ip_address_hourly: > 4
Block if :card_count_for_customer_daily: > 5
Block if :declined_charges_per_ip_address_hourly: > 5These numbers are an example. In the app they are set from your own last two weeks, so they would not have touched one real customer. Also in the checklist: CAPTCHA with a server-side check, 3D Secure, refunding what got through, and block lists.
Over Visa's share, nowhere near its count. Visa flags only when both lines are crossed, and your processor can act on far less. In the example, 206 of 726 Visa attempts that reached the bank were part of the attack.
Read-only access to your Stripe account. We cannot refund, charge or change anything.
AccessOne click, revoke any timeWe aim to send the first message within 2 minutes of a burst crossing our alert line; if Stripe is slow to deliver an event, a backup check every 15 minutes catches it. Then one if it gets worse, and one when it is over.
AlertsNever the same twiceNever a card number. A card is kept as Stripe's fingerprint, brand, last four and country, for 70 days.
Your dataThe least we can keepEvery reading shows each sign it used and how much it counted. No black box.
ReasonsEvery line shown14 days free with no card to start. Then a flat monthly fee, from $49.
PricingCancel the same dayOne app, one Stripe account.
Alerts where you will see them.
For apps with real volume.
Billed monthly on one invoice. Cancel from the settings page and billing stops that day.
Anything else? Email [email protected] and we’ll get back to you.
One click, read-only. Stripe shows you exactly what we ask for. We can see charges, card saves and customers. We cannot refund, charge or change anything. If you later want one-click Radar blocking, you can allow that separately.
We tell you and show you how. Stopping it means a CAPTCHA, a rate limit or a Radar rule, and each of those lives in your code or your Stripe account. We give you the code and the rule text for your stack. On the Growth plan and up, if you allow it, we can also add attacking addresses and cards to a Radar list for you.
Radar blocks payments, and Stripe says its own card-testing protection works best on Checkout and the Payment Element. We are the part that tells you what is going on and what to change: when it started, how big it is, what it costs, and how close it gets to the Visa line.
A record of each card attempt for 70 days: the card's fingerprint (a Stripe hash), brand, last four, country and type, the amount, the decline code, and your customer ID. Never a card number. Email addresses are kept as a hash and a shape, not in full. Attack summaries are kept until you delete your account.
Stripe does not put the buyer's IP or the card's BIN on a charge. If you add the IP to your payment metadata (one line, and we show you which), the address signals switch on. BINs we cannot get at all on most accounts, and the page says so instead of guessing.
Visa watches card testing apart from disputes: enumerated authorizations as a share of all authorizations, flagged at 20% together with 300,000 of them in a month. We estimate yours from what we see, and tell you plainly that most small apps are nowhere near the count, and that their processor can act on far less.
No. This is its own product. If you do get chargebacks, we can win some of them back, and you can add that from inside the app when you want it.
Nothing. 14 days, no card to start. After that it is a flat monthly fee, billed on one invoice. Cancel from the settings page and billing stops that day.
Connect Stripe in a few minutes. Read-only, 14 days free, no card to start.