AI Is Now on Both Sides of Payout Fraud. Here's How We're Responding.
Over the past few weeks, the gift card and incentives industry has faced the most coordinated wave of cyberattacks many of us have ever seen. Aggregators, processors and the platforms that run redemption sites have been targeted at the same time. Several have taken their services offline, some for more than a week, at the start of the busiest quarter of the year.
We want to be open about what we've seen, what we've learned, and what we're doing about it. Attacks like these succeed when companies stay quiet.
Why our industry, and why now
Gift cards are one of the fastest ways to turn stolen access into money. A code holds value the moment it's issued, it can be resold within minutes, and once it's spent it can't be recovered. The fourth quarter makes it worse: volumes spike, teams are stretched, and a fraudulent order is easier to hide among legitimate ones.
The structure of the industry adds to the risk. Many payouts pass through a chain of companies before they reach a recipient: a reseller, an aggregator, a processor, a redemption platform. Every link is a place an attacker can probe, and when one link fails, everyone downstream feels it.
What's different this time
This is one of the first real-world tests of a new kind of threat: attackers using AI to probe systems, automate attacks and move at machine speed. They can test thousands of combinations in the time it takes a person to review a single alert, and adjust their approach as soon as one route is closed.
On our own platform, we've seen tens of thousands of probes and thousands of attempted attacks in recent weeks.
Defences built only on rules written and reviewed by people can't keep pace with that. The only credible answer is to defend the same way.
How we're responding
We didn't start this month. For the past five months our teams have been building a major upgrade to Runa Assure, our fraud and security infrastructure, and for the whole of October the entire company was dedicated to it. When the attacks began, that work was already landing.
The upgrade rests on four principles.
- Check twice, not once. Every payout is assessed when the order is placed, and again at the moment it's fulfilled, when we have the richest signals about who is really on the other end.
- Let machines catch machines. Machine-learning models score device, network and behavioural signals in milliseconds, and stop high-risk payouts before the value can be spent.
- Learn across the network. An attack seen on one account sharpens detection for every account. A single programme only sees what has already hit it; a network sees the pattern.
- Show every decision. Our customers see what we stopped, when and why, and can tune it with us. Security you can't inspect is security you can't trust.
Alongside that, we've tightened access itself: API keys limited to the job they were created for, keys that expire on a schedule, IP allowlists customers manage themselves, checks on every new user, and faster cancellation across more of our catalogue. Some of this is live today; the rest is rolling out customer by customer over the coming weeks.
Questions every platform should ask its payout provider
Whoever you work with, these are the questions worth asking now.
- If one of my API keys leaked tonight, what could an attacker do with it, and how fast could I shut it off?
- Can I restrict which IP addresses can call you, and can someone who gets into my account switch that off?
- Do you check a payout only when it's ordered, or again when it's redeemed?
- How many companies sit between you and the brand, and who fixes it when one of them fails?
- When you stop a transaction, can I see why?
- How quickly can you cancel a code that has been stolen?
Good answers don't guarantee you'll never be targeted. They decide how much an attack can cost you.
Working together
No single company can solve this alone. We support the industry efforts now forming to share threat intelligence and lessons from these incidents, and we'll contribute what we learn. If you're dealing with something similar, our door is open.
Why it matters
Every payout is a promise. Someone did their part and is waiting for their reward. Attacks like these put that promise at risk for everyone in our industry.
Payouts only work if people can trust them. That trust is our product, and we're investing in it accordingly.
Aron Alexander, Founder & CEO, Runa