Stolen Cards Buying License Keys: Stop Digital Goods Fraud
Digital goods fraud prevention for software and game sellers: velocity rules, delivery holds, key revocation and grey-market checks that help reduce losses.
Photo: Pixabay
On this page 8 sections
- Why Fraudsters Target Instant Digital Delivery
- Red Flags in License Key Fraud and Account Purchases
- Fraud Rules for Digital Downloads: Velocity Limits and Quantity Caps
- Holding Delivery for Risky Orders Without Hurting Sales
- Revoking Keys After a Fraud Chargeback
- Spotting Your Keys on Grey-Market Resale Sites
- A Digital Goods Fraud Prevention Checklist
- Next Steps
Key takeaways
- Instantly delivered keys turn a stolen card into resellable value within minutes, so your controls have to act before delivery.
- Velocity limits and quantity caps per card, account, device and IP can catch many bulk cash-out attempts while keeping friction low for normal buyers.
- Score-based delivery holds paired with authorize-then-capture let you review risky orders without charging customers for keys they haven't received.
- Tying every key to an order lets you revoke keys after fraud and trace your inventory when it appears on grey-market resale sites.
If you sell software licenses, game keys, gift cards or account credits, a fraudster can resell what you sell within minutes of checkout. That makes digital goods fraud prevention a core part of running the business. This guide covers five areas:
- Why instant delivery attracts stolen cards
- The red flags that show up in key purchases
- How to set velocity limits and delivery holds
- What to do with keys after a fraud chargeback
- How to spot your inventory on grey-market resale sites
Why Fraudsters Target Instant Digital Delivery
A thief with stolen card numbers has a problem: card data alone is hard to turn into cash. Physical goods need a shipping address, a reshipper and time, and each step leaves a trail. A license key needs none of that.
That is the core of instant delivery fraud. The pattern usually looks like this:
- The fraudster buys keys, gift cards or in-game currency with a stolen card.
- Your system delivers the key to an email inbox or order page within seconds.
- The fraudster lists the key on a resale marketplace below retail price, or redeems it into an account that gets sold.
- Weeks later, the real cardholder spots the charge, and the issuer files a fraud chargeback.
By then someone else has activated the key. You lose the sale, the product and a chargeback fee. Repeated fraud disputes also raise your risk profile with your processor.
Several things make software and game sellers especially attractive targets:
- No shipping friction. There is no address to verify and no package to intercept.
- Liquid resale market. Game keys, popular software licenses and gift cards resell easily.
- Peak-time cover. Launch days, seasonal sales and bundle drops bring order spikes that make bulk fraud harder to see.
- Low-cost SKUs for card testing. Cheap add-ons and small-denomination credits let fraudsters check which stolen cards still work before buying expensive items.
Red Flags in License Key Fraud and Account Purchases
No single signal proves fraud. License key fraud tends to show up as clusters of signals, so weigh them together.
Order-Level Signals
- Several copies of the same high-demand SKU in one order, especially a title that just launched
- An order made up mostly of gift cards, prepaid credits or the most expensive license tier
- Purchases of region-specific keys that don't match the buyer's apparent location
- A new account placing a large first order
Customer and Device Signals
- Billing country, card-issuing country and IP location that don't match
- Traffic from anonymizing proxies, hosting providers or VPNs. Many legitimate, privacy-minded buyers use these too, so treat this as one signal among several.
- Disposable or newly created email addresses, or email names that look auto-generated
- One device or browser fingerprint using several different cards
Payment Behavior Signals
- A string of declines followed by an approval, which often points to card testing
- Many small purchases of the cheapest item in a short window
- Cards from the same BIN range used one after another
- AVS or CVV mismatches that still produced an approval
Gift Card and Game Key Fraud
Gift card and game key fraud deserves its own rules because these products are as close to cash as digital goods get. Treat gift cards, wallet top-ups and in-game currency as your highest-risk SKUs. Give them lower quantity limits, stricter verification and more holds for review.
If you sell accounts or account credits, check the platform's terms first. Some platforms restrict resale, and underwriters will ask about it.
Fraud Rules for Digital Downloads: Velocity Limits and Quantity Caps
Velocity rules count how often something happens within a time window and act when the count crosses a limit. They are among the most useful fraud rules for digital downloads because cash-out attempts depend on volume.
What to Count
Set velocity limits across several identifiers, because fraudsters rotate one variable at a time:
- Per card: orders and attempts within an hour and within a day
- Per customer account: orders, total spend and unique cards used
- Per device or browser fingerprint: attempts and distinct cards
- Per IP address: checkout attempts and declines
- Per email address and email domain: orders tied to new or disposable domains
- Per SKU: units of a single title per customer within a set period
Illustrative Starting Rules
The numbers below are illustrative only. Set yours from your own order history, average basket and product mix.
| Rule (illustrative) | Example Threshold | Action |
|---|---|---|
| Declined attempts from one device | 3 within 10 minutes | Block the device temporarily |
| Distinct cards on one account | More than 2 in 24 hours | Hold for review |
| Units of one game key per order | More than 2 | Cap quantity or hold |
| Gift card value from a new account | Above your typical first order | Require step-up verification |
| Orders from one IP | 5 within 1 hour | Add CAPTCHA, then review |
Tune Rules for Launches and Sales
During a major launch or seasonal sale, legitimate buyers act faster than usual. Don't loosen every rule. Keep quantity caps firm on the hot SKU, and relax only the rules that create friction for single-unit buyers.
After each event, review your declines and chargebacks. Look for the rules that caught fraud and the ones that blocked real customers.
Many payment gateways include configurable fraud filters. Check what your gateway supports before you build rules from scratch. MannyPay works with payment gateways such as Authorize.net and NMI, along with common ecommerce platforms.
Holding Delivery for Risky Orders Without Hurting Sales
Instant delivery is what customers expect, and most orders should still get it. The goal is to slow down only the small share of orders that look risky.
Use Risk Tiers
Score each order on the signals above and route it into one of four lanes:
- Deliver instantly. Returning customers with a clean history and normal baskets.
- Step-up verification. Before delivery, ask the buyer to authenticate through 3-D Secure authentication, confirm their email or verify their account. Depending on network rules and how the transaction was authenticated, 3-D Secure can shift liability for certain fraud chargebacks to the card issuer. Confirm the details with your processor.
- Hold for manual review. Mixed signals that need a person to look at them.
- Decline. Strong fraud indicators, such as a device that just cycled through several declined cards.
Authorize Now, Capture on Release
For held orders, authorize the card at checkout and capture the funds only when you release the key. If the order turns out to be fraudulent, void the authorization instead of refunding a completed sale.
Authorization holds expire after a period that varies by card brand and transaction type. Confirm the timing with your processor and keep your review window short.
Tell Customers About Holds at Checkout
A held order with no explanation turns into a "product not received" dispute. To prevent that:
- State in your checkout and terms that most orders deliver instantly but some are reviewed for security.
- Give a realistic review window and keep to it.
- Send an automated email when you hold an order, and another when you release it.
- Staff reviews to match your peak periods, including evenings and weekends around launches.
Revoking Keys After a Fraud Chargeback
When a fraud chargeback lands on an order you already delivered, the key is still out there. If your activation system or publisher agreement allows it, revoke the key.
Build Revocation Into Your Systems
- Map every key to an order. Store the order ID, customer account, payment reference and delivery timestamp with each key.
- Log delivery and activation. Record when the key was revealed or emailed, and from what IP and device. Record when and where it was activated.
- Know your revocation path. If you run your own license server, you can deactivate keys directly. If keys come from a platform or publisher, find out ahead of time how to request revocation and how long it takes.
- Put it in your terms. State that you may deactivate licenses obtained through fraudulent or reversed payments. Have a lawyer review this language, since consumer protection rules vary.
Refund Early When You Find Fraud
Your review may turn up a fraudulent order after delivery but before a dispute arrives. In that case, consider refunding it and revoking the key right away.
A refund before a dispute can often head off the chargeback, but not always. The issuer may already have started a dispute, or may still record the transaction as fraud.
Separate True Fraud From Friendly Fraud
Not every "unauthorized" dispute is stolen-card fraud. Sometimes the cardholder bought the key, used it and disputed the charge anyway. Your activation logs, IP records and account history become evidence in those cases. For tactics, see our guide to spotting friendly fraud and fighting back.
For confirmed stolen-card fraud, accepting the chargeback and revoking the key is usually the cleaner path.
Spotting Your Keys on Grey-Market Resale Sites
Software key reseller fraud feeds on the gap between what a stolen card costs and what a key sells for. Watching where your keys end up tells you whether your controls are working.
Monitoring Methods
- Watch for underpricing. Search resale marketplaces for your products. Listings well below your cost or your distributors' prices are a warning sign.
- Make test purchases. Buy a suspicious listing and check the key against your database to identify which order it came from.
- Compare purchase and activation geography. Keys bought in one region and activated in bulk in another can point to resale.
- Track keys by sales channel. If you sell through distributors or bundles, give each channel its own key batch so you can trace leaks back to the source.
What to Do When You Find Your Keys
- Trace the key to its original order and payment.
- Revoke the key if your terms and systems allow.
- Check the related account, device and card data, and block any linked accounts.
- Report the listing through the marketplace's fraud or intellectual property process.
- Adjust the velocity rule or risk signal that let the order through.
A Digital Goods Fraud Prevention Checklist
Use this list as a quick audit of your current setup:
- Velocity limits per card, account, device, IP and email
- Lower quantity caps on gift cards, top-ups and launch-day titles
- CAPTCHA and attempt limits on checkout to slow card testing
- 3-D Secure available for step-up verification
- Authorize-then-capture for held orders
- Clear delivery-timing language in checkout and terms
- Every key mapped to an order, with delivery and activation logs
- A documented revocation process for each key source
- Regular grey-market monitoring and test purchases
- Post-launch reviews of chargebacks and false declines
A strong fraud program also helps when your processor reviews your account. Underwriters look closely at digital goods sellers. Our article on why digital products merchant accounts get flagged covers what they look for.
Describe your business model accurately during underwriting. Being upfront about reselling, bundles or gift cards protects your account over time. If you're still deciding how to structure your payments, compare a merchant of record vs. a payment processor for software sellers.
Next Steps
Start with the cheapest wins:
- Add quantity caps to your riskiest SKUs.
- Turn on velocity limits across several identifiers.
- Make sure you can trace every key you deliver to an order.
Then add delivery holds and revocation, and check resale sites on a regular schedule.
If you want to review your setup, MannyPay supports online payment processing for ecommerce sellers, 3-D Secure and high-risk merchant accounts for businesses that need them. You can request a free quote, and a MannyPay specialist will respond within one business day.
This article is general information, not legal advice. Confirm license terms, revocation policies and consumer protection requirements with a qualified professional.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
