Sardine

Fraudsters are copying AI models that cost hundreds of millions of dollars to train, and they're paying for the queries with stolen free trial credits. The account farms behind AI token fraud cycle through free trials under fresh identities, and every credit they burn is real compute the provider pays for. On a seven-day trial with no card on file, they get a week of free usage before anyone on the fraud team screens a payment. Then the operators spend that stolen compute generating deepfaked selfies and synthetic identity documents for their next batch of signups, so they pay less with every run. On the Sardine blog, Nathan DeStigter breaks down the signals fraud teams use to stop free trial abuse at signup, from device fingerprinting to behavioral biometrics, before the operation finishes building its accounts.

Wow, Merchant Fraud Alliance 2026 really knocked our (Sardine branded) socks off! We kicked off the week in Chicago by hosting the Merchant Social on the 99th floor of Willis Tower, where our CEO Soups Ranjan welcomed a room full of merchant fraud leaders. Soups returned the next day to take the main stage with Karisse Hendrick, digging into the AI attack methods merchants are running into right now. Thank you to everyone who stopped by our booth to talk shop, to the organizers for building an event around merchants and the people defending them, and to our amazing team on the ground (Tori Murphy, CRPS™, Martin Bruhat, Brian Thacker, and Anirudh Vadapalli). We can’t wait to see again next year!

We just added four new hires to the crew in sales and account management, each working out of a different port as Sardine grows across North America and Europe. 🇮🇪 From Dublin, Julia Adelman covers the EU and UK as an Enterprise Account Executive. After spending most of her 10 years as an AE in New York, she moved to Ireland nearly four years ago. She jokes that she has made her first dog, Lenny, her entire personality. 🇺🇸 Amal Aarab joins as an Account Manager after working in customer success at a software development startup, so she already knows how to keep clients happy. She came to LA from Germany by way of New York, and she still travels whenever she can, always on the lookout for good food. 🇨🇦 Steven Tait joins our growing Canadian Sardine team out of Toronto as an Account Executive. In recent years, he's seen teams trade customer experience for fraud protection and came here for a change of pace. Off the clock he's an avid reader and is currently looking for recommendations. 🇬🇧 Zach Bennett is helping build Sardine's EMEA team as an Account Executive in Manchester. He helped a compliance tech company grow from 50 people and open its APAC office, so he's no stranger to this. Afterward, he stretched a planned one-year sabbatical into three years of hiking around the world so he's got no shortage of great travel stories. Together, they'll bring new customers to Sardine on both sides of the Atlantic and look after the ones already here. Welcome aboard! 🐟 🐟 🐟 🐟

Next stop: Las Vegas! 🎲 🎰 💸 As you plan your week at Money20/20 USA, save time for booth 5079 and the Presidential Suite at The Venetian, which we booked again for anyone who wants to sit down somewhere quieter than the show floor. Tell us how you're getting ready for AI agents that shop and open accounts on a customer's behalf, and we'll share what we've seen so far. Meet with us: https://lnkd.in/ga_3V43n The Faster Money Party: https://lnkd.in/gWT79gPU Stablecoin Workshop: https://lnkd.in/gggjKczw

Would your underwriters flag an applicant whose credit file looks better than your best customer's? On this week's Fraudology, Matt Vega, Chief Fraud Strategist at Point Predictive (and former Sardine), walks through how fraudsters give a 90-day-old identity five years of payment history by adding it as an authorized user on someone's high-limit credit card. From there they stack buy now, pay later loans that report to the bureaus, then apply with an 800 score no lender in the consortium has seen. Since fraudsters can buy their way past those checks, Matt wants fraud teams to start by mapping how good customers move through an application, because once they know what normal looks like, the 800-score stranger stands out. Listen to the full episode >> https://lnkd.in/gRRSdKEy Watch on YouTube >> https://lnkd.in/ghNSXppC

Due to popular demand (and because we promised we would), keynotes from August's SardineCon are now on the Sardine website! Joseph Cox, co-founder of 404 Media and author of Dark Wire, shared his case for why we're not ready for AI-powered fraud, a conclusion he reached after generating a fake ID and using it to pass a real crypto exchange's identity check. Sardine's CEO Soups Ranjan followed by breaking down real attacks his team has caught this year, including deepfaked interviews and 250,000-account fraud rings, and then walked the room through the shift toward narrow, specialist AI agents over one do-everything model. Watch both keynotes on demand >> https://lnkd.in/eC3ZMHTp

Somehow Hailey Windham, CFCS managed to find time this week between events to sit down for Episode 120 of Fraud Forward, with just the notebook she filled at HHS in DC and ACAMS The Assembly in Las Vegas. She first heard "fraud follows money" in DC and kept hearing it everywhere she went after that. In the episode, she gets into: 🔹 How she'd prove to leadership that a dollar saved beats a dollar recovered 🔹 Why she warns against grading investigators on closed alerts 🔹 Her advice for banks that figure stablecoins aren't their problem 🔹 The one expert investigator, and what she says you lose when they quit If "fraud follows money," she says, "our job is to make sure we're paying attention to where the money is going next." Listen to the full episode >> https://lnkd.in/g9q7ebxM Watch on YouTube >> https://lnkd.in/gbemPKjm

For fifty dollars in bitcoin, 404 Media co-founder Joseph Cox bought a fake British passport and got it through a crypto exchange's document check. At SardineCon SF this year, he walked us through his odyssey to find a face and voice to go with it. He spent over a month getting the deepfake vendor to sell him a subscription, borrowing screenshots of his co-founder's gaming rig to pass vetting. Once he had the software, he watched a stranger wear his face on a live call and showed it to his mother. Then he cloned his own voice in five minutes and played it into his bank's voice login to get into his account. To train the clone, he read out a steamy romance novel the tool generated for him, and he told the room he kept thinking, "Why are you making me read this out in my office?" Joseph found vendors selling each piece on its own, and he hasn't yet watched anyone stitch them together into a single call. He doesn't think society is ready for it, and he called the belief that only the old or naive fall for these scams bigoted and wrong. Read the full recap: https://lnkd.in/gcqPs7wi Watch Joseph Cox's full keynote: https://lnkd.in/eC3ZMHTp

After sizing up a fraud attack, Chen Zamir says the next question is who actually committed it. On episode 24 of The Saturday Fraud Strategist, he explains that skipping this step can cost millions. His answer sorts every attack into one of two types, based on who is behind it: - Third-party fraud: someone poses as another person - First-party fraud: a real customer uses their own name with no plan to honor the deal Getting it wrong is expensive. A fintech answered early chargebacks with stronger KYC and device fingerprinting, but its fraudsters were real customers who passed every new check. A SaaS team wrote tenure rules while fraudsters on three IP networks drove 80% of its fraud. He tags loss events with signals like these: • First-party fraudsters dispute inside a week and rarely show a geo mismatch • Third-party rings run "different" customers off the same devices and IPs • Ring operators spin up fresh identities with email handles like johnsmith777 and janesmith777 He calls third-party fraud the easier one to beat, and traces teams' trouble with first-party fraud to how the industry built its tools. His two recommended stacks share one tool. Listen to the full episode >> https://lnkd.in/gC9EjTta Watch on YouTube >> https://lnkd.in/gf_BTmW6

Last week we launched Sardine AI Labs, an applied research group that studies how AI can learn the language of financial behavior and catch attacks it was never explicitly trained to find. Every model the lab builds gets tested against what a live risk system demands, with latency, governance, and explainability measured alongside accuracy. The first result is a foundation model for issuing risk, pretrained on close to a billion transactions from 13 card issuers. Tested on issuers held out of training entirely, it improved fraud detection accuracy by 68% for a consumer card issuer and 41% for a business card issuer, and caught up to 35% more fraud from the same transaction volume. Niranjan Shetty, our Head of Data Science, credits those gains to letting the model learn from a cardholder's complete transaction history, where older approaches boil that history down to a table of features. Because the patterns carry across institutions, a new card program doesn't have to start from zero. We're also opening five research grants of up to $75,000 each for independent researchers working on: • Cross-issuer generalization • Multi-stream event modeling • Identity matching • Money laundering detection • Real-time inference Applications close December 13. Domain-specific data is what made this model possible. We think regulated industries, and the systems underneath them, will need more of it as attacks get harder to see coming. Full write-up and grant details: https://lnkd.in/gFgvP2BK