Rupt

Adaptation is life for fraud & abuse prevention 👏

This week in fraud: 724 fake accounts in 2 hours 🤖. This customer is an email platform for AI agents. Anyone can sign up, give their agent an inbox. They even offer 1,000 free emails a month! No credit card required. These attackers signed up and started sending spam emails. Emails about a fake declined payment which requires you to enter your credit card details to verify. Once you verify, the card details are stolen (it's all fake). These attackers were not sophisticated. They were using an AI generated code. But 724 accounts, each with 1,000 free emails, that's 724K potential victims! Needless to say Rupt stopped them! But if you don't have a protection system for your onboarding, here are a few things you should do immediately to avoid this kind of attack: 1. Rate limit signups based on IP (and be more aggressive as abuse continues) 2. Check for a valid user agent! Don't allow headless signups if you don't support it. If you want a stronger stance: 3. Check the browser fingerprint and rate limit based on that too. 4. If multiple sign ups from the same fingerprint/ip, require a phone number 5. Require 2FA for each sign up method 6. Detect and disable disposable emails and phone numbers and non-supported geographies 7. Detect lies (UA lies, bot lies, timezone mismatch lies, etc.) and if they add up, stop/flag the sign up. You can and should do more as you grow and as the risks for your business grows.

120,000 new sign ups in the last 3 months. All fake! Here's the story Attackers sign up using fake emails. They go straight to check out page. Trigger an API call with stolen credit card. If the card goes through, they go max it out on on an account that goes to their bank. If the card is declined, they try the next one. Businesses then have to deal with network authorization problems, high decline rates, and dispute charges. AI removed the barrier for motivated attackers to target online businesses. I know this is not a very sexy thing to work on for most engineers, but do not ignore it. As soon as your traction grows, you'll have a target on your back. Be vigilant, implement protection systems and ideally add AI to constantly stay on top of things for you.

Crexi is the leading commercial real estate marketplace in the US. They partnered with Rupt to stop product abuse, grow revenue, and boost customer trust. "Security and growth are two sides of the same coin", says Adam Siegel, VP of Product Growth at Crexi. Read the full case study with Ahmed S., founder of Rupt in the link below.

I "acquired" the first 10 customers for Rupt through embarrassingly bad generic cold outreach 😶! Well, kind of. Here's the story. When I started Rupt, more than anything, I wanted to avoid to solving an imaginary problem nobody cared about. So I gave myself three criteria to decide if I'm going to work on the idea or not: 1. Two months to execute everything. If I fail to do it all in two months for whatever reason, I'm abandoning the idea. 2. 1,000 people whom I think will benefit from the product to reach out to. 3. At least 5 paying customers. So I set out to find the 1,000 folks and started sending a *generic* cold email or LinkedIn invite. I also posted about the product in HN, PH and IH. No fancy rules, no fancy personalizations (some minor ones like company name, and person name, etc.) and to my surprise, the first 5, paying customers, 10 paying customers, and they kept growing. I have gotten way way better at cold outreach since then. I know how to get people to respond. But the one thing I've found to be true: If you are building something people need, and you are solving a real problem, people don't really care about personalization. They WILL respond and be happy you reached out. The point: if you find that people are not responding to your cold outreach, it's likely you're contacting the wrong person, or the wrong companies, or this isn't a painful enough problem. Don't over invest in personalization (it's good once you know what you're doing, but it's a live or die difference).

I like small teams. We build a lot of internal products at Rupt 🚧 from email validation, to scraping detection, to AI agents 🤖 that help us with sales, support, and other tasks. This helps keep us a small, lean, and a fast team 💪. Last week, we (Rupt) open-sourced our email validation service. In the next week or two we will open-source even more of our products 🔥. I never really understood 🤔: a) why for-profit companies maintained open-source projects, or b) how they were profitable despite all their intellectual property being open-source. There are three main reasons behind that : 1) Developers often need a super quick solution to start with and they need it free (open sources allows for both). 2) It helps familiarize people with the rest of the company's products and brand. 3) At scale, people usually prefer using hosted & managed solution rather than dealing with the hassle themselves (involves lots of maintenance and updates an patches, etc.) With that, we found that all three of those reasons were true for things we released at Rupt and I'm excited to release more.

Checkout our open-source, production-ready email validation library:

Check out Ahmed Saleh discussion with Harnoor Singh on device identification, fingerprinting, surveillance marketing, and fraud. https://lnkd.in/gZtmxJxc

Had a great time chatting with Harnoor Singh about device identification, fingerprinting, surveillance, and startups. Harnoor Singh is one of the coolest people with one of the most positive personalities I've ever met. It shines through quickly. Check out his incredible content. https://lnkd.in/gQwvEM6g