Payments Company Protects the Infrastructure Behind Billions in Daily Transactions With Ollandi
A payments company whose platform carries billions in transaction value every day uses Ollandi to see the cyber threats and fraud campaigns targeting its infrastructure, and to give its fraud and security teams one account of each attack.
The condition
The company processes card, transfer and wallet payments for merchants and consumers, and its platform carries billions in transaction value every day. Its fraud engine scores individual transactions well. The attacks that hurt it most did not start at the transaction.
They started earlier: credential-stuffing runs against customer login, abuse of a partner API, a support account used outside its normal pattern, a new device enrolling against hundreds of accounts. Each signal sat in a different system owned by a different team. By the time the pattern reached the fraud engine as suspicious payments, the attacker had already established access.
Ollandi's role
The company deployed Ollandi as a reasoning layer across identity, API gateways, cloud workloads, endpoints and the payment channels themselves. It runs alongside the existing fraud engine rather than replacing it. Ollandi follows each payment path from customer access and identity through authorization, settlement and record, and watches the infrastructure each step depends on.
Attacks recognised before they reach payments
Ollandi connects weak signals across systems into a single threat sequence: a surge in failed logins from a new network range, followed by successful sessions, followed by changes to payout details. The security team receives one case with the sequence, the affected accounts and the evidence behind each step.
Context for the fraud team
When a threat sequence touches customer accounts, the case is shared with the fraud team so they can tighten rules for those accounts before transactions are attempted. The fraud engine keeps its role in deciding individual payments. Ollandi gives it the context of the campaign behind them.
Bounded, reversible containment
The deployment runs under the Assisted Response control. Ollandi recommends actions such as revoking a session, rate-limiting an API key or forcing re-authentication for a set of accounts. An authorized operator approves each one, and Ollandi verifies afterwards that it took effect without disrupting legitimate payments.
The operating outcome
Account takeover and API abuse campaigns are now identified while the attacker is still establishing access, and the fraud and security teams work from the same case instead of reconciling separate alerts. Every containment action is approved, verified and recorded, which the company uses in its reviews with partner banks and regulators.
Operating control: Assisted Response.
