Case files · Public record
Teardowns
Attack trees of public launches and incidents. Every finding is marked Confirmed or Not yet confirmed, with its source.
-
001
DraftKings 2022: how stolen logins became withdrawals
A credential-stuffing run on a sports betting site touched about 68,000 accounts and cashed out about 1,600 of them by adding a new payment method and withdrawing everything.
-
002
DoorDash 2020 to 2021: paid for deliveries that never happened
Fake customer and driver accounts, plus two employees’ logins, let a group mark orders delivered, get paid, reset the status and do it again.
-
003
Zelle 2017 to 2025: an instant-payment rail and the scams that rode it
A New York Attorney General suit alleges that quick sign-up, thin payment information and weak rule enforcement let scammers use Zelle at scale.
Court and regulator detail is second-hand. We build each teardown from press and law-firm reports of the filings, and we say so on the page. Confirmed means a public source we cite states it, not that we verified it ourselves.
Start with the attack tree of your own launch.
A Launch Fraud Review is a private attack tree of your new flow. Free, in writing. Runs beside your current system. Nothing to rip out.