Every business has a Super Bowl. It just isn’t always the Super Bowl.
For one company, it might be Black Friday. For another, Valentine’s Day. For others, the biggest payment spike of the year comes from a product launch, ticket release, or viral moment nobody saw coming.
That was the premise of a recent Merchant Advisory Group (MAG) webinar, “Know Your Super Bowl: Optimizing Fraud Prevention Through Peak Payment Volume Spikes,” featuring Sift Trust and Safety Architect Maria Benjamin and independent fraud operations consultant Megan Doxtator, formerly of Patreon. The discussion centered on one key distinction, the peaks you can predict versus the surges you can’t. Both require preparation, but not the same kind.
Your biggest payment day might not be the one you’d expect
Peak payment volume doesn’t follow a universal calendar. One food business’s biggest days weren’t Black Friday, but Valentine’s Day, Mother’s Day, and Father’s Day. A live webinar poll reinforced the point, with attendees most often identifying seasons as their biggest peak periods, followed by launches, releases, and major events.
Businesses also have to account for peaks that aren’t on any calendar. Virality is one example: an influencer or celebrity can suddenly appear with a product and drive a slew of traffic to your site with little or no warning. The first step is understanding what a peak looks like for your business, looking beyond holidays to launches, promotions, recurring payment cycles, and unexpected moments that can send legitimate customers and fraudsters to your platform at the same time.
Predictable peaks are a planning and timing problem
When a high-volume event is already on the calendar, fraud teams have the advantage of time. The work starts roughly a quarter out, reviewing forecasts, product changes, and aligning with finance on how much additional risk the business is willing to accept. About a month out, the focus shifts to execution, with code freezes, rule changes, and stakeholder alignment.
“Fraud isn’t about saying no to things. We want to say yes to things. You just haven’t given us the full context.” — Maria Benjamin
A week before the event, the plan should be locked, covering which thresholds change, when, for how long, and when everything returns to normal. One retailer loosened fraud thresholds for an entire week around a major holiday, only to find the wider window had created more losses than intended. The next time around, they narrowed that window to roughly the portion of a single day the business actually needed. Take more risk when the revenue opportunity justifies it, but not for longer than necessary.
Unpredictable surges need an incident response plan
Not every spike gives you months to prepare. For unpredictable events, a solid incident response plan starts with triage and activation, sizing up the surge itself before deciding who needs to jump in, then moves through containment, investigation, and recovery.
“How big is the surge? Is this isolated to a specific area, or is this across your payment scape? And then mobilizing. Who do you need to be involved?” — Megan Doxtator
Containment is where the team acts on that assessment. Investigation documents what happened. Recovery returns controls to normal and decides what changes before the next incident. A strong plan keeps the team from inventing roles and next steps while the incident is already unfolding.
Not every suspicious surge turns out to be fraud, either. Maria Benjamin recalled a sudden wave of transactions from one state, many in specific amounts adding up to roughly $500, that looked coordinated until it traced back to a new state benefits program letting recipients get funds faster through linked bank accounts. The company manually released the transactions while engineering built a way to handle the volume at scale, freeing the fraud team to focus on behavior that was genuinely suspicious.
Recovery is where risk tolerance gets decided
Recovery goes beyond resetting rules. Fraud teams and leaders use this stage to evaluate what happened to customer experience, revenue, and risk, then decide whether to take on more or less going forward. Fraud teams can supply the data, but risk tolerance is ultimately a business decision. One incident consumed months of a company’s risk budget, forcing it to cut off a payment channel entirely until the business recovered financially. Those tradeoffs are easier when fraud, finance, and leadership have already aligned on risk tolerance before an incident happens.
New behaviors will keep changing the playbook
Audience questions surfaced two emerging challenges. The first is shared payment credentials promoted on social media, sometimes nicknamed “TikTok cards.” The instinct to shut down every account that attempts to use the same card is usually the wrong one. A better approach identifies connected accounts, blocks the shared credential itself, and pairs controls with education rather than immediate bans.
The second was agentic commerce. As AI agents make purchases on a customer’s behalf, merchants will need clearer policies for what that agent was actually authorized to do. Fraud plans can’t stay static while customer behavior and technology keep changing.
Build the plan before you need it
Whether your Super Bowl happens once a year, lasts a season, or arrives with no warning, the goal doesn’t change. Maximize trusted payments without letting fraud controls become too loose or too restrictive. That takes forecasts, clear risk tolerance, cross-functional coordination, and an incident response plan. It also means learning from every surge and keeping those plans current.
“Having strong plans in place, whether you have a predictable payment event or season, and having an incident plan that you can stand up at any time that fits your organization, is the key to maximizing your ability for good payments.” — Megan Doxtator
Your “Super Bowl” is unique to your business. Your response plan should be too.
Want to prepare before the next surge? Get the practical peak-event readiness checklist.
