Marketplaces · Retail · Travel · Card paymentsApplication Shield · Omniguard fraud3 min read

Security for Online Stores & Payments

Approve more customers, charge back less, and keep the bots and card-testing off your checkout.

For an online store, every attack is an attack on revenue. The storefront, the checkout and the APIs are the business, and they get hit three ways: bots, payment fraud, and downtime.

The threat

Most of the traffic hitting your site is automated. Bad bots make up more than a third of all web traffic, and during peak sales they can be the majority of your "shoppers". They test stolen cards, take over accounts, scrape prices, hoard stock, and skim card details at checkout:

Card-testing and BIN attacks on your payment API, rising sharply year over year.
Checkout skimmers injected into the payment page, hitting thousands of stores.
Account takeover at login, and credential stuffing at scale.
Chargebacks, now dominated by first-party and friendly fraud.

And the quiet one nobody dashboards: you lose far more revenue to false declines, good customers wrongly blocked, than to actual fraud.

What Nemesis does

One agent wraps your whole store, with no re-platforming:

Edge drops bot floods before they cost you.
Application Shield detects and blocks card-testing and checkout skimmers, and stops account takeover and API abuse at the app layer.
Omniguard scores every transaction in real time, so fraud is declined before it ships and you stay below the card-scheme monitoring line, while sharper scoring means fewer false declines and more approvals.

The money

Every naira of fraud costs you several times over once you count fees, labor and lost goods, and crossing the card-scheme fraud threshold can cost you your merchant account entirely. Nemesis keeps you on the safe side of that line, and raises approvals at the same time.

Getting started

Start with a 30-day pilot on your checkout, observe-only. We show you the bots, the card-testing, the skimmers, and the good customers you are wrongly declining, on your own traffic.

Integrate Nemesis

Plug Nemesis into your stack

One agent runs all three. Start with whichever you need. Most begin with Omniguard for the money, add Application Security for the apps behind it, and Edge to keep it all standing.

See it working - live demo

A real, working app for this sector, deployed twice: one build protected by Nemesis end to end, one left unprotected. Run the same attacks on both - fraud, injection, account takeover, BOLA and mule cash-outs - and watch the protected build block what the other lets through. It opens a guided walkthrough so you can run the end-to-end tests yourself.

Open the protected demo →Open the unprotected demo →

Score every order before you authorize it. Card testing, stolen cards, chargebacks, account takeover and triangulation, blocked in a single API call on the checkout you already control, with the card handled as a SHA-256, never a raw PAN.

Free to start

Screen payout recipients and marketplace sellers against sanctions and PEP lists, free. 100 screens a day, no card, no function to build. Search it now or wire the API, then grow into full transaction scoring when you are ready.

POST https://shield.nemesislabs.xyz/api/v1/omniguard/verify   { "check":"sanctions_pep", "subject":"…" }   # free · no function needed

1 Who are you?

You build the product and own the payment code end to end.

Your access to transactions

Full code control - insert Omniguard inline on the payment path.

Recommended: Inline API / SDK

What you are fighting

Card testing & BIN attacksMule & payout fraudChargeback / first-party fraudAccount takeoverStructuring & scam payoutsSanctions & PEP screening

CBN / NFIU obligations Omniguard covers for you

✓ Real-time monitoring✓ Sanctions & PEP screening✓ STR to the NFIU (goAML)✓ KYC/CDD (BVN/NIN)✓ PCI-DSS for card data✓ PSP / switch licensing conditions

2 How do you reach your transactions?

Inline API / SDK

You call Omniguard from your payment, transfer or checkout path, before you post the entry. The verdict comes back in one request; you block, hold or allow.

LatencyReal time · sub-second

EnforcementDecline before the transaction commits

Best forFintechs, PSPs, wallets, e-commerce and digital-first banks - anyone who controls their own transaction code.

Create a function, get your key

A function is region × app × event (e.g. NG × payments × transfer). Create it in the Omniguard console, or via the API with your developer key. You get a function id and an ingest token (your API key). Sector rules are seeded automatically.

curl https://shield.nemesislabs.xyz/api/v1/omniguard/functions \
  -H "authorization: Bearer $DEV_KEY" \
  -H "content-type: application/json" \
  -d '{"name":"NG payments","industry":"banking","event":"transfer","region":"NG"}'
# → { "functionId":"fn_…", "ingestToken":"og_…", "rulesSeeded":16 }

Score every transaction before it commits

Send the transaction to /score on the payment path. Include what you have; Omniguard enriches the rest (BIN, first-time-payee, velocity, graph, breach). Any custom field you add is scored too.

curl https://shield.nemesislabs.xyz/api/v1/omniguard/score \
  -H "authorization: Bearer $OMNIGUARD_KEY" -H "content-type: application/json" \
  -d '{"function_id":"fn_…","customer_ref":"cust_913","amount":1500000,
       "currency":"NGN","channel":"web","country":"NG",
       "counterparty_account":"0123456789","beneficiary_name":"A. Bello"}'
# → { "verdict":"block", "overall_score":97, "rule_score":97, "ai_score":null,
#     "reasons":[{"signal":"Beneficiary is a flagged mule","contribution":55}],
#     "transaction_id":"txn_…", "ctr":{"reportable":false} }

Act on the verdict

block → decline. review → hold or step-up (OTP, call-back). allow → proceed. Test everything with dry_run:true first (free, persists nothing).

if (r.verdict === "block")  decline(txn);
else if (r.verdict === "review") holdForReview(txn);
else                            proceed(txn);

Screen the parties

One call, no function needed. Screen a name against sanctions/PEP, or verify identity (BVN/NIN/passport). Screening is free; KYC is metered.

curl https://shield.nemesislabs.xyz/api/v1/omniguard/verify -H "authorization: Bearer $OMNIGUARD_KEY" \
  -d '{"check":"sanctions_pep","subject":"Ibrahim Musa"}'
# → { "risk":"hit", "data":{"lists":["OFAC (US)"]}, "usage":{…} }

Enforce, learn, report

Flip the function to enforce so block is binding. Send true outcomes back to sharpen the model, and file goAML STR/CTR from the case.

curl https://shield.nemesislabs.xyz/api/v1/omniguard/outcome -d '{"transaction_id":"txn_…","outcome":"fraud"}'
# STR for the NFIU:  GET https://shield.nemesislabs.xyz/api/v1/omniguard/reports/{id}/goaml  (goAML XML)

The whole flow in four calls

# 1 · create a function → get your key (or do it in the console)
POST https://shield.nemesislabs.xyz/api/v1/omniguard/functions   { "name":"…", "industry":"…", "event":"…" }
# 2 · score a transaction before it commits
POST https://shield.nemesislabs.xyz/api/v1/omniguard/score       { "function_id":"fn_…", "amount":…, "counterparty_account":"…" }
                         → { "verdict":"block", "overall_score":97, "reasons":[…], "transaction_id":"…" }
# 3 · screen a party (no function needed, screening is free)
POST https://shield.nemesislabs.xyz/api/v1/omniguard/verify      { "check":"sanctions_pep", "subject":"…" }
# 4 · report the outcome + file the STR
POST https://shield.nemesislabs.xyz/api/v1/omniguard/outcome     { "transaction_id":"…", "outcome":"fraud" }
GET  https://shield.nemesislabs.xyz/api/v1/omniguard/reports/{id}/goaml   → goAML STR XML for the NFIU

Create an Omniguard account →About Omniguard

Vibe-code it - Nemesis MCP

Wire all of this from your AI coding agent. Add the Nemesis MCP server to Claude, Cursor, Windsurf or VS Code, then just ask - the agent calls the real tools (create a function, score a transaction, screen a name, protect the app) and ships it for you. Sanctions and PEP screening is free.

1 · Add the server

{
  "mcpServers": {
    "nemesis": {
      "command": "npx",
      "args": ["-y", "@nemesis-shield-autogon/mcp"],
      "env": { "NEMESIS_API_KEY": "nsk_your_key" }
    }
  }
}

Or one command: npx -y @nemesis-shield-autogon/mcp

2 · Ask your agent

Add Nemesis to my checkout: create an Omniguard function for e-commerce checkout, score each order for card fraud and chargebacks, screen marketplace payout recipients against sanctions, and protect the storefront and checkout API.

Would rather we set it up with you?

Not every team wants to wire this in themselves. Tell us your setup and our engineers will map the integration to your stack and walk you through it end to end, from first call to enforce.

You Can't Blocklist What Doesn't Exist Yet

AI generates novel attacks faster than any signature can be written. The only defense that scales is learning what your systems are supposed to do, and refusing the rest.

Read · 14 min →

Other industries

Operators · PSBs · Data Centers

Security for Telecom Operators & Data Centers

Protect the network, the money and your data center, from one agent, with a security line you resell.

Read →

Shared · cPanel/WHM · VPS · Reseller · Cloud

Security for Hosting & Cloud Providers

One agent per server protects every site, with no DNS change, and a security line you sell under your own brand.

Read →

B2B SaaS · Platforms · APIs

Security for SaaS & B2B Software

Positive security for the app and APIs that are your product, plus the pen-test proof enterprise buyers demand.

Read →

The threat

What Nemesis does

The money

Getting started

Plug Nemesis into your stack

Inline API / SDK

Create a function, get your key

Score every transaction before it commits

Act on the verdict

Screen the parties

Enforce, learn, report

The whole flow in four calls

Recommended reading

You Can't Blocklist What Doesn't Exist Yet

Other industries

Security for Telecom Operators & Data Centers

Security for Hosting & Cloud Providers

Security for SaaS & B2B Software