Every shared blocklist has the same failure mode, and anyone who has been on one can describe it. A merchant has a bad day, decides a customer is a thief, and presses a button, and four other shops start treating that customer as a thief on the strength of one person's temper. This article is about what one label can reach and what it cannot, and about who is allowed to make an accusation stick.
The property
A fraud label makes the buyer's device and IP hot for every Pro shop at once. E-mail and phone, which anyone can type in anyone's name, carry full weight elsewhere only once they are verified or tied to that same device. The network tier needs two independent owners. Independence is a property of the owner, not of the account, and an operator decides it, never the shop itself. An operator cannot write network heat.
Why it holds
The angry merchant
Start with the case the rule exists for. A shop has an order it is unhappy about. The buyer was difficult, the return was awkward, the shop is convinced it was defrauded and may well be right. Someone opens the order and labels it fraud.
Here is exactly what happens. The label is written, and that shop's own view of the identity changes: on a later check from the same shop, the heat is there and the reasons name it. The device and the IP address the order came from turn hot for every Pro shop at once, so a later check at another Pro shop from that IP reads a reason saying another shop confirmed fraud there, and the device adds to it. Those are traits the shop observed on the order, not words somebody typed, and they are what lets the next shop be warned on its very next check.
Here is exactly what does not happen. The e-mail address and the phone number on the order do not carry the accusation to other shops at full weight just because they were typed there. Anyone can type a stranger's address into a checkout, so another shop that later sees that address from a different device reads a caution that the address may have been misused, not the full weight. The address counts in full elsewhere only once the labelling shop verified it or the same device is behind it. The customer is not on a list, no reason ever shows another shop who they are, and the network tier stays out of reach of one shop's certainty.
Two owners, not two accounts
The second accuser has to be independently owned. That word does the work here, and here is what it excludes: two accounts belonging to the same owner are one accuser, not two. A company running three storefronts, or opening a second account after the first, has one voice, and labelling from all of them never reaches the network tier.
The decision about who owns what is not made by the shops and cannot be influenced by them. It is made by an operator, from ownership, at the point where a shop is approved. It is recorded about the shop before that shop has sent a single check, and there is no field in the API, no setting in the portal and no support request that moves it.
Figure 1
There is no other path to network heat
The only path to network heat is two independently owned shops. An operator has no route, no button and no evidence type with which to write an identity hot for the network. That asymmetry is deliberate: a stolen operator account can cool a trail, and it cannot mark one. A human is not an exception to the two shop rule.
An operator still decides independence, when a shop is approved, from ownership. That decision is recorded before the first check, and neither the shop nor a support request can move it. What the operator cannot do is take that decision and write to the network with it. The independence requirement is a gate, not a licence for the operator to walk around the gate. The approval, like every other operator action, goes into the same append-only history, with the actor and the time (evidence in minutes).
Structural, not statistical
Nothing above is a score. No weight is attached to a shop, no reputation accrues to an older merchant that a new one lacks, no confidence value climbs with the number of complaints, and nothing anywhere is a majority. Corroboration is not a vote a sufficiently loud shop can win.
It is a rule about who may say what. Either the second independently owned accuser exists or it does not, and if it does not, the strength of the first shop's conviction is not an input to the network tier. A statistical rule degrades under pressure: a shop confident enough, often enough, eventually moves the number. A structural rule does not degrade at all, because there is no number to move. The most certain merchant in the network and the most careless one have the same reach: the device and IP of the orders they label, and a typed address that counts in full only once it is verified or tied to that device.
It is also why a mistake stays bounded. A shop that labels the wrong order has made that order's device and IP hot for other Pro shops, as an advisory reason that never stops a purchase, and one real label takes it back.
What it costs to evade
What a merchant must spend
The attacker this rule is built against is not a fraudster, it is a merchant. To manufacture network heat against a competitor's customer, one shop is not enough: you need two companies an operator has independently approved. That is two registrations, two sets of terms and a data processing agreement accepted in your own name, two billing relationships, and two shops sending checks anchored to real orders. Both leave an append-only ledger trail that names you, and that trail is the evidence file we build for the authorities.
What they gain
One false signal about one identity. It is advisory, no shop is obliged to act on it, and it cannot stop that person buying anything anywhere. It lasts until either shop applies a real label, one call that undoes it everywhere it reached. Two contracts and two audit trails under your own name, to give a competitor's customer a slightly worse afternoon.
Verify it
Start by reading. The property at the top of this article, the glossary entry and the product page say the same thing. The Terms you accept do not spell the rule out: section 6 requires fraud and chargeback labels to reflect real, evidenced outcomes, and says nothing about how many shops it takes. Reading tells you what the rule is. The demonstration below shows it holding.
Then have it demonstrated, on staging. We set up test keys and shops for the purpose, and the arrangement is the whole point: two shops we have recorded as one owner label the same identity as fraud, and a third shop unrelated to either checks that identity and reads the reasons on the response. No reason names a network-confirmed trail. If that check comes from the same device or IP, it reads that another shop confirmed fraud there, which is the reach of one shop described above and nothing more. Two accounts under one owner are one accuser, and the rule does not care that the label was sent twice. Ask for it at hello@heatrail.eu.
For the other direction, what happens when a label was wrong and has to be taken back, see labels and reversal.
Legal footing
Corroboration is the accuracy safeguard of Article 5(1)(d) GDPR: personal data must be accurate, and a typed identifier asserted by one interested party does not carry full weight at other shops unless it is verified or tied to the same device, and the network tier needs a second, independent owner. The operator's role in deciding independence when a shop is approved is not an informal escalation but a documented processing step, carried out on the Article 28(3) instructions recorded in the data processing agreement each shop accepts at registration, and logged with the actor and the time. That step does not write network heat.
Related
- Heat, and what cools it, on what a label creates and what makes it fade.
- Labels and reversal, on undoing a label applied in error.
- Evidence in minutes, on the history that records who confirmed what, and when.