Shared signals are usually argued for with size: more members, more data, better coverage. That is the wrong quantity. What decides whether a cross-shop signal is worth anything is not how many shops are in it, but whether the shops one attacker visits are shops that are in it. Those are different numbers, and in a small market they are very different numbers.
The property
A cross-shop signal is worth more in a small dense market than in a large sparse one, because the same small set of actors reaches the same shops. The network effect begins at the second independently owned shop, not the thousandth.
Why it holds
One shop sees a dot, the network sees a line
Take one confirmed fraud in one shop. The shop has a fact: this order was fraudulent, and it knows it because it was the party harmed. What it lacks is somewhere to hold the fact against. Every trait that might be a pattern is also true of ordinary customers in ordinary numbers: accounts are made minutes before a purchase, addresses fail to match card countries, baskets of resellable goods leave warehouses all day. Inside one shop those traits stay ambiguous, and care does not remove the ambiguity, because what is missing is not analysis. It is comparison.
Now let a second, independently owned shop hold a piece of the same evidence. Nothing has been computed and no trait has become more suspicious in itself. What changed is that the same combination occurred in two places sharing no customers, no catalogue, no staff and no reason to coincide. A coincidence that was cheap to explain inside one shop is expensive to explain across two. The evidence did not get stronger. It got positioned.
That is a statement about evidence rather than about the volume of data. A million orders inside one shop still produce dots. Three orders across three shops produce a line. Enlarging one shop's history moves the ambiguity nowhere, because the shortage was a second vantage point and not a bigger sample of the first.
Figure 1
Why density and not size
A shared signal is only useful when the shops a given attacker visits are shops that are in it. That one sentence fixes which quantity matters: the share of an attacker's reachable shops that participate, not the absolute number of members. That share is a property of the market and the membership together, and membership alone never determines it.
Reachable is meant literally. A crew working a market has a working set of shops: the ones that ship to the addresses it can use, that sell goods worth reselling, that take the payment methods it can obtain, and that can be worked inside the few days before anybody compares notes. Where one crew can reach a large fraction of the relevant shops within days, a small membership already sits across most of that crew's paths. In a very large market the same membership sits across almost none of them.
This is the ordinary reason local networks in small countries beat global averages at this particular problem. It is not local knowledge and it is not better labelling. It is that the denominator is small, so coverage arrives at a membership that would be a rounding error somewhere else. A signal that is thin everywhere is worth less than a signal that is thick in one place, because thickness is what an attacker runs into.
Why the second shop is the threshold
One label already reaches past its own shop: a fraud label makes the buyer's device and IP hot for every Pro shop at once, so a cross-shop statement needs only a second shop to hear it. What a single shop cannot reach alone is network heat, which requires corroboration from two independently owned shops. Both halves point at the same place. Below two shops there is nobody to warn and nobody to corroborate. At two there is. The interesting transition is therefore from one to two, not from small to large.
Every shop after the second is not a row added to a table. It is a path covered. A new member does not change how much data exists, it changes how many routes through this market pass a shop that is listening. Those grow differently. Rows grow with membership. Covered paths grow with the overlap between membership and an attacker's working set, and that overlap is the entire product.
Cost to evade
What one more order costs the attacker
An attacker cannot tell which shops in a market are members, so every further order goes into a set of shops of which some are listening. As shops join, the chance rises that the next order arrives in front of a shop already holding a corroborated label, and the order that used to be free becomes the one that closes the line. The cost of continuing rises with every shop that joins, without anybody changing a rule.
What that order gains them
Exactly what it gained before. The value of an order is the goods, and goods do not become more valuable because the network grew. The only structural answer is to work shops outside the network, which costs travel, new addresses, new payment paths and time, and which is the same thing as the network working. An attacker who has moved on has not defeated the design. The design is what moved them.
Verify it
This claim is structural, so there is no call that settles it. It is checked by argument, and both halves of the argument are published.
- The threshold is published. Read the corroboration requirement directly (the property) and you can see that two independently owned shops is where a network statement becomes possible at all.
- The production numbers are published. Latency and fail-open measurements from the first day in production are on the product page and the trust page, with dates attached.
The two answer different questions. The threshold says what the network is able to state at all, and the measurements say what it costs a checkout to ask. This page rests on both, and neither needs an account to read.
Legal footing
Participation is by contract: each shop instructs Heatrail OÜ as processor under Article 28, concluded at registration, so joining is the signing of an agreement and not an entry into a pool. What passes between shops is limited to categories about an order rather than records about a person, which is Article 5(1)(c) applied at the interface, and that limit does not loosen as the network grows. Growth changes how many shops hold their own labels, not what any one of them can learn about another's customers. The interface refuses questions that are not about an order in front of the asking shop, which is the subject of enumeration. Each shop remains the controller for its own orders, so adding shops adds controllers rather than pooling controllership.
Related
- Why a shared signal, on the visibility gap this article prices.
- Corroboration, on the rule that makes the second shop a threshold rather than an increment.
- Why the network cannot be enumerated, on why more members is not more exposure.
- Glossary, for these terms in their exact sense.