---
title: Auto Escalation
description: "Auto-escalation is the Pro feature that triggers Panic Freeze automatically when an attack spreads across multiple device fingerprints faster than per-fingerprint lockouts can contain it. It's the answer to distributed botnet attacks: when one bot trips a lockout, the next…"
url: "https://webstepper.io/docs/trustlens/card-testing-defense/auto-escalation/"
updated: "2026-10-18"
category: Card Testing Defense
---

# Auto Escalation

Auto-escalation is the Pro feature that triggers Panic Freeze automatically when an attack spreads across multiple device fingerprints faster than per-fingerprint lockouts can contain it. It's the answer to distributed botnet attacks: when one bot trips a lockout, the next bot in the rotation just takes over. Auto-escalation watches for that pattern and freezes the entire checkout until you can intervene.

---

## How It Works

Every time velocity detection newly locks out a fingerprint, auto-escalation records it in a counter of *distinct fingerprints* over a sliding window. When the counter reaches the trigger threshold, Panic Freeze activates automatically.

| Value | Fixed at |
| --- | --- |
| Trigger threshold | 3 distinct fingerprints |
| Window | 10 minutes |
| Panic Freeze duration | 15 minutes |

So: if 3 different fingerprints trip velocity lockouts within any 10-minute span, auto-escalation fires. That's a strong signal of a distributed attack, since legitimate traffic rarely produces 3 separate devices hitting decline thresholds at once.

---

## The Geo-Diversity Safeguard

Before firing, auto-escalation runs the geo-diversity safeguard to check whether the pattern looks like an attack rather than legitimate viral or flash-sale traffic. See [Geo-Diversity Safeguard (Pro)](/docs/trustlens/card-testing-defense/geo-diversity/) for the full logic. In summary: if the locked-out fingerprints come from 3 or more countries with no single country accounting for more than half, the safeguard *blocks* the escalation.

This prevents the worst-case failure: auto-freezing the store on Black Friday because a viral hit spiked decline counts naturally.

---

## What Happens When It Fires

1. Panic Freeze activates for 15 minutes
2. The TrustLens Dashboard alert band, the header status chip, and the Card-Testing Defense page show the freeze — the same display as a manual freeze
3. The `trustlens/card_testing/auto_escalated` action fires, and an `auto_escalated` email and/or Slack alert is sent if Pro card-testing alerts are configured
4. The freeze can be deactivated manually like any Panic Freeze

TrustLens doesn't keep a separate log of escalations; the alert and the action are the record.

---

## Tuning the Threshold

The trigger threshold, the window, the freeze duration, and the safeguard's limits are fixed in this version — there are no settings or filters for them. The 3-fingerprint, 10-minute default is conservative: it triggers on relatively small distributed attacks.

You can shape what reaches auto-escalation in other ways:

- **Velocity thresholds** decide when an individual fingerprint is locked out, and therefore counted. Lowering them makes escalation more likely during an attack.
- **Allowlists** keep QA devices, partners, and other known-good traffic out of the count entirely.
- **The Browser Challenge** stops attackers who rotate identity on every attempt — the pattern that never trips a per-fingerprint lockout and so never reaches auto-escalation.

---

## Configuration

There is no Auto-Escalation section or switch. Auto-escalation runs whenever all of these are true:

| Requirement | Where |
| --- | --- |
| Pro license active | Your TrustLens account |
| Card-Testing Defense enabled | TrustLens → Card-Testing Defense → Detection Settings |

The geo-diversity safeguard is part of auto-escalation and can't be turned off separately.

---

## When Auto-Escalation Won't Fire

Even with Pro and Card-Testing Defense on, the system won't fire if:

- Geo-diversity safeguard determines the pattern looks legitimate
- Fewer than 3 fingerprints have been locked out within 10 minutes
- Panic Freeze is already active (no duplicate freezes)
- The attacking traffic is allowlisted, or comes from users who can manage WooCommerce — neither reaches the velocity rule
- Each attempt comes from a fresh identity that never accumulates enough declines to be locked out

---

## Alerting

The `auto_escalated` event sends an email and/or a Slack Incoming Webhook message when those are configured. The alert includes:

- The event name (`auto_escalated`)
- The freeze duration in seconds
- The number of distinct attacking fingerprints in the window

There is no settings screen for card-testing alerts in this version: they use the `trustlens_card_testing_alert_email` and `trustlens_card_testing_alert_slack_webhook` options, which a developer can set (for example with WP-CLI). Alerts are sent in the background a moment after the event, so they never slow down checkout.

This is one of the highest-priority alerts the system produces — if you're going to wake up for any TrustLens event, this is the one.

---

## After the Escalation

Use the freeze time to:

1. Review the 24-hour intelligence card — the contributing fingerprints, decline codes, and hourly chart
2. Check whether the attack continues after the freeze lifts (often it shifts to a different vector)
3. Consider tightening per-fingerprint velocity thresholds if the attack used the slow-paced pattern
4. Document the attack pattern for post-incident review

Auto-escalation is reactive, not preventive. If you're seeing repeated auto-escalations, the underlying attack pattern is recurring — adjust the per-fingerprint defenses and consider the Browser Challenge to catch attacks earlier rather than waiting for the distributed signal.

---

## Auto-Escalation vs Manual Panic

Both result in the same Panic Freeze state. The differences:

| Aspect | Manual Panic | Auto-Escalation |
| --- | --- | --- |
| Trigger | Admin clicks Engage | System detects distributed attack |
| Reaction time | Depends on admin presence | Within seconds of pattern detection |
| Duration | 5, 15, or 30 minutes | 15 minutes |
| Action and alert | `trustlens/panic_button_activated` / `panic_activated` | `trustlens/card_testing/auto_escalated` / `auto_escalated` |
| Geo-diversity safeguard | Doesn't apply | Required to fire |

Best practice: treat auto-escalation as a backup. Use manual panic for known-bad situations where you have specific evidence the system hasn't picked up yet.