The present invention is directed to systems and methods which identify fraudulent situations during the transaction phase. In one embodiment, such detection is accomplished by monitoring for situations either outside the range of normal for the general population or outside the range of normal for this particular user. The normal range could be rule driven and, for example, could include size of a given purchase, frequency of purchases, identity of use equipment being utilized for the current transaction, etc. The rule could be relaxed or tightened, at least in part, based on the length of time that the user has been a customer and the user's past payment history. In one embodiment, device ids are used to detect fraudulent users. These device (or software) ids could, for example, be a “fingerprint” of the user's equipment, or a “cookie” previously downloaded to the user that identifies the user to the fulfillment system. In situations where fraud is detected downloading the value to the user is interrupted.