Let me throw out this problem I'm having to some of my technical peeps and see if you guys have any new suggestions:
We have a website that sends text messages and voice mails for our clients. Clients can buy credits and use those credits when sending SMS and voice calls.
We have this Nigerian scammer who has decided that he wants to mess with us and continues to set up accounts, charge other people's cards and send messages. He appears to have full card data, including CVV2, address and expiry. (Harvested from some non-PCI compliant site, I'm sure) He isn't failing any of those checks. Sometimes he charges the card and sends messages, sometimes he just charges the card. (Probably to test validity, though we now automatically block an account that fails a card check three times in a week, so we get 90% valid cards now)
We are furiously developing a method to validate the charge card by charging them a couple of sub-dollar charges and they have to enter the amounts to validate the card. But that's currently slow to program and it's going to be a real barrier to entry for a lot of our more casual users. We are also considering a SMS based validation, but that's less secure as I'm sure he has access to at least 5 or 6 phones as well, or Skype SMS or something.
Plus, if we get too many of these charges backed out by the consumer, we stand to lose our merchant account. We are working to void them before they go through, but that's a painful manual process.
So, while we are working on adding solid card validation, what can we do? Near term and/or long term? This guy creates 5 or 10 accounts a day using all kinds of names, addresses, IP sources (usually in Nigeria, but not always, he also proxies from elsewhere), etc.
In short, everything we do to stop this guy right now is going to stop legitimate users from accessing their accounts or giving us money.
What other kind of defenses can we erect to prevent a single, reasonably technically involved malevolent user? Some kind of evil detecting Turing test?
I hate to admit it, but I'm running out of brainstorming ideas. So I came here.