Someone is using a client's commerce site to check the validity of lots of credit cards.

After dropping IP addresses based on usage whoever is behind it throttled their requests down to 1 request every 20 seconds and only using the same ip for about 15 requests then switching IPs.

So for the last few months or so I have been "pretending" to process these and returning a credit card error to make it look as though it's attempting to process the order, although it is not.

I think I'll implement a captcha and just be done with it. But before that wondering if there is a benefit to keeping them on the hook, collecting some information and reporting this to credit card company or law enforcement?

3 Answers 3


Reporting this to local law enforcement sound like the right thing to do. Hopefully they will have access to people who are competent enough to make use of the information you can provide without you getting into trouble.

You should also contact whoever you are using for processing credit card transactions. Ideally they have an API that you can use to report suspected abuse while preserving the same security for the card number as a normal transaction.

Your own logs will obviously contain IP address and time of each abuse attempt. But I would refrain from logging the card numbers, as you could potentially get into trouble yourself, if you did.


If you're in the USA, contact your local FBI office. They will likely have one or two cyber crime investigators who will likely be very interested in finding an active hacker's watering hole.


It depends on the fraudster him-/herself, if they know how to secure themselves and know how to remain anonymous there won't be anything 'worthy' to report to LE (law enforcement), but from seeing what fatal mistakes he/she is making I would report it and keep logs to see if he/she has made a mistake so far, if not that mistake as yet to come (if lucky).

If it gets checked out via an automated process they will be most likely use an off-shore server (RDP, box, VM routed through TOR, etc.) for power & security purposes. Most likely these will be off-shore and routed through SOCKS5 proxies from infected computers or purchased proxies.

But it looks like it's a stupid skid not knowing what he's doing from what I see. I'm not explaining why as it could benefit other kiddos that are reading this. So I'm pretty sure adding Captcha will help unless they know about the known 'service' to bypass those.

Could you please tell me if your client/customer uses a pre-made eCommerce? WordPress, Stripe, Shopify? I could give some security advice if necessary.

  • Please do not ask questions in your answer. When you have enough rep, you can post comments to the question to ask these questions.
    – schroeder
    Feb 24, 2016 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .