We are currently setup using Magento on a LAMP stack for our e-commerce platform. As of a month or two ago we began noticing a lot of carding attempts against our website. All attempted transactions would be for a small amount, just to check if their credit card is valid. As one is declined they usually try it again repeatedly changing the card number by 1 or 2 numbers. These attempts happen very quickly, in succession. As you can imagine, this adds up quickly in our credit card processors system and often times we get shut down for a brief period of time to prevent more attempts.
Most of the attacks were coming from outside of the U.S. and we are a U.S. only business so we used mod_geoip to deny all traffic from outside of the country. This has helped with the mass attacks but we still get people carding from U.S. origins. I am really interested in knowing what’s going on here. How do they setup scripts to mass attempts orders like this? Is there really anything else I can do to stomp this out? Any insight on these types of attacks is appreciated!
This question was IT Security Question of the Week.
Read the Sept 14, 2012 blog entry for more details or submit your own Question of the Week.