4

We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a distributed attack). 99% of these are declined, however our merchant services provider (Braintree) has asked that we remedy the fraudulent card verifications by adding security measures.

I've tried installing reCAPTCHA v2 and v3 on the site, and neither of these stop the submissions. I have detailed front-end logging which shows that the reCAPTCHA was successfully validated before the form was submitted.

My suspicion is that these attacks are being carried out by humans, not bots, but I can't confirm that. My front-end logs show the forms being filled out in around 20 seconds on average -- which is fast, but not impossibly fast.

At the moment I'm blocking requests based on GeoIP (as most of our donors are in our region), but this is not ideal, as we have some out-of-state donors.

Is there a better solution we can try?

4
  • Does your site check the Luhn checksum for credit card numbers entered on your site (en.wikipedia.org/wiki/Luhn_algorithm)?
    – mti2935
    Apr 23 '20 at 15:38
  • We're using Braintree's Hosted Fields, which check the checksum before submitting. These are stolen credit card numbers that are being tested using our site.
    – Ben Davis
    Apr 23 '20 at 15:41
  • 4
    Does your donation site support Verified By Visa & MasterCard SecureCode? Apr 24 '20 at 6:55
  • @EsaJokinen has the true answer. This is specifically what that technology was developed for. I believe it's also now mandatory in Europe, although it's still pretty uncommon in the US.
    – Bobson
    Jul 13 '20 at 21:14
0

According to prowebscraper.com cracking 1.000 reCaptcha's costs around $2 so it is just factored into the business case of the fraudsters.

Your only chance is to make your site less attractive than other websites, e.g. by requiring a registration and e-mail activation for visitors from outside your region and limiting the amount of times an account and IP-adres can be used each day

-3

Creating a separate token for each request can help you avoid this. You can now use an IP address blocker available on Netflix that protects it(anti vpn software).

2
  • 1
    OP mentioned that they already use an IP address blocker. Please also explain how the separate token would help to avoid this - OP never mentioned tokens of any sort, please give some clarification here.
    – Heng Ye
    Jan 3 at 22:44
  • Also, what's the relevance of Netflix? Is this a cloud service they're offering? (Seems kindof out of their usual business model)
    – Bobson
    Jan 4 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.