We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a distributed attack). 99% of these are declined, however our merchant services provider (Braintree) has asked that we remedy the fraudulent card verifications by adding security measures.
I've tried installing reCAPTCHA v2 and v3 on the site, and neither of these stop the submissions. I have detailed front-end logging which shows that the reCAPTCHA was successfully validated before the form was submitted.
My suspicion is that these attacks are being carried out by humans, not bots, but I can't confirm that. My front-end logs show the forms being filled out in around 20 seconds on average -- which is fast, but not impossibly fast.
At the moment I'm blocking requests based on GeoIP (as most of our donors are in our region), but this is not ideal, as we have some out-of-state donors.
Is there a better solution we can try?