3

We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a distributed attack). 99% of these are declined, however our merchant services provider (Braintree) has asked that we remedy the fraudulent card verifications by adding security measures.

I've tried installing reCAPTCHA v2 and v3 on the site, and neither of these stop the submissions. I have detailed front-end logging which shows that the reCAPTCHA was successfully validated before the form was submitted.

My suspicion is that these attacks are being carried out by humans, not bots, but I can't confirm that. My front-end logs show the forms being filled out in around 20 seconds on average -- which is fast, but not impossibly fast.

At the moment I'm blocking requests based on GeoIP (as most of our donors are in our region), but this is not ideal, as we have some out-of-state donors.

Is there a better solution we can try?

Improve this question
4
  • Does your site check the Luhn checksum for credit card numbers entered on your site (en.wikipedia.org/wiki/Luhn_algorithm)?
    – mti2935
    Apr 23, 2020 at 15:38
  • We're using Braintree's Hosted Fields, which check the checksum before submitting. These are stolen credit card numbers that are being tested using our site.
    – Ben Davis
    Apr 23, 2020 at 15:41
  • 4
    Does your donation site support Verified By Visa & MasterCard SecureCode?
    – Esa Jokinen
    Apr 24, 2020 at 6:55
  • @EsaJokinen has the true answer. This is specifically what that technology was developed for. I believe it's also now mandatory in Europe, although it's still pretty uncommon in the US.
    – Bobson
    Jul 13, 2020 at 21:14

3 Answers 3

Reset to default
2

The 3-D Secure protocol (Visa) is designed to verify the identity of the card holder and is also adopted by MasterCard SecureCode & American Express SafeKey among others. While this is primarily intended to protect the customer, it clearly would help in this situation, too.

Visa's entry point for merchants: Visa Secure with EMV® 3-D Secure.

Improve this answer
1
  • While this is primarily intended to protect the customer - I doubt that, it rather protects the bank.
    – Haukinger
    May 29, 2022 at 15:41
0

According to prowebscraper.com cracking 1.000 reCaptcha's costs around $2 so it is just factored into the business case of the fraudsters.

Your only chance is to make your site less attractive than other websites, e.g. by requiring a registration and e-mail activation for visitors from outside your region and limiting the amount of times an account and IP-adres can be used each day

Improve this answer
-3

Creating a separate token for each request can help you avoid this. You can now use an IP address blocker available on Netflix that protects it(anti vpn software).

Improve this answer
2
  • 1
    OP mentioned that they already use an IP address blocker. Please also explain how the separate token would help to avoid this - OP never mentioned tokens of any sort, please give some clarification here.
    – Heng Ye
    Jan 3, 2021 at 22:44
  • Also, what's the relevance of Netflix? Is this a cloud service they're offering? (Seems kindof out of their usual business model)
    – Bobson
    Jan 4, 2021 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .