Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 12 down vote favorite

We are having a problem with a user who comes to our site to attempt to validate hundreds of credit card numbers. He will run around 400+ $1.00 transactions at a time, find some valid card numbers and then quit. This is happening with more frequency.

He uses the same name and address each time and his IP address is the same. We are taking several steps to address the issue.

One of the steps I would like to take is to prevent him from submitting the transaction if I see his IP address. Is it safe to do this? Could I potentially be losing legitimate sales by doing this?

BTW, we use PayPal's Payflow pro service to process credit cards.

share|improve this question
I doubt blocking the ip address would stop it in the long run if it's a malicious user. You said he's using the same address each time, do you mean billing address that gets validated with the card or just the address registered with your site? – JMC Dec 15 '11 at 17:09
@JMC: He is using the same billing address and same IP Address for each transaction. – Tod1d Dec 15 '11 at 17:30
1  
I can't get the address right now. But the FBI has a way to report this kind of internet fraud. A quick search may find it for you (internet filter at work won't let me). – Chris Dec 15 '11 at 21:09

3 Answers

up vote 13 down vote accepted

If it is always from the same IP address then blocking it is a good idea. If it is a region you don't do business in then blocking the IP range may not be a bad idea, either.

An alternative approach is to identify when that user is on your site and give them bad information. Randomly tell them when credit cards are good or bad without actually attempting to validate them. Additionally, you can make each request very slow requiring more and more of his time to do this making it inefficient for his purposes. Eventually they'll consider you not worth their time and go elsewhere.

share|improve this answer
2  
Randomly tell them when credit cards are good or bad without actually attempting to validate them.. That's just sooo funny. – PeeHaa 埽 Dec 15 '11 at 16:58
Thank you for the suggestions. If I am doing the IP lookup correctly, it appears to be from Nevada, USA. I don't want to block that region. I really like the idea of making the transactions take longer and providing random responses. – Tod1d Dec 15 '11 at 17:00
6  
I'd say that's counter productive, amusing as it would be to mess with a fraudsters mind, it will probably end up taking up more of your time than it would his (assuming "he" is even human and not software). Additionally, you risk annoying legitimate customers from that area. I'd say send the user with that IP to a page saying there has been irregular activity detected, that its been reported, and you apologise for any inconvenience. Then provide a phone number to call for legitimate users wanting to buy in the meantime. – Codecraft Dec 15 '11 at 17:37
1  
@Tod1d Strictly talking about the response from your site, the delay might be best. Multiply the wait time for that IP by 1.3 seconds or so each time a validation fails. Divide by the same amount each day or week (so real users don't accumulate delays due to typos). If the base wait time on first failure is 1 second, you're up to a 3 minute wait time after 19 failures, and it just keeps growing exponentially... – Izkata Dec 15 '11 at 19:05
2  
IP based solutions aren't a good idea here. Tod1d needs to fix the root problems that make him a target for verifying fraudulent cards instead of duct taping code into his payment application. – JMC Dec 15 '11 at 19:39
show 2 more comments
up vote 6 down vote

You could report it to Paypal, let them do their job and investigate these transactions and take appropriate steps upstream to make sure the transactions are declined at payment provider level.

This not only fixes it for you, but all sites using the same payment service, and if its serious enough, they will pass it further up the line to the card issuers too.

Rather than just fixing the problem on your site, you have an opportunity to help fix the problem across many sites. Its better for everyone if this problem is handled as far upstream as possible.

share|improve this answer
1  
Thanks for the suggestion. We have already contacted PayPal and they are looking into it. Unfortunately, they are apparently taking their time. – Tod1d Dec 15 '11 at 16:50
up vote 3 down vote

Going out on a limb without knowing much about your setup.

It seems like you're a target because you're not validating any of the billing address credentials. That enables him to verify valid card numbers without having to know much additional information about the card such as billing zip code. It's also possible that your error messages are too verbose and are giving the guy more information about the decline than he can find else-where. Most eCommerce stores return generic decline messages to avoid becoming a target for this type of misuse.

As a side note, I believe getting used like this can hurt you in the long run with PayPal, causing them to tack on higher rates because you're a risky customer. Read your agreement with them about additional % points due to fraud and risk. If I remember correctly it says something like they can add up to 5% points to each transaction if you fall into a high risk category.

share|improve this answer
You are correct. We were not using address validation. We are in the process of remedying that. – Tod1d Dec 16 '11 at 18:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.