We are having a problem with a user who comes to our site to attempt to validate hundreds of credit card numbers. He will run around 400+ $1.00 transactions at a time, find some valid card numbers and then quit. This is happening with more frequency.

He uses the same name and address each time and his IP address is the same. We are taking several steps to address the issue.

One of the steps I would like to take is to prevent him from submitting the transaction if I see his IP address. Is it safe to do this? Could I potentially be losing legitimate sales by doing this?

BTW, we use PayPal's Payflow pro service to process credit cards.

  • I doubt blocking the ip address would stop it in the long run if it's a malicious user. You said he's using the same address each time, do you mean billing address that gets validated with the card or just the address registered with your site?
    – JMC
    Commented Dec 15, 2011 at 17:09
  • @JMC: He is using the same billing address and same IP Address for each transaction. Commented Dec 15, 2011 at 17:30
  • 1
    I can't get the address right now. But the FBI has a way to report this kind of internet fraud. A quick search may find it for you (internet filter at work won't let me).
    – CLo
    Commented Dec 15, 2011 at 21:09

3 Answers 3


If it is always from the same IP address then blocking it is a good idea. If it is a region you don't do business in then blocking the IP range may not be a bad idea, either.

An alternative approach is to identify when that user is on your site and give them bad information. Randomly tell them when credit cards are good or bad without actually attempting to validate them. Additionally, you can make each request very slow requiring more and more of his time to do this making it inefficient for his purposes. Eventually they'll consider you not worth their time and go elsewhere.

  • 2
    Randomly tell them when credit cards are good or bad without actually attempting to validate them.. That's just sooo funny.
    – PeeHaa
    Commented Dec 15, 2011 at 16:58
  • Thank you for the suggestions. If I am doing the IP lookup correctly, it appears to be from Nevada, USA. I don't want to block that region. I really like the idea of making the transactions take longer and providing random responses. Commented Dec 15, 2011 at 17:00
  • 6
    I'd say that's counter productive, amusing as it would be to mess with a fraudsters mind, it will probably end up taking up more of your time than it would his (assuming "he" is even human and not software). Additionally, you risk annoying legitimate customers from that area. I'd say send the user with that IP to a page saying there has been irregular activity detected, that its been reported, and you apologise for any inconvenience. Then provide a phone number to call for legitimate users wanting to buy in the meantime.
    – Codecraft
    Commented Dec 15, 2011 at 17:37
  • 1
    @Tod1d Strictly talking about the response from your site, the delay might be best. Multiply the wait time for that IP by 1.3 seconds or so each time a validation fails. Divide by the same amount each day or week (so real users don't accumulate delays due to typos). If the base wait time on first failure is 1 second, you're up to a 3 minute wait time after 19 failures, and it just keeps growing exponentially...
    – Izkata
    Commented Dec 15, 2011 at 19:05
  • 2
    IP based solutions aren't a good idea here. Tod1d needs to fix the root problems that make him a target for verifying fraudulent cards instead of duct taping code into his payment application.
    – JMC
    Commented Dec 15, 2011 at 19:39

You could report it to Paypal, let them do their job and investigate these transactions and take appropriate steps upstream to make sure the transactions are declined at payment provider level.

This not only fixes it for you, but all sites using the same payment service, and if its serious enough, they will pass it further up the line to the card issuers too.

Rather than just fixing the problem on your site, you have an opportunity to help fix the problem across many sites. Its better for everyone if this problem is handled as far upstream as possible.

  • 1
    Thanks for the suggestion. We have already contacted PayPal and they are looking into it. Unfortunately, they are apparently taking their time. Commented Dec 15, 2011 at 16:50

Going out on a limb without knowing much about your setup.

It seems like you're a target because you're not validating any of the billing address credentials. That enables him to verify valid card numbers without having to know much additional information about the card such as billing zip code. It's also possible that your error messages are too verbose and are giving the guy more information about the decline than he can find else-where. Most eCommerce stores return generic decline messages to avoid becoming a target for this type of misuse.

As a side note, I believe getting used like this can hurt you in the long run with PayPal, causing them to tack on higher rates because you're a risky customer. Read your agreement with them about additional % points due to fraud and risk. If I remember correctly it says something like they can add up to 5% points to each transaction if you fall into a high risk category.

  • You are correct. We were not using address validation. We are in the process of remedying that. Commented Dec 16, 2011 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.