We are sharing this latest scam with you because we fell victim to carding in March. The beauty of having an e-commerce store is that it can be open 24-7. One early morning, our credit card processing company processed 8,000 orders within one hour. As soon as we arrived at the office and aware of this situation, we canceled all the orders and charged back the credit cards to make it right with the victims. We currently owe thousands of dollars in processing fees.
We are bewildered that this happened to us. Our website is hosted through Rocket.net using Cloudflare Enterprise Edge security, the same protection used by Doordash, Revlon, & Dropbox. Furthermore, it is inconceivable that our credit card processing solution allowed 8,000 orders to go through. Unfortunately, during my research for this article, I discovered that carding is rising, and small businesses are particularly vulnerable.
Here are some steps you can take to protect yourself:
1. Add a reCAPTCHA feature
A CAPTCHA is a system that enables web hosts to distinguish between a human and a robot accessing a website. In other words, it protects websites from spam and abuse.
2. Ensure your website is validating on both the frontend and backend
Your website frontend is where your customer enters their credit card information. The backend is the programming that processes credit card transactions. It handles the direct communication to the payment gateway where transactions are processed, typically via API token. An effective way to deter credit card testing is to require a login or session validation when your customers perform specific tasks—such as making a payment or creating an account.
3. Create a velocity logic ruleset
Velocity checks monitor specific data elements occurring in specified intervals within a brief period and are critical in enforcing fraud prevention for merchants. To reduce incoming fraudulent activity, create a velocity logic ruleset that filters card authorization test attempts by IP address, dollar amount, and repetition, then blacklist any IP addresses that meet your criteria.
4. Identify illegitimate traffic and behavior
Another tactic to assist in identifying fraudulent activity is to view backend server logs, where you’ll most likely see a significant increase in declines when attempted fraud happens. Credit card testing declines are usually identified as failed request logs or 402 errors. This error code indicates that payment cannot be processed for a particular reason—either the transaction was declined by the processor, the payment gateway, or even the issuing bank. A high volume of failed requests is indicative of credit card testing.
5. Partner with a secure payments provider
We purchased an anti-fraud plugin that overall let us set stricter transaction rules. It seems like a new scam is born every day. As small business owners, we must look out for each other!
