6601 Fraudulent payments $250K+

  • Resolved outlook9394

    (@outlook9394)


    2 years ago

    Hi there
    Please pay special attention to your plugin. It seems card testers are out in force looking for sites with your plugin.

    My site was card tested 6601 transactions were blocked by Stripe, still about 22 transactions went through and ended up costing me $144 in dispute fees, which I have paid. Stripe’s backend blocked most of those transactions, phew!

    I’d plead you to beef up your plugin security defenses against card testing, like extremely aggressive transaction throttling as soon as you detect card testing behavior which is distinctly different from a regular legit card user/customer.

    Please do not rely on customer having the right plugin configuration or card processor with chops to block frauds etc, just tune down the defaults to stop these card testers immediately.

    Thanks

Viewing 6 replies - 1 through 6 (of 6 total)
  • Thread Starter outlook9394

    (@outlook9394)

    If all of the transactions had gone through and disputed, I’d be paying:

    $16 * 6601 = $105K in dispute fees to Stripe.

    If there is no path to making it bullet proof against card testers, you might want to take the plugin down until the plugin team/dev can fully figure it out.

    Plugin Support mbrsolution

    (@mbrsolution)

    Hi, sorry to hear about the issue you are having with our plugin. Please read the following instructions to help you further protect yourself from card testing fraud.
    https://s-plugins.com/protect-yourself-from-card-testing/

    Also, please make sure the plugin is updated to the latest version 2.0.70. Don’t forget to use the contact form provided in the link above to share more information regarding your setup.

    Kind regards.

    Plugin Author mra13

    (@mra13)

    Hi, Sorry to see that you had to deal with this one.

    Direct Stripe API integration (with any plugin) is going to be subject to this card testing attack. We are continually investigating each one of these (when a user contacts us) and adding more and more checks to the plugin to improve it. Adding too many checks also limits some of the features that we can offer. So we have been trying to balance things. We will continue to improve this.

    You won’t need to pay the dispute fees once you contact Stripe and explain to them that it was a card testing attack that got through. If you contact us using the site, we will give you more guidance and help.

    Few questions for you.

    1) Are you using the latest version of the plugin?

    2) Did you have the “I am not a robot” captcha option enabled?

    3) Did you have the debug logging feature enabled by any chance? If you did, can you please contact us using our site and then you can send it to us.

    Plugin Author mra13

    (@mra13)

    Please feel free to reply to this post when you get a chance.

    Thread Starter outlook9394

    (@outlook9394)

    Thanks for your message and follow up. 

    1) Are you using the latest version of the plugin?

No. I had slightly older version. But I have seen card testing before.  

2) Did you have the “I am not a robot” captcha option enabled?

Yes. Visible captcha. 

3) Did you have the debug logging feature enabled by any chance? If you did, can you please contact us using our site and then you can send it to us.

    Unfortunately no. It is a production environment so no debugs on.

    As per stripe, perhaps due to the macroeconomic situation, stripe refused to refund dispute fees. They said the bank charges them the fee so they won’t refund. In the past, I believe they used to refund.

    Plugin Author mra13

    (@mra13)

    There is no issue with keeping the debug logging feature enabled on live setup. All it does is write additional data to a text file. It’s a good idea to keep it enabled since you had this issue once. It will be very helpful to see if there is any further attempts happening. You will be able to send us the log file if you see anything unusual there. We can then analyze it to see what kind of attempt is being made on your site and provide tips to help with your particular setup.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘6601 Fraudulent payments $250K+’ is closed to new replies.

Tags