Authorize.net 'authorize only' transactions

[jeking]

In the last two days, I've had two clients report 'authorize only' transactions on their Authorize.net accounts. Both sites are using Authorize.net but both are set to Authorize+Capture. There is no order in Zen Cart.

Anyone else see this?
Any evidence it's related to Zen Cart at all?

[jeking]

A third client is reporting the same scenario, authorizations for less than $1.

[jeking]

No one else has had these happen?

[carlwhat]

customers are potentially updating their credit card information. these under $1 authorizations are used to validate the new credit card data.

i would look at the access logs or if your 3 clients are all using my card on file module for time stamps at the same time on the customer credit card table as the time stamps for the $1 auth.

[jeking]

Thanks Carl, but this is not for your card on file plugin. None of these clients are using it, sorry. This is the built in authorize.net plugins, AIM version. One of the sites is a non-profit I work with. We have 8 yesterday and 13 so far today. All different names and card numbers. All under $1. All authorize only, yet the plugin is Authorize+Capture. Most are declined but some have been approved pending capture.

I don't see how this can be happening through Zen Cart directly. There are no products at these amounts and the transactions would be captured, not authorize only. I'm concerned the bad guys might have found a way to bypass Zen Cart, use the authorize.net plugin capabilities to run these transactions looking for valid cards.

[carlwhat]

i would change all passwords as well as the api keys.

[jeking]

I got a hold of authorize.net. They also feel the a.net account credentials had been compromised. All that's needed it the gateway id and transaction key for a bad guy to run their own connection. This explains the random amounts and Authorize Only.

A new transaction key and new passwords all around is the order to today.

[swguy]

Bad guys never sleep.

[jeking]

Bad guys never sleep.

I don't mind they don't sleep. I do mind them stealing credentials!