Can anyone tell me if this is possible?

Hi all,

I am just wondering is it possible for some lowlife who knows what they are doing to effectively 'filter' someone elses checkout and steal a percentage of their orders?

No, I don't want to do it but I fear that it may be being done to me.

Reason I ask is, since launching my site I have had 2.4% sign ups from nearly 3,300 unique visitors but only just over 1% sales?

Nobody needs to sign up to see information as prices, postage, payment options, terms, etc. are all clearly visible, I even have the checkout without account mod installed so they no longer even have to sign up for that!

So, people have to be signing up for a reason right? If not to order, what could that reason be?

Since the start of the new year for example, I have had 20 sign ups, yet only 9 orders, also one of the orders was done using COWOA, then the day they recieved the items (yesterday) they signed up for a proper account yet have heard nothing else, no messages, order, anything, this is the one I am most worried about as it is a MAJOR UK banking group so potentially a very good customer!

Anybody got any ideas if the checkout can be filtered to send x amount of orders elsewhere? If so, what would I need to look out for to stop it?

Or could it just be coincidence and I am being paranoid?

It's just strange to me that approx 55% of my 'customers' haven't ordered, granted, the odd few could change their mind, etc. but over half, especially when all the info they need is there without having to?

Appreciate any advice on this,

Thanks in advance!

If the "checkout can be filtered to send x amount of orders elsewhere", that would be a major security exploit and would raise every alarm bell in five counties. Unless you are the first victim of a new hack, this is not happening (and if you have noticed it for a month or more, if it was a hack they would be doing it to thousands of others by now). So yes, you are just being paranoid:)
That does seem like a large ratio of signups to orders, but you would need to compare with industry averages to know if it is really an anomaly. There might be something about your ordering process that isn't as user-friendly as you think. Do you have a lot of cart abandonment?

gjh42:

If the "checkout can be filtered to send x amount of orders elsewhere", that would be a major security exploit and would raise every alarm bell in five counties. Unless you are the first victim of a new hack, this is not happening (and if you have noticed it for a month or more, if it was a hack they would be doing it to thousands of others by now). So yes, you are just being paranoid:)
That does seem like a large ratio of signups to orders, but you would need to compare with industry averages to know if it is really an anomaly. There might be something about your ordering process that isn't as user-friendly as you think. Do you have a lot of cart abandonment?

How would I know if I had cart abandonment?

Sorry this is my first store so am still learning, I do have google analytics installed but have never been able to get the conversion part to work.

This has been happening pretty much from the start, I'll get spells where I may get one or two orders out of five or six sign ups.

I wasn't thinking so much of a hack but I will PM you this part if ok as I do have a bit of a suspicion.

Thanks for your response!

Even the cPanel basic visitor stats should be able to show you something - there is a "last 200 visits" where you can see every resource requested in sequence by a visitor.

gjh42:

Even the cPanel basic visitor stats should be able to show you something - there is a "last 200 visits" where you can see every resource requested in sequence by a visitor.

Will have a look into it but like you say I am probably just being paranoid, just thought I would ask those who know more than me for an opinion.

Thanks again for your help!

People creating accounts doesn't mean nothing. Sometimes they create an account with intention to come back and buy at a later time. Sometimes they try to purchase something but their card gets declined.

There is a mod caller supertracker: http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=683 it will show you customers behavior on the site and see on which page they will abandon your site.

Otherwise your doing good for a new website.

Well, if someone was siphoning off a % of your orders, wouldn't you start hearing from customers who claim to have purchased an item and never received it, and you have no record of the order?

But to answer your actual question, yes, such an exploit is not only possible, the idea of swapping out payment modules or configs so customers money goes elsewhere is a topic of some discussion amongst the scum who would do such things. But as far as I know, there is not at this time a viable script to do this. And as long as you have all the latest patches and directory obfuscation done, you should not be a victim of such nasties. Seems script kiddies are a dime a dozen, but real programmers are rare.

Is there some other reason why folks might create an account with you other than to buy something? Maybe login is required to use "tell-a-friend" or something?

Its most likely not being done.

I visited your site, and after adding products to cart, checkout_shipping wasnt even loading.

Its possible that they are getting some errors during checkout/ shipping/ payment pages.

Test your site and place dummy orders from cumputers other than yours, and also test it in different browsers.

My ratio when i first launched my site was 30% signup/purchase...
now it is about 85%.

you will need to learn how to streamline your checkout process. PM me i will send you some articles and advice on how to do so.

( and yes, the person above me is right, if your customers were being stolen, you would have heard from someone by now)

Goodluck