Hacker creating account and using Authorize.net to check credit cards

Hello,

I have someone that is creating a fake customer account and then somehow using my Authorize.net account to test and see if their stolen credit card numbers are any good.

The Zen Cart customer account gets created, and I get notified of this, however I have no other notification of fraud unless I log into my Authorize.net account and see all of the declined transactions from the same fake customer account.

Please help me better understand exactly what is going on and how I can rectify the situation.

I did delete the customer and put the website in maintenance mode for a couple days, but he came right back. The customer IP address seems to change so blocking the IP address will not resolve the problem.

Thank you,
Mike M.

Well, technically they are not 'hacking' anything.

dgent:

Well, technically they are not 'hacking' anything.

OK, so they are just creating an account and trying to place orders one at a time with different credit card numbers? Any suggestions?

Thanks,
Mike

There is nothing you can do about it if the IP is changing and I wouldnt worry about it.

All they can do is keep trying numbers, and if they ever get one that does go through, as you are aware of this person and the illegal activity, its not like you are going to send the goods out anyway. So I wouldnt lose any sleep over it. In fact putting your site in maintenance mode is more harm than him as you're not getting any sales.

dgent:

There is nothing you can do about it if the IP is changing and I wouldnt worry about it.

All they can do is keep trying numbers, and if they ever get one that does go through, as you are aware of this person and the illegal activity, its not like you are going to send the goods out anyway. So I wouldnt lose any sleep over it. In fact putting your site in maintenance mode is more harm than him as you're not getting any sales.

OK, thank you for the posts and feedback.
Mike

At the risk of dgent accusing me again of posting something "not helpful", I would suggest you talk to your merchant account service first. They deal with this situation all the time and will have some suggestions.

There are some other forum discussion threads talking about the same thing, with various people having their own acclaimed expertise. Your mileage may vary. But it's worth a read.

And do note that with many merchant accounts you're paying for each one of those attempted authorizations. So that's another reason to talk to your merchant account service provider to see how they would handle the situation, and maybe they'll try to help minimize the fees somehow.

If they charge you for declines, ditch Authorize.net

Well talking to your merchant will do you no good, they won't do a thing to you. If it was that easy to prevent crime before it happens then there would be no reason to have law enforcers.

There is nothing you can do unless you can narrow down the IP address or IP range and block them from accessing your site which is a risk unless they are coming from a country you don't do business with.

As far as charging you, it is very common to have transaction fee per order which is usually minimal fee such as 1-5 cents, that merchant apply to each time the transaction is processed even if it gets declined, that is still considered transaction.

If you sign up for Authorize.net Fraud suite you can add filter for how many attempts a customer can make within preset time, you will also be notified every time an order is declined or a filter is triggered based on your selected filters.

You shouldn't ditch a merchant just because of the way their fees are structured, you must of read the agreement before signing up with them. Most merchants have some minimal fees per order if you wish to get good rate on transactions.

CoolCarPartsOnline:

You shouldn't ditch a merchant just because of the way their fees are structured, you must of read the agreement before signing up with them. Most merchants have some minimal fees per order if you wish to get good rate on transactions.

I wasnt saying ditch them because they have fees, more in so that they have a system that can be abused so easily, and rack you up fees.

May be worthwhile writing a mod to temporarily block a user/ip after x attempts in a given period... Even if they can change their IP, it may be enuogh to deter them to another website.

We're charged 15c per transaction for address verification on every attempt. Some legitimate customers can't figure out how to find their CCV and will try 5-10 times before contacting us saying the card doesn't work = $1.50 for nothing.

If you use Fraud Suite with Authorie.net you can add filter for that automatically.