declined transactions charges - card slamming - eway gateway

Hi,

I'm posting here as I don't want this sort of vulnerability discussed in the open forums.

I'm using zencart 1.3.9h, apache server.

Recently I received a higher than expected fee from my EWAY credit card processing people. When I investigated it I discovered that one particular client had put in the same transaction 30 times, apparently after it was declined for some reason on each occassion. What I didn't realize till now was that the banks and Eway will charge a transaction fee of $0.50 on each attempt. This was quite worrying because it means than any malicious attempt to spam the site with fake orders would generate quite a high fee in a short time, possible tens of thousands of dollars per hour.

Eway said I'd need to protect myself from my end, meaning I need to find a way for Zencart to
do the following:

Limit the number of declined transactions from same customer IP
Limit the number of declined transactions from same credit card number.

My question is, can we achieve this and if so how do I do it?

Regards
Robert

Zen Cart already has built-in "credit card slamming" prevention insomuch as it logs the customer out after 5 failed attempts to make a payment, such as would occur if they were testing a batch of card numbers.

If you wanted to do more isolated restriction based on tracking specific IP addresses and card numbers, you could certainly do that by writing your own custom code to handle it. Be sure you follow safe OWASP guidelines and PCI security guidelines around how you store those card numbers, else you could be deemed a participant in fraudulent activity if you've stored card numbers on your server, whether they were real or not.

Your custom code would go in the same section where credit-card slamming detection is presently handled. A simple search in the code for the word "slamming" will get you to the relevant bits quickly.

Sorry we don't have any code to just slap onto the site to handle all that stuff. We only see people talking about this sort of thing maybe once or twice every couple years. It's declined significantly since adding the slamming prevention awhile back.

Hi DrByte,

Thank you for your reply. Ok, its good to find out there is some sort of "slamming" protection involved. One particular client placed 30 such transactions and its not clear how he was able to do that. I guess he just logged back in.

I'm not worried about the occasional lost money due to people making honest retries. What was keeping me awake at nights was the thought that I might come in one morning and find myself with $100,000 worth of bank fees because someone had set up some sort of automated bot. Its unlimited liability and it didn't seem like I had control of it.
The banks aren't very sympathetic once you own them money, and my credit card processor EWAY was useless, preferring to shrug their shoulders and say "sorry, you're on your own"

I'd write my own code if I knew how to code PHP, but I don't. I could learn but I'm running a one man electronics design firm and I'm flat out working 7 days a week as it is so I doubt I'll get a chance to teach myself what I need to know.

Anyway its good to know there is some protection built in which is probably enough for now. Although I'm surprised malacious hackers haven't tried to make use of this feature to wreck havok on peoples sites before.

Regards
Robert