Ways to prevent fraudulent orders

Using 1.5.7d, with Access Blocker installed.

I have to delete 20-60 new accounts every day from people using a different credit card number each time and a new user name each time. Paypal (our card processor) catches every one of these and prevents a sale from actually going through, but it is getting tedious. I do have Access Blocker installed with a link to ipdata dot co, and I'm adding to the IP address cache on Access Blocker every day. But of course they just spoof a different IP address.

Does anyone have other ideas to prevent fraudulent accounts from being added in the first place?

HeleneWallis:

Using 1.5.7d, with Access Blocker installed.

I have to delete 20-60 new accounts every day from people using a different credit card number each time and a new user name each time. Paypal (our card processor) catches every one of these and prevents a sale from actually going through, but it is getting tedious. I do have Access Blocker installed with a link to ipdata dot co, and I'm adding to the IP address cache on Access Blocker every day. But of course they just spoof a different IP address.

Does anyone have other ideas to prevent fraudulent accounts from being added in the first place?
Since you've registered at ipdata (dot) co, perhaps checking to see the country associated with the IP and blocking via country-code?

lat9:

Since you've registered at ipdata (dot) co, perhaps checking to see the country associated with the IP and blocking via country-code?

I'll try that, but I suspect they will just spoof a different IP. I've blocked probably a dozen so far and they have all been from different countries.

Is there anything else common to these created accounts? For example, I've seen specific email domains being used.

If there is, send me a PM with that information and we can chat about solutions off-line.

lat9:

Is there anything else common to these created accounts? For example, I've seen specific email domains being used.

If there is, send me a PM with that information and we can chat about solutions off-line.

Yes, but nothing that this person can't easily change if I block it. For example, he was using a specific company name. I blocked that, so he changed to using the same name but with a slightly different spelling. I've blocked that now too, but he'll just change to something else. All the domains he's using are in the US, so I can't block him by country. I block every IP address that he's using, and he just uses a new one. He creates a new account with each new attempt, using the stolen card's user name plus some random number at gmail, never his own. For example, JohnSmith33445566 at gmail dot com. So the account confirmation mail gets returned as no such user from gmail. I don't know how I would find his own email server info. If you can help with that, I'll definitely PM you. This is beginning to take serious amounts of my time, not to mention it's beginning to feel personally hostile.

HeleneWallis:

Does anyone have other ideas to prevent fraudulent accounts from being added in the first place?

I do, but its not easy. censored but all these measurements take also serious amounts of time (and coding).

What if he knows about this topic? "Powered by Zen Cart" and you are using your real name here.

nl2dav:

I do, but its not easy. censored but all these measurements take also serious amounts of time (and coding).

What if he knows about this topic? "Powered by Zen Cart" and you are using your real name here.

hmmm....

i think the whole point of open source is that the code is open and available for anyone to see.

you have found a security whole? great, we will plug it...

security by obfuscation is really not very secure.

as far as the OP's problem, i would potentially suggest the need to confirm an email address for an account PRIOR to placing an order, as well as turning off guest checkout.

as to whether there is a plugin for this or the need for custom coding i can not say....

best.

carlwhat:

hmmm....

you have found a security whole? great, we will plug it...

not really a security hole, there are just several ways to detect if you deal with the same person. This situation sounds like stalking. The thing with IP addresses (and blocking) is extremely old fashioned.

If its stalking then I would not want to talk openly about it, its a psychological disorder where a person wants attention. Only thing which helps is ignoring and shadowbanning, or in this case; "shadowing" orders (not reacting on them).

But this topic is not open, I didnt realize that. Only members can read it. So keywords are; localStorage, user agent logging, other fingerprinting techniques. (Its called browser fingerprinting).

nl2dav:

not really a security hole, there are just several ways to detect if you deal with the same person. This situation sounds like stalking. The thing with IP addresses (and blocking) is extremely old fashioned.

i would suggest you re-read what i wrote. i did not talk about IP addresses and blocking.

nl2dav:

If its stalking then I would not want to talk openly about it, its a psychological disorder where a person wants attention. Only thing which helps is ignoring and shadowbanning, or in this case; "shadowing" orders (not reacting on them).

But this topic is not open, I didnt realize that. Only members can read it. So keywords are; localStorage, user agent logging, other fingerprinting techniques. (Its called browser fingerprinting).

wow. psychology now.

in my experience, this individual is testing credit cards to see which are still good for potential fraud. but hey i could be wrong...

have fun. i'm out.

lets just pretend you were in.

nl2dav:

not really a security hole, there are just several ways to detect if you deal with the same person. This situation sounds like stalking. The thing with IP addresses (and blocking) is extremely old fashioned.

If its stalking then I would not want to talk openly about it, its a psychological disorder where a person wants attention. Only thing which helps is ignoring and shadowbanning, or in this case; "shadowing" orders (not reacting on them).

But this topic is not open, I didnt realize that. Only members can read it. So keywords are; localStorage, user agent logging, other fingerprinting techniques. (Its called browser fingerprinting).

I do not believe there is any stalking going on here. We've been hit for months now with attempted purchases of our least expensive items. Credit card thieves do this to find out whether a stolen card is still valid. At first there were just a few daily attempts, and I used the Access Blocker plugin to catch most of them. It has increased now to the point where it's taking hours of my time every day. As Carl said, verifying the email address before allowing a purchase to go through would stop most of this, but my days of programming are over. Even a couple of years ago, I could have done it, but age and Lyme disease have put too many holes in my brain, lol.

carlwhat:

hmmm....

i think the whole point of open source is that the code is open and available for anyone to see.

you have found a security whole? great, we will plug it...

security by obfuscation is really not very secure.

as far as the OP's problem, i would potentially suggest the need to confirm an email address for an account PRIOR to placing an order, as well as turning off guest checkout.

as to whether there is a plugin for this or the need for custom coding i can not say....

best.

That is absolutely the way to do it. I haven't found a plug in for it, and I'm no longer capable of writing it myself. Nor does the company have the money at the moment to pay someone else to do it, or I'd have already contacted them.

Any of you have any experience with the ZX AntiSpam and Email Verification plugin? I see it's several years old, and don't know whether it will work with my 1.5.7d installation. I've looked at PHPMailer, and might try to figure out how to include that in customers.php. But that's likely to take quite a while, and I'm still deleting 20-60 invalid purchase attempts every day.

HeleneWallis:

Any of you have any experience with the ZX AntiSpam and Email Verification plugin?
I might have some (limited) experience with it... :P

It will work with your 1.5.7 installation, that's for sure. You could add some custom rule (based on common factors you can pick up) or just require all customers to go through verification. If you're using OPC and Guest Checkout, I must admit I'm not 100% sure if the plugin will kick in - it might need some modification, but again, not sure, it's been ages...

balihr:

I might have some (limited) experience with it... :P

It will work with your 1.5.7 installation, that's for sure. You could add some custom rule (based on common factors you can pick up) or just require all customers to go through verification. If you're using OPC and Guest Checkout, I must admit I'm not 100% sure if the plugin will kick in - it might need some modification, but again, not sure, it's been ages...

Thanks, I don't use Guest Checkout. I'll look at it more closely.

I'm still fighting spammers setting up hundreds of fake customer accounts to test stolen credit cards. In looking through the code, I see many instances of "zen_validate_email" being called, but I can't find where it is defined. I'm not certain whether that's what i need or not, but if I can find it, I might be able to add to it or modify it to catch fake email addresses and prevent a customer account from being created.

its here

grep -R --exclude-dir=images "zen_validate_email:

includes/functions/functions_email.php: function zen_validate_email($email)

nl2dav:

its here

Thank you!