Fraud scammers running credit cards. What can we do?

[Peter_Canada]

We are getting hit with tons of fraud scammers testing credit cards on a single item in our store. Started using BLOCKY app which definitely works and blocked some countries and persistent IP's and ranges of IP addresses as well as high risk poxy, etc.

Still getting hit while only the occasional one makes it thru as a legit order (which we cancel) there are a few things in common:

• customer name is in all small letters, no CAPS
• street address is usually just the ZIP code, not an actual address, although a few days ago some had legit looking addresses
• email is not legit, it is always in format "customername ##### at g ma-i-l . c-o-m" where customer name again is lower case letters and the number is anything 5 digits long.
• phone numbers could be made up too we haven't tried calling any
• order is generally placed thousands of miles/kms from shipping address
• cvv doesn't match
• usually incorrect billing address

So they likely have a bot or a well-oiled boiler room testing credit cards.

BLOCKY has been pretty helpful. However, we have more than 50 abandoned carts in just 6 hours or less. Abandoned carts don't show IP address (shopify's privacy) so I'm SOL for blocking them. All I have is BLOCKY analytics which you can see last 100 IP addresses of visitors and who's blocked, etc but sometimes impossible to tell who the offender is as they likely fill the cart leave it for a while then hit BUY button.

I'm concerned our credit card processor will shut us down at some point for all the fraud attempts.

Can we add a checkmark or something to the shopping cart if this is a bot? Since shopify's cart is the same for most stores it means we are all at risk for this scamming.

So far shopify hasn't been very helpful.

[dylanpierce]

Sorry to hear that. This is a problem that plagues any B2C business online.

For context, I build Blockade which was a similar app to what you're describing. However I shut it down because of the reasons you're listing.

1. Shopify doesn't allow apps to server side redirect, before the page is loaded.

Therefore any Shopify app that claims to block requests isn't technically true, these apps can't work until the page starts to load. This means that any mildly sophisticated bot can ignore the JavaScript redirect that these Shopify apps try to perform when the visitor matches one or more of your rules by IP address, proxy detection, etc.

You can't beat the bots unless you can block the website from loading before the page is rendered.

2. IP Addresses are easily proxied, and proxies constantly change

The bad guys pay for cheap proxy services to hide their true IP address, or deploy their bots to different hosting platforms to prevent detection. Trying to identify bots on IP addresses alone is not possible from your perspective only.

This is why Shopify partnered with Cloudflare, which in my opinion is the best bot deterrent on the market. However, Shopify has paywalled this Cloudflare solution for only Plus stores.

So my recommended solutions are:

1. Upgrade your Shopify plan to qualify for this Shopify Bot Protection (which is just Cloudflare under the hood)

2. Find a way to transfer your store's domain to Cloudflare and find a way to enable bot protection on Cloudflare natively while pointing the domain to Shopify (might be tricky, or not even possible because Shopify wants you to pay for a higher tier subscription)

3. Use the new Shopify Cart Validation Functions to maintain a list of IP addresses/rules for denying access to checkout. However, this will require a developer and it's not generally available to app store apps yet. And you'll still have the job of keeping up with the cat & mouse game of testers changing their automations slightly to beat your rules.

Hope this helps,

[Peter_Canada]

Thanks for the info. I'll look into your suggestions.

It's unfortunate that shopify isn't looking at this type of security breach. Doesn't inspire confidence going forward.

[dylanpierce]

Of course, happy to help.

I agree, they may have decided to paywall Bot Protection before card testing was so pervasive.

I think the original value proposition for Bot Protection was for high end stores to protect against bots automating drop purchases purely for scalping. Here's a really good NYTimes article about it if you're interested: https://www.nytimes.com/interactive/2021/10/15/style/sneaker-bots.html

But card testing effects all Shopify merchants, and botters get the same value of testing against a Free Shopify site versus a Plus. So they can just write their automations for low plan Shopify shops and there's not much recourse at the moment.

[Peter_Canada]

Thanks for that so here's the suggestion we are trying for the moment. It's not great for the customer as they need to enter their email address for a one-time verification code to be sent. If the email is not legit, they can't complete checkout. We'll see if it's working in an hour or two.

From helpful support @ Blocky:

I would also like to propose a great solution that is working great for other users of us that are experiencing the same issue - using the new Shopify user accounts for checkouts. This will require all customers to register an account with your lovely store before placing an order, and thanks to Shopify's new account management options, the registration process occurs on Shopify and is being verified by them, so no fake emails can be used, and it should prevent all of the fake abandoned carts and customer accounts. You can also try that for a few days and see its effect in you store

Here's how to turn it on -
Go to the checkout settings page: (go into your store settings)
Tick the "Require the customer to log in to their account before checkout" option
Click Save
4, Then, go to: (customer_accounts experience link)
Make sure that the "Show login link in the header of online store and at checkout" option is ticked, and under it, select the "New customer accounts Customers will log in with a one-time code sent to their email." option.
Click Save.

More info here: https://community.shopify.com/c/shopify-discussions/change-send-email-id-for-quot-customer-accounts-... but website seems down 503 error at the moment?

[dylanpierce]

Thanks for sharing that, I didn't realize that you could require a Shopify account before checkout. That is an interesting idea.

Then you require email verification, which isn't hard to pass with enough technical know how, but it does add a barrier for the bad actors jump over.

Just to reiterate, this won't be an end all solution, you can bypass this by programmatically interfacing with Gmail to pass the code. Or use a custom domain, it's definitely possible. But it will definitely weed out some bad actors.

I would encourage anyone that is considering this to keep in mind that extra steps of verification like this might harm your conversion rates. Make sure you monitor your conversion rate before and after implementing a change like this and make sure it's not doing more harm than good.

In some cases extra verification is actually a good thing and sends a good signal, if it's a high end purchase for example. But if your store is on the lower end of AOV, then this might cause more harm than help.

[Peter_Canada]

Conversion rate is the worry. Was sweating bullets until the first new order came thru.

[Peter_Canada]

So far sales numbers are ok.

[Tarnish]

Agreed. Seems like something Shopify should have built in so bots can't steal cc info.

[dannyshane]

Oh damn, I am new to shopify, but I have a site on Magento where I have card attacks that would literally run tens of thousands of card attempts within an hour. hundreds per second. But in magento I used Braintree as a processor and I... (1) I used AVS and declined any transaction that the address did not match the credit card billing address. (2) I set a few fraud rules  "Reject when 5 or more transactions have the same customer ID within 30 minutes" and "Reject when 5 or more transactions have the same credit card number within 30 minutes".   

That prevented any successful transactions but that card attack still shut my site down while it was going on because it was just too many transactions. and the processor wrote me.  I then put up a google recaptcha on the checkout page. We will see how that goes. 

But I just launched a site here on Shopify.  It seems crazy that there is no way to prevent that. I adding to this post in hopes that if there is ever some tool to prevent card attacks, that I will be notified also. 

[Peter_Canada]

Hey thanks for sharing. There should be A LOT MORE coming directly from Shopify to help deter these kinds of fraud attempts.

So far with adding either customer needs to login or enter valid email address to continue to payment has curbed the bs cc scams. Fingers crossed. But these jerks (who should get a real job) scamming cards are always coming up with new ways to screw the system. The biggest issue is that most shopify shopping carts use the same generic format so creating a bot to thwart security stuff is almost too easy for the scammers.

Unfortunately we aren't using shopify payments (they kicked us off), since shopify's cc processing contracts with Stripe/Wells Fargo/etc make even Canadian stores beholden to lazy USA credit card classification rules. Essentially they lump health canada licensed products with "quasi pharmaceuticals" like the blue pills - simply because Stripe is lazy to add a legit class for our products. This is the disadvantage with any corporation that goes south to USA. Anyway, don't get me going on that garbage.... lol  I'm sure if we used shopify payments there might be more protection for cc scammers but who knows? 😕

[Pripri]

about you approve the transaction manually ?

Then you check the fraud analysis, it will tell you if the adress matches the registered billing adress, and the cvv, etc If not, then void the order. 

You can also block these customers from coming back with Cozy antitheft. I had some idiots who tried and tried again, and when I would void their order, they would contact and be angry with us ?? fake names, adresses, we told them we can call the credit card company to help them understand it has to match or they can do on their own. But we block them afterwards. 

[Aaron2024]

I have a bot that runs credit cards every day. The only way to stop it is activate log in before check out, which is really bad for conversions. Ive messaged with Shopify support 7 times and they arent doing anything about it. Ive tried Blockify and it didnt work. So frustrating might just need to leave the platform. 

[Pripri]

Why don't you accept manually ? Like this if they do not seem legit, since, you have 5 days to approve, thye will cancel themselves

You go to Settings, Payments and at the bottom, Payment capture method. Pick manually. and choose Manually.

We do this to check every transaction and we void when we want to let the customer know, otherwise, it voids by itself. But we never accepted the money.

The ones we suspect, but not sure, we accept, but take our sweet time to ship, almost a month, enough to give time to the one who got their card stolen to report it, or to give us more time to search into the buyer. Anyway, Manually is better, and as for that bot, they will bot by themselves doing so

[dylanpierce]

Exactly, setting up manual payments isn't that difficult.

Also, now that Shopify Flow is available for free on all plans, you can easily automate capturing payment on non-risky orders.

That way you save a ton of clicks by "automatically" capturing payments on regular orders, while these fake orders can be manually captured without risk of a chargeback.

[Pripri]

Na, bad idea because shopify does not help with chargebacks. Amd their fràud app says no risk to approve orders when in fact when you look into the report, the customer uses a fake billing adress.

[dylanpierce]

Sorry I could have been more clear, I'm not referring to the Shopify Fraud Filter app

I'm referring to the Shopify Fraud Analysis that's provided for each order (no app required).

But, to your point, say you don't want to automatically approve payments if the shipping address doesn't match the billing address even if the Shopify Fraud Analysis claims the order is low risk.

Then you can still use Shopify Flow to not automatically capture orders with mismatching billing and shipping addresses _in addition_ to the Shopify Fraud Analysis.

Here's an example workflow that considers both the Shopify Fraud Risk analysis and if the order's shipping address matches the billing address:

 
Only orders with matching billing and shipping addresses will have automatic payment capture, otherwise you can add a tag to show these orders need verification, etc.

[Pripri]

What is the point ??

We have to verify anyway and will not rely on shopify for thos if they do not already. See how they handle chargebacks ?? Even in your right, shopify put their heafs in the sand. How can you suggest them as a secure way when they do not care already

Seriously, best way is to rely on our own  judgment.

[Pripri]

Even in your right, shopify put their heads (not heafs)in the sand. Sorry mistake typing. But i learned to stay away from apps in their store as much as i can. Couples i contacted from 2 new emails for infos and we started getting the same scams offers. Told shopify about this but of course they did not check.

We have to spend time checking each order and it is what it is. Because will certainly not start asking their ids, right? I almost had a fraud done to me and equifax told me to never give my birthdate to anyone or i would be responsible. And also, never give out your driver's permit to anyone unless being stopped by a cop. Not to get a phone line, etc. I was told to remove ids infos everywhere the other day because there was a lot of fraud since covid. So you understand that i would not give my id to buy 3 pairs of socks 😀

[dylanpierce]

There's a spectrum of customer verification, and ID verification is on the high end. It's an industry standard for rental marketplaces like AirBnB, Turo, etc. It's also required for high end purchases like jewelry or where chargebacks are extremely costly like auto parts.

I would never recommend ID verification for cheap orders, but there are other ways of verifying orders to prevent fraud even with low order values:

* Email verification
* SMS verification

* Phone verification

You can send a unique code over any three of those channels to help prove the customer's phone number and email address. Criminals are often using disposable emails and phone numbers and can't keep track of the messages across all of their inboxes. Or even more likely they're too lazy to even use real emails and phone numbers. 

OTP (one time passcode) verification is a cheap and even more frictionless way of verification.

But ID verification has it's place in the anti-fraud toolbelt, it's just not for all.

[Pripri]

Well, I do not care who asks for it, they would not get it from me. They will get a library card, but no way, will they get a driver's permit with adress, age and all kind of info a scammer can use. What you are not thinking about is at the other end, the person who takes the orders from the website, the secretary that could be asking for it, or the shipper, I have to trust them with my ID ??? Seriously ? 

When Equifax tells me we should never give our birthdate, I think I will follow their advice. EVEN if you had the id, for example, the 2 chargebacks we got, were people who were out there, quite known and played games with us, so, getting their ids was pointless because I could find out online who they were.  Ont was even a neighboor from someone we knew. The probllem was Shopify who did not send our answer to the credit card company when we gave the proof all was shipped and even the customer asking details about the stuff she had received then denying having them ? We had the proof, but Shopify did not do their job. Not much the little ID could do about this right ?? We called Visa and they said they had never gotten our answer. 

If anyone asked for my ID, i would tell them to get lost and cancel the order.

At the end, we have to double check every order because Shopify's chargeback system is worth minus 1000. 

[dylanpierce]

I understand ID documentation is not a viable solution for you, but that doesn't mean it's not essential for different merchants and industries. We help online pharmacies as well as implement age verification beyond self-reporting your own birthday.

I totally agree, private details shouldn't be viewable by just anyone. That's why we provide controls to limit whom can view this data - including at the per staff level. I respectfully disagree with your claim regarding entering in personal information online. Parts of the internet is more dangerous because identity is disposable.

We have also helped overturn fraudulent chargebacks based on ID evidence provided at checkout. But what we hear most often are the dramatic drop in chargebacks, just because friendly fraud (also known as first party fraud) is mostly a crime of opportunity.

> At the end, we have to double check every order because Shopify's chargeback system is worth minus 1000. 

Genuinely curious, what do you mean by double check? What is your process for judging if a customer's order is legitimate, like you said they can file a chargeback based on non-fulfillment. In theory those orders won't trigger Shopify Fraud Analysis because the billing and shipping details line up. 

[Pripri]

Honestly, do not get what you are trying to say at all. And you must be selling apps to be pushing for something without reading people's situations

One chargeback

This lady ordered 2 items. All was going through, billing adress matched, cvv, etc. AND she was known and neighboor from a friend of the company (though she did not know that) SO, SHE EXISTS You got me until now  ??

And she has money. The order was only 500$

Are you still following me ?? Then, she asks if we have a different colors, we say yes. Then, she said I am returning rush UPS and here is the tracking but please reship asap. Since we knew someone who knew her and she said the package was gone, we reshipped two more items but we never got back the other two AND SHE ASKED FOR A CHARGEBACK !!!!!!!! No reason at all, lying she had shipped and UPS confirmed not picking up anything from her

So, we lost the chargeback because even with the proofs that she had not reshipped and she did not even wait one day after asking for return, she asked a chargeback, but we lost

The whole story was crazy

But few months later, the lady comes back and says I have 4 items but would like a 3rd version. SO, SHE ADMITTED. We called the credit card company, they were going to open the file for us  aid that Shopify never gave them our answer .. 

We contacted the lady and said, we will report you to the credit card company and she refunded us.

But she was legit

Unless there is an app that can spot legit people and have a cristal ball that they might try to steal, not interested

[Peter_Canada]

We've implemented an email verification or login to shop. So basically the CC fraudsters don't have legit email addresses. If they want to actually get to checkout they need to either enter their legit email address to which shopify sends them a one time code, or they can login before checkout. This prevents scammers testing cc's. It makes it slightly more difficult for us because we can't use shopify payments, we use moneris 3rd party.

[linia]

Just bumping this thread to note I'm having the same issue - bots from Russia and the US (I think it's the same one disguising its IP) trying to buy a $1.25 item (always the same one) every 6 or so hours.

The bot is trying to pay via credit card unsuccessfully, but I'm nervous in case of a successful attempt.  I'm worried it would download all my digital inventory and steal my store basically (I sell only digital templates).

My feeling is that help/support against these bot attacks should be part of the foundational offerings of Shopify. We shouldn't need fancy development or buying extra modules for this, as the bots are becoming very prevalent, messing up automations and statistics, and are dangerous if they succeed.

So adding my vote here for a future (soon hopefully) fix.

[Pripri]

Just pick the option to accept payments manually, not automatically. They have this set-up in shopify. You have one week to accept the charge and if you do not, it does not go through and cancels automatically.

It will give you time to review

[linia]

Thanks, Pripri - looking into it!

[Pripri]

You go to Settings, Payments and at the bottom, Payment capture method. Pick manually. and choose Manually.

Ps, wonder if yoir set up of downloading as soon as paid will work with this. We have to ship items so it works for us. But test ot or set it up wot a delivery date as well ?

[linia]

Yes - you nailed exactly the issue I'm thinking about: the auto delivery email.  So still considering the options open to me, but I appreciate adding this one to the mix.

[Pripri]

Legit email does nothing for us because we were exchanging e mails with the chargeback people before they did and after. Even phone calls.

The problem for a 1000 time is that if we are in our rights and provide the proof to shopify to pass on to the credit card company, itbis apparently npt send to the credit card company. But we called the credit card as well and that will mess up their future try outs.

[abfielder]

Just wanted to say this is still a major problem, I run a store selling digital items and I've had to turn on users must be logged in to order. I was getting hit with hundreds of fraudulent orders a day, different names, card numbers and email addresses but literally all using the same postal address. I set up manual payment capture so at least it wasn't costing me but it still completely messes up your store with things like reports and user accounts not to mention the ridiculous number of alerts. Amazingly some orders using this address weren't even flagged as high risk (or medium risk). The AVS stuff did nothing the orders still go through, which seems odd but shopify support didn't care.

However by turning on must be logged in the conversion rates lower, so by doing nothing else to help prevent this shopify are losing out on money as well.