Preventing Stripe Fraud?

[SMMFlare]

Hey guys!

I'm using stripe to accept payments on my SMM related business.

Today i got hit with about 10-20 $20 transactions (via stripe) that were very obviously fraud. They were all made from an Iraq IP address, with the cards being in USA, as well as majority of them being declined and 10-20 being successful.

I sorted it out manually with a bit of a monetary loss, but wondering how I can prevent this in the future from happening again?
Does enabling 3DS in the radar settings totally eliminate this risk? Seeing as on the payment information, it states:


'3D Secure was attempted for this payment, but the customer hasn’t been verified by their bank. This payment is still protected from being disputed for fraud.'
With that link refering to this page:

'Payments that have been successfully authenticated using 3D Secure are covered by a liability shift. Should a 3D Secure payment be disputed as fraudulent by the cardholder, the liability shifts from you to the card issuer. These types of disputes are handled internally, do not appear in the Dashboard, and do not result in funds being withdrawn from your Stripe account.

Liability shift can also occur when the card network requires 3DS, but it isn’t available for the card or issuer. This can happen if the issuer’s 3DS server is down or if the issuer doesn’t support it, despite the card network requiring support. During the payment process, the cardholder isn’t prompted to complete 3DS authentication, because the card isn’t enrolled. Although the cardholder didn’t complete 3DS authentication, liability still shifts to the issuer.'

 

[Dopious]

There were someone else in the forum that got hit with thousands of charges, criminals testing credit cards is a huge problem lately. Do a search in the forum, I don´t remember what the thread was.

 

[Ndiqi]

Just enable 3DS authentication to prevent fraudulent payments, you will see less purchase and minimize your monetary loss from dispute / chargeback.

 

[SMMFlare]

Just enable 3DS authentication to prevent fraudulent payments, you will see less purchase and minimize your monetary loss from dispute / chargeback.

Looks like that is the only way to go. Does this actually prevent unauthorised chargebacks entirely as advised by stripe?

 

[Rakzs]

As mentioned above, 3DS will be the best way to stop it.
However, if Stripe allowed an Iraq IP Address to make so many charges on an American card, it shows that there is little to no security in place on your gateway. No payment gateway should allow such an obvious fraud charge.
Understandably, it can be more problematic if the fraud charges are harder to recognize, but them allowing such an obvious charge honestly is unacceptable and would be a deal breaker for me.
It could be an issue with poorly configured stripe (their default settings also kind of suck).
You can look into modifying the gateway settings/security, and maybe into Stripe Recon.

 

[Mrnewbie]

There were someone else in the forum that got hit with thousands of charges, criminals testing credit cards is a huge problem lately. Do a search in the forum, I don´t remember what the thread was.

Maybe it's this thread https://www.blackhatworld.com/seo/f...do-you-guys-deal-with-fraud-and-shit.1420733/

 

[crisisss]

Use their radar (it's worth it) and definitely enable 3DS

 

[Dopious]

Maybe it's this thread https://www.blackhatworld.com/seo/f...do-you-guys-deal-with-fraud-and-shit.1420733/

Na, it was someone that got thousands of $ in fee´s so he got a huge amount minus in his account. I tried to search it, but can not find it now.

 

[BassTrackerBoats]

You are reselling SMMservices... I am pretty sure Stripe is not a fan of that.

 

[Rakzs]

Maybe it's this thread https://www.blackhatworld.com/seo/f...do-you-guys-deal-with-fraud-and-shit.1420733/

Na, it was someone that got thousands of $ in fee´s so he got a huge amount minus in his account. I tried to search it, but can not find it now.

I believe it's this thread being referring to, but correct me if I'm wrong

 

[Dopious]

@Mrnewbie This was the thread, it was not a member here, but a user on reddit, @Yes posted about it.

https://www.blackhatworld.com/seo/assholeoftheday.1434160/
Edit: @Rakzs yes that was it.

 

[Rakzs]

@Mrnewbie This was the thread, it was not a member here, but a user on reddit, @Yes posted about it.

https://www.blackhatworld.com/seo/assholeoftheday.1434160/

We posted it at the same time, guess we're post twins now

 

[Mrnewbie]

I believe it's this thread being referring to, but correct me if I'm wrong

@Mrnewbie This was the thread, it was not a member here, but a user on reddit, @Yes posted about it.

https://www.blackhatworld.com/seo/assholeoftheday.1434160/

Good find, as it's beneficial to the community.

 

[BassTrackerBoats]

We posted it at the same time, guess we're post twins now

 

[Ndiqi]

Always use 3DS, you can still get dispute and chargeback but you won’t be paying additional fee if what they are saying is true. And you will be less likely hit by fraud.

Another thing you can do is adding more layer of protection on your site that put balance into pending for suspicious transaction, if it were automated in the first place. Ask them to verify their payment before you authorize the balance in their account.

I think you ought to check your competitors and see how they process payments.

 

[tidelow]

The solution is building your own anti-fraud layer, as CC processors do not provide enough protection from this type of attack from stolen card checks.

I have this integrated with checks on users before they even reach checkout page:

https://fingerprint.com/

You can very easily stop any malicious intent as most people attempting fraud at small or large are not sophisticated enough to run each transaction with completely unique footprint. It would be too costly and time consuming for them, making it more difficult than other sites is your best protection and they will not think twice to move on to a easier site to attack.

 

[Ndiqi]

The solution is building your own anti-fraud layer, as CC processors do not provide enough protection from this type of attack from stolen card checks.

I have this integrated with checks on users before they even reach checkout page:

https://fingerprint.com/

You can very easily stop any malicious intent as most people attempting fraud at small or large are not sophisticated enough to run each transaction with completely unique footprint. It would be too costly and time consuming for them, making it more difficult than other sites is your best protection and they will not think twice to move on to a easier site to attack.

This also a good solution, all you have to do is make it hard for them just once and they usually don’t return anymore.

 

[Rakzs]

The solution is building your own anti-fraud layer, as CC processors do not provide enough protection from this type of attack from stolen card checks.

I have this integrated with checks on users before they even reach checkout page:

https://fingerprint.com/

You can very easily stop any malicious intent as most people attempting fraud at small or large are not sophisticated enough to run each transaction with completely unique footprint. It would be too costly and time consuming for them, making it more difficult than other sites is your best protection and they will not think twice to move on to a easier site to attack.

This is great advice, another good thing to do also is to add something to track etags.
Many times it can help you identify fraudsters, especially since it's relatively unknown.
This is a good video which explains it.

 

[0xxi3]

Looks like that is the only way to go. Does this actually prevent unauthorised chargebacks entirely as advised by stripe?

Most of the time. There are still problems with Apple Pay for Visa cards (supposed to get resolved this fall) and a few banks that will not honor liability shift. Another thing to keep in mind is that liability shift prevents chargebacks that are labeled as fraud, customers will still be able to raise chargebacks such as non-delivery against you.

 

[MakeCoolDays]

I'm using stripe to accept payments on my SMM related business.

WTF !!! Why are people still using Stripe, Paypal, card (merchant) processors for SMM, etc related businesses ? Are you folks nuts or are your bolts that loose ?
Stripe, Paypal, card (merchant) processors will these days freeze your account(s) and rob your money in broad daylight incase you are receiving payments for non-physical goods or services.
For Heaven's sake, I beg all you people to please atleast now wake up, see the reality and accept the reality as it is.
If your product or service is not a physical product or service, then DO NOT use Stripe, Paypal, card (merchant) processors, etc. Accept crypto payments and remain safe from getting scammed OR just go ahead and provide all your non-physical goods or services FOR FREE without crying like babies saying "Paypal stole my money", "Stripe put a hold on my account & later they stole my money".
Times have changed and buyers of non-physical goods & services are almost all already aware of crypto and are using crypto and have absolutely no issues paying using crypto. Please wake up dear people. Wake up from your sleep !!!