blackkatemoss
Newbie
- May 19, 2025
- 13
- 11
I founded an e-commerce marketplace startup. We use PayPal's Multiparty APIs (PayPal Commerce Platform) for checkout. For the 10 days, someone has been bombarding us with purchases that they later dispute. There's consistent pattern to it:
* They use an email address that has no footprint online, always from the same two domains * They use an unverified PayPal account to pay * They pay a low amount, not always the same, in a narrow range for a digital item * All of the charges were disputed within a few hours
They're not doing this through our API. The purchase process requires a browser because of the way our payment form is configured. There's an amount of variation to each purchase that tells us they're automating a browser. Logs indicate that they're changing IP each time. The events come in bursts and seem to be spaced to avoid automated detection.
We added the typical mitigations to our network stack and code. A few are still slipping through. Logs indicate a high amount of bot traffic.
PayPal does not seem equipped to deal with this. Their support is always extremely slow, relies on canned responses, and to date has a very limited understanding of how their own Multiparty APIs work. Their phone support people will not talk with me, they see no indication that my PayPal account is affiliated with these purchases in any way. They want each of our sellers to contact them independently, which we know will result in disparate cases that don't tell the complete story or offer any assistance.
Has anyone encountered anything like this before? We're struggling to find the motive or intended outcome by the attacker(s). We're a small company with a niche audience, we've never had a conflict with anyone that got serious enough that we'd expect them to come after us like this.
Any thoughts and recommendations would be greatly appreciated. We feel like we are on our own here and are unsure of how to handle it.
* They use an email address that has no footprint online, always from the same two domains * They use an unverified PayPal account to pay * They pay a low amount, not always the same, in a narrow range for a digital item * All of the charges were disputed within a few hours
They're not doing this through our API. The purchase process requires a browser because of the way our payment form is configured. There's an amount of variation to each purchase that tells us they're automating a browser. Logs indicate that they're changing IP each time. The events come in bursts and seem to be spaced to avoid automated detection.
We added the typical mitigations to our network stack and code. A few are still slipping through. Logs indicate a high amount of bot traffic.
PayPal does not seem equipped to deal with this. Their support is always extremely slow, relies on canned responses, and to date has a very limited understanding of how their own Multiparty APIs work. Their phone support people will not talk with me, they see no indication that my PayPal account is affiliated with these purchases in any way. They want each of our sellers to contact them independently, which we know will result in disparate cases that don't tell the complete story or offer any assistance.
Has anyone encountered anything like this before? We're struggling to find the motive or intended outcome by the attacker(s). We're a small company with a niche audience, we've never had a conflict with anyone that got serious enough that we'd expect them to come after us like this.
Any thoughts and recommendations would be greatly appreciated. We feel like we are on our own here and are unsure of how to handle it.
