This past entire month somebody has been placing numerous fraud orders through my site. He is obviously using my order form to run stolen credit cards through it to see if the card is good so that he can then go shopping with the stolen credit card. When he first started I did not even notice they were fraud and got hit with a ton of chargebacks thinking they were legit orders.
I am using AVS verification so the transaction gets declined if the AVS does not match. I am also using CVV2 verification so that must also match. I am also collecting IP's for every order.
The problem is that this sick mother f'er is using a program to hide his real IP and is also using a different IP each time. I KNOW it is the same person because lately he is always ordering the same package so it is obvious.
How can I get rd of this a**hole???
It's making me VERY angry that he is using my order form for this!!!!
I don't know what else other than what I am ALREADY doing to stop this?
And now he has also started ordering other of my packages as well so now it's VERY difficult to tell which orders are fraud or legit. I am thinking of forcing all new signs to fax me a copy of their driver's license... do you think that is a good idea?
If an order is legit I don't see why any customer would have a problem faxing me a copy of their driver's license if I mention it is for fraud prevention pruposes?
Depending on whether the proxies are public proxies he is abusing or malicious proxies that are part of a bot net, you may find the X-ForwardedFor header is present in the HTTP request and gives the real IP.
I have tried... I am not able to find the real IP. I use authorizenet and I have set their setting to collect the IP... I don't know how to obtain the IP in the way you have described "X-Forwarded for header present in http request"? If he is using one of those programs that allow him to hide his real IP and use whichever IP he wishes... then you can't find the real IP that way.
I think I am simply going to have to ask that all new orders fax or email me a copy of their driver license so that I can verify their identity because right I am literally having to guess each time an order comes through if it legit or fraud. It is a huge hassle!
I got hit with a dozen chargebacks because of this!! It is very difficult to tell sometimes if an order is fake or legit.
Either I have to call the phone number listed on all new orders and verify that way or get a copy of their license Id because this is ridculous.
But I am afraid asking for a driver's license verification might ward of some new customers, what do you think?
In the past I also put that I do not accept ANY orders if they use a free email account such as yahoo, hotmail etc... but that did not help.
Personally, I wouldn't order from an establishment that requested a faxed copy of my driver's license, unless I was making an unusual or substantial purchase. However, I wouldn't be bothered if I was contacted by a vendor prior to shipping for confirmation - provided they were polite and explained why they were contacting me.
Are you positive the IPs are truly random? Is it possible the IP addresses are from a pool of IPs used by a particular ISP? Are they all originating from a particular area?
Also, you said you were using the address verification feature, does this mean they're randomly shipping packages all over the place? Seems weird to me but I don't know too much about AVS.
If you have custom coded the oder form make it really big and collect all sorts of information from the customers .Use a image verification system also. Make life harder for the human on the other end by filling out all those stuff
If the customer is legitimate and he truly wants to purchase a thing ;i am sure he wont mind filling it all up
Plug in Nginx & Plug in performance on cPanel systems
WebOps on cPanel . Deploy webapps to multiple servers and scale horizontally
Make it temporarily really annoying to do that, add captcha, first email to user and verification of email address then billing details, stuff like that, and revert back to userfriendly easy mode when done
Maybe even SMS verification? That's rather easy to do
Pulsed Media: Seedbox hosting and Dedicated Servers for content distribution