5 ms·

> it's cost me, £21.54 to allow some shithead to use JS Bin as a stolen card testing facility. Not sure if it's standard practice, but in our case we let the u

by Mahn 11y ago

> it's cost me, £21.54 to allow some shithead to use JS Bin as a stolen card testing facility. Not sure if it's standard practice, but in our case we let the users use the "free tier" service first, and we offer the paid plans only once we can validate they have a genuine interest in the product . It works well for us to avoid these cases.

dasil003 11y ago
If that works for you I'm glad, but I've had to deal with credit card fraud hitting my service, and it tends to be an arms race. There's simply too much money it for them to be deterred. If you are an attractive target it's difficult to find something which prevents credit card fraud without also hurting your business.
markbnj 11y ago
That's an interesting approach, but if the "pro" features are something the user really needs, then don't you risk losing a sub if the feature is withheld until you "get to know each other?"
- dbpatterson 11y ago
  You could give them 15 days free use, and only charge it after that... there is a risk that the charge doesn't go through (in which case you've given a couple weeks free service - big deal), but otherwise, you've just made it much less useful for card testing (to the point that they certainly won't use your site).
  - msandford 11y ago
    Yeah, that's all of the upside and none of the downside really. Introducing ANY kind of delay between taking the order and charging the card will just about eliminate these kinds of fraudulent transactions.
  - markbnj 11y ago
    Yep, this makes a lot of sense.
jessaustin 11y ago
The shitheads who are testing stolen cards will probably skip the free tier so they can, ahem, test their stolen cards.
- Killswitch 11y ago
  Like mentioned above, when you sign up with the service, you're giving the card info and then you're automatically enrolled in a 2 week trial that will automatically charge afterwords. This should suffice. I don't think they'll wait 2 weeks for the charge to go through. You can automate the process of disabling charges to if nothing happens. Say 2 days before the charge is about to happen, you do an automated audit of the account and if there hasn't been any activity, fire off an email stating that their trial is about to expire and they're about to get charged and you noticed they hadn't used the service yet. If still no activity when you're about to charge, then cancel charge and disable account and chalk it up as avoiding a chargeback. Make sure to email the user saying that you disabled the pro features and voided the charge as to not automatically charge them for something they're not using. It's a win/win situation. If the customer was legit, you just saved them on paying for something they didn't plan on using, and they may actually re-enable it and start using the account because they see you actually care about them as a customer and aren't just hoping they forget about such a small charge and it goes on for years before they audit their card charges and cancel any small things. If it's a user who was just testing stolen cards, well 2 weeks is a long time to gamble on if it's valid or not, so they move on.
  - jessaustin 11y ago
    Thanks, that makes sense.
jfoster 11y ago
Another thought I have on this is that getting the user to sign in via Google/Facebook/Twitter might help. There's nothing stopping fraudsters from having a Google or Facebook account with a dud identity, of course, but at that point it might seem much easier to hit a different business. Has anyone had any experience with this approach? Does it work?

by Mahn 11y ago

dasil003 11y ago

If that works for you I'm glad, but I've had to deal with credit card fraud hitting my service, and it tends to be an arms race. There's simply too much money it for them to be deterred. If you are an attractive target it's difficult to find something which prevents credit card fraud without also hurting your business.

markbnj 11y ago

That's an interesting approach, but if the "pro" features are something the user really needs, then don't you risk losing a sub if the feature is withheld until you "get to know each other?"

dbpatterson 11y ago
You could give them 15 days free use, and only charge it after that... there is a risk that the charge doesn't go through (in which case you've given a couple weeks free service - big deal), but otherwise, you've just made it much less useful for card testing (to the point that they certainly won't use your site).
- msandford 11y ago
  Yeah, that's all of the upside and none of the downside really. Introducing ANY kind of delay between taking the order and charging the card will just about eliminate these kinds of fraudulent transactions.
- markbnj 11y ago
  Yep, this makes a lot of sense.

jessaustin 11y ago

The shitheads who are testing stolen cards will probably skip the free tier so they can, ahem, test their stolen cards.

Killswitch 11y ago
Like mentioned above, when you sign up with the service, you're giving the card info and then you're automatically enrolled in a 2 week trial that will automatically charge afterwords. This should suffice. I don't think they'll wait 2 weeks for the charge to go through. You can automate the process of disabling charges to if nothing happens. Say 2 days before the charge is about to happen, you do an automated audit of the account and if there hasn't been any activity, fire off an email stating that their trial is about to expire and they're about to get charged and you noticed they hadn't used the service yet. If still no activity when you're about to charge, then cancel charge and disable account and chalk it up as avoiding a chargeback. Make sure to email the user saying that you disabled the pro features and voided the charge as to not automatically charge them for something they're not using. It's a win/win situation. If the customer was legit, you just saved them on paying for something they didn't plan on using, and they may actually re-enable it and start using the account because they see you actually care about them as a customer and aren't just hoping they forget about such a small charge and it goes on for years before they audit their card charges and cancel any small things. If it's a user who was just testing stolen cards, well 2 weeks is a long time to gamble on if it's valid or not, so they move on.
- jessaustin 11y ago
  Thanks, that makes sense.

jfoster 11y ago

Another thought I have on this is that getting the user to sign in via Google/Facebook/Twitter might help. There's nothing stopping fraudsters from having a Google or Facebook account with a dud identity, of course, but at that point it might seem much easier to hit a different business. Has anyone had any experience with this approach? Does it work?