4 ms·

I also had something like this happen on a site I built for my wife's work's site, a Boys & Girls Club[0]. I had a donation button that let people make an open

I also had something like this happen on a site I built for my wife's work's site, a Boys & Girls Club[0]. I had a donation button that let people make an open donation to the club. It's such a tiny site with little traffic, but apparently the SEO must be decent because somehow it got targeted by people appearing to come through Brazil and Poland. Suddenly one day, hundreds of donation attempts. Checking the failed transactions, the script was trying $1, then $2, etc up to $22 then starting over, each time with a different number. About $200 in successful donations came through before I caught it. So I just shut it all down for now. I'm not really sure how best to fix it. The club has no money and already complain about the transaction fees they get charged per swipe (and those are all pretty standard rates in the U.S.). Being a non-profit, they expect a lot of stuff for free, and unfortunately won't consider paying for an anti-fraud service. Even PayPal takes too big a cut. Realizing that this wasn't a helpful comment, just a "me too." It sucks. Oh well. [0]: https://salembgc.org https://salembgc.org

imjk 11y ago
How can they not be willing to pay a transaction fee from even PayPal for donations? Seems their options right now is to take donations via a service like Paypal with a transaction fee, or just take no donation.
- pc86 11y ago
  You would be surprised at how unreasonable people can be once you start talking about taking a percentage of money they get (be it donations or business revenue or something else). It's the financial equivalent of having a tumor that will kill you and refusing the surgery because the doctor says you have a chance of dying on the table.
- fredleblanc 11y ago
  I don't want to speak for them or go into their financials, but in a literal sense, every dollar counts. When we were talking about taking donations and registrations online, they were frazzled about the transaction fees, and I suggested working them into the costs. (It was only, say a $3 increase in membership price.) The truth of the matter is that some people don't have that much to spare. Of course, that conversation happened way before the site was used as a credit card validator. Trying to explain to them the bad side of charge backs and why this is a big deal is an on-going challenge. The last time I discussed it with them, they kept asking me if they were going to get stuck with all the transaction fees. And, being a developer, my first gut instinct is stepping back and saying "you're wasting money here and here and here and here, cut down these inefficiencies and it'll all balance out." However, it's not as simple as that. Everyone needs to be on board, and the people in charge of these things are already overworked and not highly paid. A catch-22, I suppose. I try to stay out of it as best I can. I made them the site for free in exchange for our two kids to use the club's stuff for free, and with those inefficiencies I hinted at, I can't afford to get caught in being the role of business consultant too.
- milesvp 11y ago
  They may actually not have a choice. My wife is a lawyer who does a lot of work with non-profits, and maintaining non-profit status can require jumping through a lot of legal hoops. A quick google suggests GBCA is a 501(c)3 non-profit, so it's very possible that adding a gateway in front of a donation that is tax deductible may create some legal risk (real or perceived), or be outright not allowed by current laws.
  - phonon 11y ago
    What the heck are you talking about? Fundraising expenses and overhead are totally ordinary and expected for non-profits. Obviously if it would be very high, it's problematic (as percentage of donations going to program expenses would low--think hiring a fundraiser, and giving them 50% of every dollar they bring in.), but a ~2% credit card processing is unexceptional.
driverdan 11y ago
Consider adding Bitcoin donations. The fees are very low and the Bitcoin community tends to be generous.
smcl 11y ago
I think if you provide an interesting detailed and related anecdote like you did then it's not a "me too" post
StavrosK 11y ago
Wait, why would someone fraudulently donate somewhere? I don't understand the motive.
- fredleblanc 11y ago
  From what I've read in research, the reason is four-fold-ish. 1: Using the site as a credit card validator. Only the real ones will get through. 2: By making donations to places with a stolen credit card little bits at a time, it establishes a wider pattern of use for that card. Fast forward a couple steps ahead, the purchases are getting a little weirder each time, and before you know it, you're at whatever level people use stolen cards to buy. 3: Tiny non-profits generally do not have a great deal of extra man-power to deal with such things, and there's a better chance that this sort of behavior goes unnoticed. 4: When people see weird charges on their card, some people are more likely to feel bad enough taking away money from a non-profit organization that they won't report the abuse, or they may not question it if the card is joint-used. I'm sorry that I don't have sources on these, the research was from a couple of months ago. It's pretty frustrating and there seems to be little retribution for things. You have to just change your charge flow and move on. :/
  - StavrosK 11y ago
    Thanks for that, that's very interesting!
- rstupek 11y ago
  They aren't attempting to donate they are attempting to try credit card numbers to find ones that are valid.

imjk 11y ago

How can they not be willing to pay a transaction fee from even PayPal for donations? Seems their options right now is to take donations via a service like Paypal with a transaction fee, or just take no donation.

pc86 11y ago
You would be surprised at how unreasonable people can be once you start talking about taking a percentage of money they get (be it donations or business revenue or something else). It's the financial equivalent of having a tumor that will kill you and refusing the surgery because the doctor says you have a chance of dying on the table.
fredleblanc 11y ago
I don't want to speak for them or go into their financials, but in a literal sense, every dollar counts. When we were talking about taking donations and registrations online, they were frazzled about the transaction fees, and I suggested working them into the costs. (It was only, say a $3 increase in membership price.) The truth of the matter is that some people don't have that much to spare. Of course, that conversation happened way before the site was used as a credit card validator. Trying to explain to them the bad side of charge backs and why this is a big deal is an on-going challenge. The last time I discussed it with them, they kept asking me if they were going to get stuck with all the transaction fees. And, being a developer, my first gut instinct is stepping back and saying "you're wasting money here and here and here and here, cut down these inefficiencies and it'll all balance out." However, it's not as simple as that. Everyone needs to be on board, and the people in charge of these things are already overworked and not highly paid. A catch-22, I suppose. I try to stay out of it as best I can. I made them the site for free in exchange for our two kids to use the club's stuff for free, and with those inefficiencies I hinted at, I can't afford to get caught in being the role of business consultant too.
milesvp 11y ago
They may actually not have a choice. My wife is a lawyer who does a lot of work with non-profits, and maintaining non-profit status can require jumping through a lot of legal hoops. A quick google suggests GBCA is a 501(c)3 non-profit, so it's very possible that adding a gateway in front of a donation that is tax deductible may create some legal risk (real or perceived), or be outright not allowed by current laws.
- phonon 11y ago
  What the heck are you talking about? Fundraising expenses and overhead are totally ordinary and expected for non-profits. Obviously if it would be very high, it's problematic (as percentage of donations going to program expenses would low--think hiring a fundraiser, and giving them 50% of every dollar they bring in.), but a ~2% credit card processing is unexceptional.

driverdan 11y ago

Consider adding Bitcoin donations. The fees are very low and the Bitcoin community tends to be generous.

smcl 11y ago

I think if you provide an interesting detailed and related anecdote like you did then it's not a "me too" post

StavrosK 11y ago

Wait, why would someone fraudulently donate somewhere? I don't understand the motive.

fredleblanc 11y ago
From what I've read in research, the reason is four-fold-ish. 1: Using the site as a credit card validator. Only the real ones will get through. 2: By making donations to places with a stolen credit card little bits at a time, it establishes a wider pattern of use for that card. Fast forward a couple steps ahead, the purchases are getting a little weirder each time, and before you know it, you're at whatever level people use stolen cards to buy. 3: Tiny non-profits generally do not have a great deal of extra man-power to deal with such things, and there's a better chance that this sort of behavior goes unnoticed. 4: When people see weird charges on their card, some people are more likely to feel bad enough taking away money from a non-profit organization that they won't report the abuse, or they may not question it if the card is joint-used. I'm sorry that I don't have sources on these, the research was from a couple of months ago. It's pretty frustrating and there seems to be little retribution for things. You have to just change your charge flow and move on. :/
- StavrosK 11y ago
  Thanks for that, that's very interesting!
rstupek 11y ago
They aren't attempting to donate they are attempting to try credit card numbers to find ones that are valid.