4 ms·

I hate the so-called card-testers, they target small businesses and put them at risk of being banned by payment processors. Stripe at least has their Stripe Rad

I hate the so-called card-testers, they target small businesses and put them at risk of being banned by payment processors. Stripe at least has their Stripe Radar service, which is easy to implement. The problem is when you have to work with less technologically-savvy providers (e.g., if you are not US-based and they don't offer 3-D secure). I'm currently looking to develop an anomaly-based system to help protect from this kind of attacks. Any pointers to open-source references I can look into?

fibonacc 4y ago
could you look into 2FA before a customer is able to checkout? unfortunately the only way to stop this seems to be to increase friction and suffer the conversion rates.
- neodypsis 4y ago
  I don't see how enabling 2FA for the user accounts could stop card-testers. Can you perhaps elaborate a bit more?
  - simlan 4y ago
    He is likely referring to the 2 FA of the credit card company. When the payment is made you are prompted to confirm the transaction in the mobile app or provide another key. Most my cards do that nowadays but it depends on the merchant.
    - neodypsis 4y ago
      Oh, I see. My country's processors still doesn't support 3-D Secure 2.0 for mobile applications.
Ayesh 4y ago
> Not US-based Most of the European and Asian countries (apart from China) are far more advanced with payment cards. Many not only have their own networks with 0-1% commission, compared to 2-4% on Master/Visa/Amex, but also have long required 2FA for online payments. They might be less tech savvy users, in that they will be taken as a surprise if a car rental company posted a temporary authorization or if someone charged your new card after you renewed it (Stripe can do it), but SMS/email 2FA is quite frictionless nowadays. US was in fact one of the last countries to commonly issue EMV (chip) cards.
- neodypsis 4y ago
  My experience has been in a Latin American country. Unfortunately, no Stripe here. I've repeatedly asked for 3-D secure 2.0 support (for mobile application), they just keep telling me that it'll happen in the future.

fibonacc 4y ago

could you look into 2FA before a customer is able to checkout? unfortunately the only way to stop this seems to be to increase friction and suffer the conversion rates.

neodypsis 4y ago
I don't see how enabling 2FA for the user accounts could stop card-testers. Can you perhaps elaborate a bit more?
- simlan 4y ago
  He is likely referring to the 2 FA of the credit card company. When the payment is made you are prompted to confirm the transaction in the mobile app or provide another key. Most my cards do that nowadays but it depends on the merchant.
  - neodypsis 4y ago
    Oh, I see. My country's processors still doesn't support 3-D Secure 2.0 for mobile applications.

Ayesh 4y ago

> Not US-based Most of the European and Asian countries (apart from China) are far more advanced with payment cards. Many not only have their own networks with 0-1% commission, compared to 2-4% on Master/Visa/Amex, but also have long required 2FA for online payments. They might be less tech savvy users, in that they will be taken as a surprise if a car rental company posted a temporary authorization or if someone charged your new card after you renewed it (Stripe can do it), but SMS/email 2FA is quite frictionless nowadays. US was in fact one of the last countries to commonly issue EMV (chip) cards.

neodypsis 4y ago
My experience has been in a Latin American country. Unfortunately, no Stripe here. I've repeatedly asked for 3-D secure 2.0 support (for mobile application), they just keep telling me that it'll happen in the future.