Reduce Brute Force Orders

-- HikaShop version -- : 5.0.0
-- Joomla version -- : 4.3.4
-- PHP version -- : 8.1

After switching to auth.net payment plugin, I've noticed an uptick in the frequency of fraudulent charges (10 in last month vs 3 in several years with previous payment plugin). It seems scammers potentially have lists of valid credit card numbers and billing addresses, but send the order to different locations. I'm trying to figure out if this is a problem with the payment plugin or something else going on with the checkout after recent upgrade to joomla 4 and hikashop 5.

You can see if the transaction logs that the same person is attempting to submit an order with the same email but cycling through billing addresses until one is successful.

Any thoughts on how to help prevent some of this behavior on the hikashop side?

Hi,

I would need more information on the situation in order to say anything useful.
For example, are you using the Authorize.net payment plugin in SIM or AIM mode ?
In AIM mode, there is no 3DS support. 3DS allows for secure transactions by making sure that the user validates the transaction via the bank's app, or a code sent to his phone.
Also, are you actually using this plugin or are you talking about the Authorize.net accept.js payment plugin from our marketplace ?
Also, you're saying that some billing address are refused and some are accepted when creating an order. As far as I know, HikaShop will accept any address, unless you made some restrictions (like disabling zones, restricting the shipping or payment methods to some zones). Are you talking about this ? Or are you saying that the payment gateway is refusing the transactions ?

I am using the default authorize.net plugin (with AIM mode enabled) included with hikashop (not the JS one from marketplace).

Even in AIM mode, authorize.net has some address verification filters to help with fraudulent accounts. However, it seems these nefarious users are using the same shipping address and seem to be rolling through lists of credit card and address combinations (brute force) until there is a successful transaction. I can see this in the payment transaction logs from authorize.net.

E.g., there is a single user that has 15 transaction attempts for the same order but uses different credit card and address combinations until something works. We can catch before the order ships out, but I was wondering if there was some clever way to prevent this sort of behavior on the hikashop side.

I can email you a copy of the transaction report from authorize.net to see this behavior if necessary.

Hi,

Unfortunately, Authorize.net decided to stop supporting 3DS last year:
support.authorize.net/knowledgebase/Know...icle/?code=000003582
3DS is a really nice way to ensure that transactions are legit since the customer has to validate the transaction with his smartphone. And thus, just getting your credit card stolen won't allow the robers to use it and someone can't just generate a credit card number and try the different date and CCV combinations until they find a match.

I know that authorize.net has AVS : support.authorize.net/knowledgebase/Know...icle/?code=000001490
I suppose you're already using it, and that's why most addresses are rejected.

What you could do is to write a small plugin using the "onBeforeOrderCreate" event in order to count the number of orders being attempted, and block it after a specific threshold.

Yes, i am currently using AVS which helps out a lot with preventing fraud.

The "onBeforeOrderCreate" counter would be very helpful in this case. I could see where this might be a useful tool for most Hikashop payment plugins. However, it's a little out of my wheelhouse to develop a plugin

Hi,

I think this is specific to Authorize.net and thus it should not apply to most payment plugins since most payment gateways support 3DS and thus this kind of problem doesn't happen.
Maybe first, it would be nice to see with Authorize.net what they recommend about your situation ? Maybe they have some other kind of protection than AVS, or maybe AVS can be configured to better handle the frauds you have ?