Need help with stripe integration
Budget: $10 – $30 USD
Hi
I have a stripe integration, just I got some test card transaction which I need some help to implement some mitigation for card testing. I got some info from Stripe as following:
The reality of card testing is, any merchant that accepts credit cards online is at risk. Card testing occurs when a fraudster finds an unprotected checkout page and they look for websites with the least amount of friction or user verification, and is able to quickly run card numbers through it, looking for cards that aren't declined so that they can confidently use them for other purchases later. Allow me to provide more insight with the card testing, in order to help you put effective mitigations in place.
As mentioned in our initial email, it looks like the card testers are using your integration to attach card information to a Customer. This confirms whether the card is valid, even without a payment. You can see the effects of this on your Dashboard by looking at the request logs in Developer > Logs for excessive 402 errors on requests to attach card information to Customers using a secret key. Note that this includes some /v1/customers and /v1/payment_methods routes.
The specific security measures you add to your integration/website will vary depending on your situation and the needs of your business. You may coordinate with your developer as they're knowledgeable in this area and they can definitely help you. Several common approaches are described below:
I have a stripe integration, just I got some test card transaction which I need some help to implement some mitigation for card testing. I got some info from Stripe as following:
The reality of card testing is, any merchant that accepts credit cards online is at risk. Card testing occurs when a fraudster finds an unprotected checkout page and they look for websites with the least amount of friction or user verification, and is able to quickly run card numbers through it, looking for cards that aren't declined so that they can confidently use them for other purchases later. Allow me to provide more insight with the card testing, in order to help you put effective mitigations in place.
As mentioned in our initial email, it looks like the card testers are using your integration to attach card information to a Customer. This confirms whether the card is valid, even without a payment. You can see the effects of this on your Dashboard by looking at the request logs in Developer > Logs for excessive 402 errors on requests to attach card information to Customers using a secret key. Note that this includes some /v1/customers and /v1/payment_methods routes.
The specific security measures you add to your integration/website will vary depending on your situation and the needs of your business. You may coordinate with your developer as they're knowledgeable in this area and they can definitely help you. Several common approaches are described below: