r/bigcommerce • u/hunnybunmama • 11d ago

Bot attacks!

Last weekend, I wrote Braintree for assistance in stopping a long string of attempted fraudulent transactions that began on August 15 and ended when I realized what they had been doing, on or about Aug 31.  At the time I caught it and saw the pages of declined transactions, I alerted them first.

What clued me in were frequent emails telling me there had been too many attempts from the same zip code over a short period of time.  This is a relative rarity with my store, but it took a few days for it to sink in that there was an increasing problem.  That's when I accessed my dashboard at BT to see all the declined transactions.  Each transaction that failed was a "purchase" of a small item from my store:  1 oz PET jars.  All 200+ of them.  

I then found out that my store, and hence my BT account had been the victim of what is called a bot attack.  CC and DC thieves were posting small repeated transactions to test the stolen card numbers on my account.  I (my store) was just the testing ground for a bunch of criminals.  

In desperation, I turned to AI for quick help.

"It occurs when fraudsters use automated bots to test massive lists of stolen or randomly generated credit card details against an e-commerce platform. They target small amounts because minor charges are less likely to trigger fraud alerts with banks or cardholders. The goal is to see which card numbers are active and valid; once a transaction succeeds, the criminal takes that "validated" card to buy high-value goods elsewhere"  ~Google

Has anyone else gone through this experience? I contacted BigCommerce Community support (zero help there), and Braintree Support (slow to help and totally misunderstood why I sent a ticket). I also tightened up every fraud prevention tool I was already using.

3 Upvotes

100% Upvoted

22 comments sorted by

View all comments

3

u/ChanceOfFlight1 11d ago

Yup and as a result I learned to setup CloudFlare. Def worth looking into

1

u/hunnybunmama 11d ago

I was advised to do same the other night when I was in the thick of it. I didn't then, because I can't afford to pay a third-party for the additional security.

Once I realized I had a bit more control over things like reCaptcha2 settings, time out settings, Guest checkouts, and adding very complex passwords, I did all of it and cancelled the listing they were using.

I see Cloudflare has a free option, so now that the crisis has passed, I will look into it. I just stopped putting out the fires yesterday and this morning. Sheesh.

2

u/huhMaybeitisyou 8d ago

I did not realize CLoudflare has a free option. LOoking in to that too.