A small-business owner describes credit-card testing fraud, where scammers mass-test stolen card numbers on free trial sign-ups. Hundreds of cards get run through his site; most fail, but the successful ones fund fraudulent purchases. He's tried blocking foreign IPs, switching processors, and removing free trials, but the fraud keeps happening because the scammers use VPNs.
As a merchant, I want you to be aware of a scam that you can protect yourself from. Um, I fell prey to this and I would just like you to be aware of it because I have never heard of this before. And it is called, called credit card testing fraud. And it's of no reference to you as the merchant. You're not causing the fraud. But here's how it works. Uh, people, nefarious people from all over the world, collect credit card numbers. They get them, I think, from card readers that, um, when you're walking through an airport, it just swipes it right out of your wallet. I'm guessing that's where most of them come from. Um, and then what they do is they look for websites that have a free trial and then it signs you up for a subscription. Because how that works on the backend is that someone signs up for your free trial, the credit card information is captured, and then whenever the free trial is over, the credit card is automatically charged. And that's how it's supposed to work. Like when you're doing, I don't know, a free trial on a membership, for example. That's what I was doing. And, um, and that's exactly how it's supposed to work. And so what these people do is they find websites that have free trials and they run hundreds and hundreds and hundreds of cards through your website. The vast majority will say it's not a valid card. Or it's stolen or whatever the message is, but it won't actually go through. And then occasionally they have one that does go through and then they hold that card and that's the card they go and they do all of their, whatever they're gonna do, purchasing of whatever fraudulently on that card. And it's great to know that there's, you know, your card numbers are cycled through this way. However, from a merchant's point of view, that is activity that's hitting your merchant account that is unusual. And so, um, when this happened to me, my merchant shut my card down or shut my account down, which I'm somewhat glad they did. Um, but I didn't know anything about it until I got a message from my merchant account because the vast majority of these cards never go through your actual system of whatever it is that you are offering a free trial for. And so you're not notified. And like thousands went through before my merchant account shut it down. So I called my merchant account. I'm like, okay, well, what can we do about this? And they were you know, do all of this, change all these settings. And I did exactly what they said. I turned it back on, and within a day, the same activity is happening over and over and over and over. So I shut it off again, called them up. No, that didn't work. Now what do we do? And, um, their only suggestion was They offered a, a, um, program that they sell, and I think it was like 20 cents a transaction or something like that, where it would check for fraud and then it would block the, the transaction from going through. Well, that's ridiculous. One, why am I paying 20 cents a transaction for a fraudster to put thousands of cards through my system? And their solution didn't block them from ever submitting the card. It blocked it after it discovered it was fraud, which, what's the difference in what was happening now? It wasn't getting paid. So that seemed ridiculous to even consider that. Uh, and so I took off the 30-day free trial cuz that's what I had. And I removed all free trials and turned it back on. And again, within a day, the same activity, except this time because the free trial was gone, they were actually registering, which caused me more work because now I get to go back into my membership system and find and delete all these people and remove their tags and all of this extra work. Okay, so that was not a good solution. So I got frustrated and I just shut it off. No new members for a while. Thankfully, this was not my main form of business. It's kind of a side, side thing that I do. So it wasn't affecting my bottom line, so to speak. However, it wasn't a solution. And so I talked to my host and I just, I discovered that all of the activity was coming first from Brazil, um, and then another country was Pakistan, and then there was a country in Africa somewhere, uh, that was doing all of this fraud. So I just work in the United States, so I said to my host, let's block the entire world except the United States and Canada from even seeing my website. So if you're in another country, you'll just get a blank white page. And in my mind I thought, yes, that will solve the problem. No, it did not, because fraudster people are not dumb. And they just got a VPN in the United States so that, and they were running all of their stuff now through the United States so they could see my site. And so obviously that didn't work. So I just was so frustrated. So I just shut it off and I waited 3 or 4 months before turning it back on. I was doing a webinar. I was gonna offer a membership or offer that membership on the webinar. And it, so I turned it back on right before the webinar. It took just a few days for it to happen again. So not only is, was my site targeted because I offered a free trial. It was then obviously cached into their system so that they would periodically go check and see if it was live again. So, and I would say their period is every day they were checking. So that wasn't a solution. I ended up having to get a different merchant processor, which was a total pain because the rest of my entire business ran on the other one that I had. Now on that specific website, I have Authorize.net connected to there and yes, I pay more fees because of it. So far it's still working. However, I do know that the fraudulent activity is still continuing. I'm just not seeing it on my end. Because, and I know this because whenever a card does work, it actually signs up a new member in my system, which then I get to go and remove. So it, it's frustrating. If anybody out there has a real solution for this problem, please let me know. Please put it in the comments. And let, let people know how to combat this. It's, it's so frustrating. My only advice at this point is do not offer a free trial at all because once your site gets discovered, it apparently just gets not only discovered by one fraudulent group of people, but then shared off to others because I'm, I'm being targeted from many, many countries now, even though I have my site entirely blocked. So they're not discovering it. It's already, it's already known and has been shared. At this point, I'm considering changing my domain, which is going to be another huge hassle for, for me. As far as the website goes. So branding and all of that stuff. So if anybody knows an answer, I would love to hear it. If any of you fraudsters out there are listening to this, please stop. I don't understand, you know, I'm just a small business owner. I'm not somebody that should be targeted for anything like this. But anyway, I just wanted to vent. And if you've, if you have had this issue, let me know that too. I would love to know how broad this is. I'm sure it's not just me. It's little old me sitting here in a small little town. I don't think it's just me. So yes, thank you.
