Attacked by “card testing” – decline orders with origin unknown?
-
Hi, we’re getting lots of card testing ‘failed orders’ and a few that went through. All for tiny amounts, all have origin unknown .. don’t want to use captcha, but it occurred to me that it should be simple enough to add a check that will decline orders that have origin: unknown? Any ideas? Thanks.
Don’t care what it does, just want it to prevent the order going to the checkout. There’s gotta be a way ?! https://woocommerce.com/document/order-attribution-tracking/
-
Perhaps a function similar to this? https://wordpress.org/support/topic/stop-checkout-if-wrong-ship-to-state-entered/
Or maybe a simple honeypot like this: https://www.businessbloomer.com/woocommerce-checkout-anti-spam-honeypot/ (I have just added this, will see if it stops the bots…)
Hello sonic1243,
Thank you for contacting WooCommerce support.
I understand you’re dealing with issues related to your payment method.
Could you share your site’s URL?
I want to review the checkout process.Could you clarify what you mean by “card testing failed orders” and “a few that went through”?
Sharing screenshots of the Order Notes from the affected orders would help diagnose this further.Could you also let me know which payment method plugin you’re using?
This will help in suggesting a tailored solution.There are various ways to secure your site against such attacks.
Once I have more information, I will be in a better position to assist you further.Looking forward to your response. 🙂
Hi, thanks ..
Storefront with a child theme, Paypal Payments plugin.
We had 100 failed orders in one day, all for £2.50, from different billing addresses, IP’s hidden by VPN, all origin unknown.. which is ‘card testing’, going through lists of stolen cards looking for ones which work. Three orders were successful.So, if I could decline orders which had an origin of ‘unknown’ it would stop them. But I am trying that checkout honeypot method linked above. To avoid putting captcha on the checkout. Though it is possible this is not a bot, but actual manual input. I imagine a filter for: If user Origin = unknown: decline.
Hi @sonic1243!
Thank you for sharing the details about this issue. That can certainly be frustrating and potentially harmful to your business. It’s great to hear you’re trying the honeypot method! This can help detect and block automated bots. However, as you mentioned, if these attempts are manually inputted, this may not be enough on its own.
Currently, WooCommerce does not offer a built-in option to automatically hide or cancel orders based on the origin of the request (such as detecting a VPN or a certain geographic location). Handling such situations usually requires more complex solutions, such as fraud detection services or custom-built functions.
I have found a plugin which can help you to block spam orders.
https://woocommerce.com/products/woocommerce-anti-fraud/
I hope this helps.I’m after a filter to add to functions.php which will decline orders based on the origin – can this be done?
Hi @sonic1243,
I’m after a filter to add to functions.php which will decline orders based on the origin – can this be done?
For this kind of intricate setup, I recommend you try the following:-
- Running the exact question you’re asking, along with the code provided, through an AI platform like ChatGPT for recommendations/changes to your code;
- Checking whether there are existing plugins in the WordPress plugin repository that might be doing that already.
- Joining our WooCommerce Slack community (it does have a developer channel where you can ask coding questions): https://woo.com/community-slack/
I hope this helps.
Ok thnx well.. CoPilot just gave me this, so will try it out …..
add_action('woocommerce_checkout_process', 'decline_orders_with_unknown_attribution');
function decline_orders_with_unknown_attribution() {
// Check if the 'order_attribution' field exists in the $_POST array
if (isset($_POST['order_attribution'])) {
$order_attribution = sanitize_text_field($_POST['order_attribution']);
// Check if the order attribution is unknown or empty
if (empty($order_attribution) || strtolower($order_attribution) === 'unknown') {
wc_add_notice(__('Orders with unknown attribution are not accepted.'), 'error');
}
} else {
wc_add_notice(__('Order attribution is missing. Please provide the attribution.'), 'error');
}
}Sounds like a plan – @sonic1243!
Please try it out and let us know how it goes.
Be sure to make a full site backup before you try out the code.
Cheers!
This hasn’t worked, had 20 failed orders with origin “Unknown” yesterday.
Taking that filter away, interestingly also had a legit customer get blocked, but that might have been due to the honeypot filter I added; so am taking that away as well…Hi @sonic1243,
This hasn’t worked, had 20 failed orders with origin “Unknown” yesterday.
This is quite unusual. Thanks for sharing an update on this.
Taking that filter away, interestingly also had a legit customer get blocked, but that might have been due to the honeypot filter I added; so am taking that away as well…
Could you kindly share more details on the honeypot filter you’re using?
Thanks .. I had tried this, but it didn’t stop them: https://www.businessbloomer.com/woocommerce-checkout-anti-spam-honeypot/
Its possible these card testing orders are being done manually, looking at time stamps.
Was considering blocking IP’s from outside the UK? If that’s possible?
@sonic1243 Thanks for sharing further updates.
While this is a unique case, I’d love to understand your site properly. Please share with us your System Status Report which you can find via WooCommerce > Status > Get system report > Copy for support.
Once we have more information, we’ll be able to assist you further.
Thanks .. .
WordPress Environment<br><br>WordPress address (URL): https://www.mikecornish.co.uk<br>Site address (URL): https://www.mikecornish.co.uk<br>WC Version: 9.4.2<br>Legacy REST API Package Version: The Legacy REST API plugin is not installed on this site.<br>Action Scheduler Version: ✔ 3.8.2<br>Log Directory Writable: ✔<br>WP Version: 6.7.1<br>WP Multisite: –<br>WP Memory Limit: 256 MB<br>WP Debug Mode: –<br>WP Cron: ✔<br>Language: en_GB<br>External object cache: – Server Environment<br><br>Server Info: LiteSpeed<br>PHP Version: 7.4.33<br>PHP Post Max Size: 16 MB<br>PHP Time Limit: 90<br>PHP Max Input Vars: 1000<br>cURL Version: 8.9.1<br>OpenSSL/1.1.1w<br><br>SUHOSIN Installed: –<br>MySQL Version: 10.6.20-MariaDB<br>Max Upload Size: 16 MB<br>Default Timezone is UTC: ✔<br>fsockopen/cURL: ✔<br>SoapClient: ✔<br>DOMDocument: ✔<br>GZip: ✔<br>Multibyte String: ✔<br>Remote Post: ✔<br>Remote Get: ✔ Database<br><br>WC Database Version: 9.4.2<br>WC Database Prefix: wp_<br>Total Database Size: 62.20MB<br>Database Data Size: 43.22MB<br>Database Index Size: 18.98MB<br>wp_woocommerce_sessions: Data: 3.86MB + Index: 0.13MB + Engine MyISAM<br>wp_woocommerce_api_keys: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_attribute_taxonomies: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_downloadable_product_permissions: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_order_items: Data: 0.71MB + Index: 0.37MB + Engine MyISAM<br>wp_woocommerce_order_itemmeta: Data: 4.50MB + Index: 3.36MB + Engine MyISAM<br>wp_woocommerce_tax_rates: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_woocommerce_tax_rate_locations: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_shipping_zones: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_shipping_zone_locations: Data: 0.08MB + Index: 0.15MB + Engine MyISAM<br>wp_woocommerce_shipping_zone_methods: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_payment_tokens: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_payment_tokenmeta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_woocommerce_log: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_actionscheduler_actions: Data: 0.53MB + Index: 0.27MB + Engine MyISAM<br>wp_actionscheduler_claims: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_actionscheduler_groups: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_actionscheduler_logs: Data: 0.41MB + Index: 0.27MB + Engine MyISAM<br>wp_commentmeta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_comments: Data: 2.61MB + Index: 0.89MB + Engine MyISAM<br>wp_failed_jobs: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_links: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_litespeed_url: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>wp_litespeed_url_file: Data: 0.02MB + Index: 0.08MB + Engine InnoDB<br>wp_mailchimp_carts: Data: 0.22MB + Index: 0.02MB + Engine MyISAM<br>wp_mailchimp_jobs: Data: 0.05MB + Index: 0.00MB + Engine MyISAM<br>wp_options: Data: 5.74MB + Index: 1.51MB + Engine MyISAM<br>wp_postmeta: Data: 18.29MB + Index: 8.66MB + Engine MyISAM<br>wp_posts: Data: 2.78MB + Index: 0.56MB + Engine MyISAM<br>wp_queue: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_termmeta: Data: 0.01MB + Index: 0.02MB + Engine MyISAM<br>wp_terms: Data: 0.01MB + Index: 0.02MB + Engine MyISAM<br>wp_term_relationships: Data: 0.05MB + Index: 0.10MB + Engine MyISAM<br>wp_term_taxonomy: Data: 0.02MB + Index: 0.01MB + Engine MyISAM<br>wp_usermeta: Data: 1.26MB + Index: 0.72MB + Engine MyISAM<br>wp_users: Data: 0.07MB + Index: 0.08MB + Engine MyISAM<br>wp_wcpdf_invoice_number: Data: 0.06MB + Index: 0.04MB + Engine MyISAM<br>wp_wcpdf_packing_slip_number: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_admin_notes: Data: 0.09MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_admin_note_actions: Data: 0.05MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_category_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_customer_lookup: Data: 0.26MB + Index: 0.22MB + Engine MyISAM<br>wp_wc_download_log: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_orders: Data: 0.02MB + Index: 0.11MB + Engine InnoDB<br>wp_wc_orders_meta: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>wp_wc_order_addresses: Data: 0.02MB + Index: 0.06MB + Engine InnoDB<br>wp_wc_order_coupon_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_order_operational_data: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>wp_wc_order_product_lookup: Data: 0.54MB + Index: 0.48MB + Engine MyISAM<br>wp_wc_order_stats: Data: 0.32MB + Index: 0.18MB + Engine MyISAM<br>wp_wc_order_tax_lookup: Data: 0.16MB + Index: 0.18MB + Engine MyISAM<br>wp_wc_product_attributes_lookup: Data: 0.04MB + Index: 0.05MB + Engine MyISAM<br>wp_wc_product_download_directories: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_product_meta_lookup: Data: 0.06MB + Index: 0.09MB + Engine MyISAM<br>wp_wc_rate_limits: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_reserved_stock: Data: 0.06MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_tax_rate_classes: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_webhooks: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpforms_logs: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_wpforms_payments: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpforms_payment_meta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpforms_tasks_meta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_also_bought: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_cart_contents: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_cart_item_meta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_checkout_forms: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wpsc_claimed_stock: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_coupon_codes: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_currency_list: Data: 0.02MB + Index: 0.01MB + Engine MyISAM<br>wp_wpsc_download_status: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_meta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wpsc_product_rating: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_purchase_logs: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_purchase_meta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_region_tax: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_submited_form_data: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpsc_visitors: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wpsc_visitor_meta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_yoast_indexable: Data: 0.18MB + Index: 0.06MB + Engine MyISAM<br>wp_yoast_indexable_hierarchy: Data: 0.01MB + Index: 0.02MB + Engine MyISAM<br>wp_yoast_migrations: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_yoast_primary_term: Data: 0.01MB + Index: 0.01MB + Engine MyISAM<br>wp_yoast_seo_links: Data: 0.01MB + Index: 0.00MB + Engine MyISAM<br>wp_yoast_seo_meta: Data: 0.01MB + Index: 0.01MB + Engine MyISAM Post Type Counts<br><br>amn_wpforms-lite: 1<br>attachment: 689<br>custom_css: 1<br>google_maps: 1<br>nav_menu_item: 46<br>page: 14<br>post: 2<br>product: 187<br>product_variation: 625<br>revision: 334<br>shop_order: 3549<br>shop_order_refund: 147<br>wp_global_styles: 1<br>wpforms: 1<br>wpsc-product: 4 Security<br><br>Secure connection (HTTPS): ✔<br>Hide errors from visitors: ✔ Active Plugins (13)<br><br>AAA Option Optimizer: by Joost de Valk – 1.2.1<br>Antispam Bee: by pluginkollektiv – 2.11.7<br>Homepage Control: by WooThemes – 2.0.3<br>LiteSpeed Cache: by LiteSpeed Technologies – 6.5.2<br>Mailchimp for WooCommerce: by Mailchimp – 4.4.1<br>Perfect Brands WooCommerce: by QuadLayers – 3.4.7<br>WooCommerce Weight Based Postage: by weightbasedPostage.com – 6.1.0<br>WooCommerce PayPal Payments: by WooCommerce – 2.9.4<br>PDF Invoices & Packing Slips for WooCommerce: by WP Overnight – 3.9.0<br>Sequential Order Numbers for WooCommerce: by SkyVerge – 1.11.0<br>WooCommerce: by Automattic – 9.4.2<br>Yoast SEO: by Team Yoast – 23.9<br>WPForms Lite: by WPForms – 1.9.2.2 Inactive Plugins (0) Dropin Plugins ()<br><br>maintenance.php: maintenance.php Settings<br><br>Legacy API Enabled: –<br>Force SSL: –<br>Currency: GBP (£)<br>Currency Position: left<br>Thousand Separator: ,<br>Decimal Separator: .<br>Number of Decimals: 2<br>Taxonomies: Product Types: external (external)<br>grouped (grouped)<br>simple (simple)<br>variable (variable)<br><br>Taxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)<br>exclude-from-search (exclude-from-search)<br>featured (featured)<br>outofstock (outofstock)<br>rated-1 (rated-1)<br>rated-2 (rated-2)<br>rated-3 (rated-3)<br>rated-4 (rated-4)<br>rated-5 (rated-5)<br><br>Connected to WooCommerce.com: –<br>Enforce Approved Product Download Directories: –<br>HPOS feature enabled: –<br>Order datastore: WC_Order_Data_Store_CPT<br>HPOS data sync enabled: – Logging<br><br>Enabled: ✔<br>Handler: Automattic\WooCommerce\Internal\Admin\Logging\LogHandlerFileV2<br>Retention period: 30 days<br>Level threshold: –<br>Log directory size: 423 KB WC Pages<br><br>Shop base: #205 - /shop/<br>Basket: #206 - /cart/ - Contains the [woocommerce_cart] shortcode<br>Checkout: #207 - /checkout/ - Contains the [woocommerce_checkout] shortcode<br>My account: #208 - /my-account/<br>Terms and conditions: #98 - /postage-and-returns/ Theme<br><br>Name: Storefront Child<br>Version: 1.0.0<br>Author URL: https://www.flitemedia.com<br>Child Theme: ✔<br>Parent Theme Name: Storefront<br>Parent Theme Version: 4.6.0<br>Parent Theme Author URL: https://woocommerce.com/<br>WooCommerce Support: ✔ Templates<br><br>Overrides: – WooCommerce PayPal Payments<br><br>Onboarded: ✔<br>Shop country code: GB<br>WooCommerce currency supported: ✔<br>Advanced Card Processing available in country: ✔<br>Pay Later messaging available in country: ✔<br>Webhook status: –<br>PayPal Vault enabled: ✔<br>ACDC Vault enabled: ✔<br>Logging enabled: –<br>Reference Transactions: ✔<br>Used PayPal Checkout plugin: ✔<br>Subscriptions Mode: Disabled<br>PayPal Shipping Callback: –<br>Apple Pay: –<br>Google Pay: –<br>Fastlane: – Admin<br><br>Enabled Features: activity-panels<br>analytics<br>product-block-editor<br>coupons<br>core-profiler<br>customize-store<br>customer-effort-score-tracks<br>import-products-task<br>experimental-fashion-sample-products<br>shipping-smart-defaults<br>shipping-setting-tour<br>homescreen<br>marketing<br>mobile-app-banner<br>navigation<br>onboarding<br>onboarding-tasks<br>pattern-toolkit-full-composability<br>product-custom-fields<br>remote-inbox-notifications<br>remote-free-extensions<br>payment-gateway-suggestions<br>printful<br>shipping-label-banner<br>subscriptions<br>store-alerts<br>transient-notices<br>woo-mobile-welcome<br>wc-pay-promotion<br>wc-pay-welcome-page<br>launch-your-store<br><br>Disabled Features: product-data-views<br>experimental-blocks<br>minified-js<br>product-pre-publish-modal<br>settings<br>async-product-editor-category-field<br>product-editor-template-system<br>blueprint<br>reactify-classic-payments-settings<br>use-wp-horizon<br><br>Daily Cron: ✔ Next scheduled: 2024-12-01 17:01:21 +00:00<br>Options: ✔<br>Notes: 155<br>Onboarding: completed Action Scheduler<br><br>Complete: 1,697<br>Oldest: 2024-10-31 06:12:32 +0000<br>Newest: 2024-11-30 23:37:45 +0000<br><br>Failed: 89<br>Oldest: 2022-11-02 03:56:08 +0000<br>Newest: 2024-09-27 17:50:06 +0100<br><br>Pending: 6<br>Oldest: 2024-12-01 07:18:57 +0000<br>Newest: 2024-12-06 14:47:31 +0000 Status report information<br><br>Generated at: 2024-11-30 23:54:22 +00:00<br>Ok thanks .. not sure what the API does but I don’t think we’re using it:
“Access is granted only to those with valid API keys.” and “The legacy REST API is NOT enabled”I’m pretty sure these card tests are manually inputted based on time stamps, in which case captcha might not work either. Annoyingly one went through today; the only way we can tell is because it has an attribution of “unknown”.
I have reCaptcha v2 in place and that has not stopped it.. had 20 attempts today, 3 were successful transactions. 🙁
The topic ‘Attacked by “card testing” – decline orders with origin unknown?’ is closed to new replies.
