Answers.Body: <p>Jim,</p>
  
  <p>This is a very common scam, the best way is to add recaptcha; it's worked for all of our clients with this issue.  The new recaptcha "I am not a robot" is very user friendly.  This can be set up from the CiviCRM admin menu.</p>
  
  <p>If your coming to the CiviCRM User summit today, please speak with Steven from iATS, he is very knowledgeable in this space and is giving a talk on security that will include this topic.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-24T15:28:07.443Z
Answers.Text: One additional point to Paul's comment: the "I am not a robot" recaptcha is supported natively in Civi from 4.6.x forward, I believe; if you want it for earlier versions, you'll need to backport the changes to use Google's new API.  (You didn't specify what version of Civi you're using so wanted to point this out just in case.)
Answers.UserDisplayName: Lesley Carter - BackOffice
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-24T15:12:36.753Z
Answers.LastActivityDate: 2015-09-24T15:12:36.753Z
Answers.UserDisplayName: pkeogan - BackOffice Thinking
Answers.Body: <p>The Authorize.net fraud detection suite now includes a "Transaction IP Velocity Filter."  This must be new since the last time I looked at the fraud settings.  In any case, you can now set a rule to block IPs that attempt more than 5 transactions in an hour, and you can also whitelist IPs.</p>
  
  <p>Hoping this will take care of the issue.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-01-14T14:52:47.653Z
Answers.Text: Any defence against abuse has to be considered against your specific reality, since you don't want to shoot yourself in the foot. For example - if you've got an administrator manually entering a bunch of credit card donations in CiviCRM, you want to make sure you don't block them.
Answers.UserDisplayName: Alan Dixon
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-25T23:02:20.367Z
Answers.LastActivityDate: 2015-09-25T23:02:20.367Z
Answers.UserDisplayName: Jim Meehan
Answers.Body: <p>iATS Payments also provides a server-level transaction ip velocity filter, amongst other security features, as listed here:</p>
  
  <p><a href="http://home.iatspayments.com/fraud-protection-features" rel="nofollow">http://home.iatspayments.com/fraud-protection-features</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-01-14T14:48:09.460Z
Answers.LastActivityDate: 2016-01-14T14:48:09.460Z
Answers.UserDisplayName: Alan Dixon
Body: <p>Recently we've had some bots testing (stolen?) CC numbers against our CiviContribute form.  Our payment processor declines them all, but it sometimes results in our account getting suspended for 30 minutes.</p>
  
  <p>Has anyone implemented per-IP-address transaction rate limiting?  As a module, or some other way?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-24T20:28:04.087Z
Comments.Text: possible duplicate of [How to prevent fraud attempts on Contribution pages?](http://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages)
Comments.UserDisplayName: Jon G - Megaphone Tech
Tags: <civicontribute><payment-processor>
Title: CiviContribute: transaction rate limiting
ThreadText: # CiviContribute: transaction rate limiting
  
  (Asked by: username_0 on 2015-09-24)
  
  Recently we've had some bots testing (stolen?) CC numbers against our CiviContribute form. Our payment processor declines them all, but it sometimes results in our account getting suspended for 30 minutes.
  
  Has anyone implemented per-IP-address transaction rate limiting? As a module, or some other way?
  
  **Tags:** civicontribute, payment-processor
  
  > **Comments:**
  > **username_1**: possible duplicate of [How to prevent fraud attempts on Contribution pages?](http://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages)  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2015-09-24. Score: 1
  
  Jim,
  
  This is a very common scam, the best way is to add recaptcha; it's worked for all of our clients with this issue. The new recaptcha "I am not a robot" is very user friendly. This can be set up from the CiviCRM admin menu.
  
  If your coming to the CiviCRM User summit today, please speak with Steven from iATS, he is very knowledgeable in this space and is giving a talk on security that will include this topic.
  
  > **Comments:**
  > **username_3**: One additional point to Paul's comment: the "I am not a robot" recaptcha is supported natively in Civi from 4.6.x forward, I believe; if you want it for earlier versions, you'll need to backport the changes to use Google's new API.  (You didn't specify what version of Civi you're using so wanted to point this out just in case.)  
  
  ---
  
  ### Answer by username_0 on 2015-09-25. Score: 0
  
  The Authorize.net fraud detection suite now includes a "Transaction IP Velocity Filter." This must be new since the last time I looked at the fraud settings. In any case, you can now set a rule to block IPs that attempt more than 5 transactions in an hour, and you can also whitelist IPs.
  
  Hoping this will take care of the issue.
  
  > **Comments:**
  > **username_4**: Any defence against abuse has to be considered against your specific reality, since you don't want to shoot yourself in the foot. For example - if you've got an administrator manually entering a bunch of credit card donations in CiviCRM, you want to make sure you don't block them.  
  
  ---
  
  ### Answer by username_4 on 2016-01-14. Score: 0
  
  iATS Payments also provides a server-level transaction ip velocity filter, amongst other security features, as listed here:
  
  <http://home.iatspayments.com/fraud-protection-features>
  
  
  ---
  
  