Answers.Body: <p>I am not certain what can be done to stop people 'testing' if stolen credit card details if that is what is happening. There is a <a href="https://civicrm.org/blogs/xcf33/civicrm-flood-control-use-case-and-implementation" rel="nofollow noreferrer">blog</a> about it and an old <a href="https://forum.civicrm.org/index.php?topic=19243.0" rel="nofollow noreferrer">forum topic</a> you might glean something from</p>
  
  <p>And this <a href="https://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages">SE question</a> is where the conversation moved to.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-19T01:17:44.773Z
Answers.Text: Thanks. What's alarming is it happened within the same week for two installs on separate sites, its almost like Civi is being targeted for this testing. Does a CAPTCHA on the registration form prevent this - do you think they are mostly drive-by's done by automated scripts?
Answers.UserDisplayName: Zachary
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-20T19:04:27.400Z
Answers.Text: reCaptcha on sites helps to prevent spambots. Are the sites receiving the money? Wild guesses: perhaps there is some attempt to defraud PayPal going on if you are not getting the money or if a refund is immediately requested, or perhaps there is an intent to verify the card number.
Answers.UserDisplayName: Joe Murray
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-24T01:09:45.627Z
Answers.Text: According to Paypal (we called) the fraudulent payments aren't covered by seller protection because we didn't require a shipping address. So we have to either keep the funds until something happens, or issue a refund (at our slight expense).
Answers.UserDisplayName: Zachary
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-24T02:22:04.883Z
Answers.Text: updated answer with link to other post about flood control
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-09T18:25:53.453Z
Answers.Text: Does CiviCRM support anything like this for Paypal Website Payment Pro? https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/Marketing_CommandDriven/merchant/RiskControlsUpgrade-outside
  
  Yes, it is being used on a couple of my sites to test stolen credit cards. The other posts aren't too helpful because I don't believe it is a drive-by bot operation, but I have enabled captcha just in case.
Answers.UserDisplayName: Zachary
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-09T22:31:09.750Z
Answers.Text: Check https://wiki.civicrm.org/confluence/display/CRMDOC/Payment+Processors
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-18T22:52:23.193Z
Answers.LastActivityDate: 2016-03-24T02:22:41.257Z
Answers.LastEditDate: 2017-04-13T12:53:13.017Z
Answers.UserDisplayName: petednz - fuzion
Answers.Body: <p>PayPal also offers some fraud filters. There's a decent starting set that come with PayPal Pro (they also offer more advanced ones for a monthly fee), their customer service is pretty good if you call and ask for some help with them and explain about the transactions you suspect are fraudulent.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-22T21:00:48.770Z
Answers.LastActivityDate: 2016-03-22T21:00:48.770Z
Answers.UserDisplayName: RayWright
Body: <p>A Membership payment was made successfully using our Contribute form with a new contact created such as:</p>
  
  <p>name: fffff fffff</p>
  
  <p>address:
  asdadad 4
  davie, FL 33328
  United States</p>
  
  <p>email:</p>
  
  <p>jdchjffdjhf@gmail.com</p>
  
  <p>Contribution says paid by Credit Card, and there is also a transaction/invoice ID. </p>
  
  <p>Why is CiviCRM Paypal WPP processor allowing this contribution which obviously appears to be fraudulent? Is this due to our set up</p>
  
  <p>Thank you.</p>
  
  <p>Drupal 7 / CiviCRM 4.6.x</p>
  
Tags: <civicontribute>
Title: Donations Made with False Name and Address using Paypal WPP
ThreadText: # Donations Made with False Name and Address using Paypal WPP
  
  (Asked by: username_0 on 2016-03-18)
  
  A Membership payment was made successfully using our Contribute form with a new contact created such as:
  
  name: fffff fffff
  
  address:
  asdadad 4
  davie, FL 33328
  United States
  
  email:
  
  jdchjffdjhf@gmail.com
  
  Contribution says paid by Credit Card, and there is also a transaction/invoice ID.
  
  Why is CiviCRM Paypal WPP processor allowing this contribution which obviously appears to be fraudulent? Is this due to our set up
  
  Thank you.
  
  Drupal 7 / CiviCRM 4.6.x
  
  **Tags:** civicontribute
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2016-03-18. Score: 2
  
  I am not certain what can be done to stop people 'testing' if stolen credit card details if that is what is happening. There is a [blog](https://civicrm.org/blogs/xcf33/civicrm-flood-control-use-case-and-implementation) about it and an old [forum topic](https://forum.civicrm.org/index.php?topic=19243.0) you might glean something from
  
  And this [SE question](https://civicrm.stackexchange.com/questions/2345/how-to-prevent-fraud-attempts-on-contribution-pages) is where the conversation moved to.
  
  > **Comments:**
  > **username_0**: Thanks. What's alarming is it happened within the same week for two installs on separate sites, its almost like Civi is being targeted for this testing. Does a CAPTCHA on the registration form prevent this - do you think they are mostly drive-by's done by automated scripts?  
  > **username_2**: reCaptcha on sites helps to prevent spambots. Are the sites receiving the money? Wild guesses: perhaps there is some attempt to defraud PayPal going on if you are not getting the money or if a refund is immediately requested, or perhaps there is an intent to verify the card number.  
  > **username_0**: According to Paypal (we called) the fraudulent payments aren't covered by seller protection because we didn't require a shipping address. So we have to either keep the funds until something happens, or issue a refund (at our slight expense).  
  > **username_1**: updated answer with link to other post about flood control  
  > **username_0**: Does CiviCRM support anything like this for Paypal Website Payment Pro? https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/Marketing_CommandDriven/merchant/RiskControlsUpgrade-outside  Yes, it is being used on a couple of my sites to test stolen credit cards. The other posts aren't too helpful because I don't believe it is a drive-by bot operation, but I have enabled captcha just in case.  
  > **username_1**: Check https://wiki.civicrm.org/confluence/display/CRMDOC/Payment+Processors  
  
  ---
  
  ### Answer by username_3 on 2016-03-22. Score: 2
  
  PayPal also offers some fraud filters. There's a decent starting set that come with PayPal Pro (they also offer more advanced ones for a monthly fee), their customer service is pretty good if you call and ask for some help with them and explain about the transactions you suspect are fraudulent.
  
  
  ---
  
  