As outlined in my post Do payment gateways or shopping cart providers really care about credit card fraud? our website was used to screen thousands of credit cards and we were charged processing fees for each attempt (see Notice from Chase Your Authorization Activity Is At Risk Due Possible Card Testing) back in April. I reported the issue to Chase Paymentech in early May after receiving our April 2018 statement and after almost 4 months a refund for the $2,400 in fees we were charged was issued.

In order to receive that refund I had to sign a document basically stating it is not Paymentech’s fault, that If this happens again we are responsible and that I can not disclose information about the settlement.

I still don’t understand how Paymentech’s and 3dcart’s systems allowed such a clear card screening attempt to happen, both were allowing several thousand credit card attempts, one after the other, typically 2-3 seconds apart from the same IP address and for the exact same order. It seems like both should have systems in place that prevent such clear attempts. That said Paymentech did give us access to some card screening tools that we did not have access to when this happened. I also was able to configure 3dcart to prevent the issue (I think) but had to pay for their Fraud Watch addon to do it.