As outlined in my post Do payment gateways or shopping cart providers really care about credit card fraud? our website was used to screen thousands of credit cards and we were charged processing fees for each attempt (see Notice from Chase Your Authorization Activity Is At Risk Due Possible Card Testing) back in April. I reported the issue to Chase Paymentech in early May after receiving our April 2018 statement and after almost 4 months a refund for the $2,400 in fees we were charged was issued.

In order to receive that refund I had to sign a document basically stating it is not Paymentech’s fault, that If this happens again we are responsible and that I can not disclose information about the settlement.

I still don’t understand how Paymentech’s and 3dcart’s systems allowed such a clear card screening attempt to happen, both were allowing several thousand credit card attempts, one after the other, typically 2-3 seconds apart from the same IP address and for the exact same order. It seems like both should have systems in place that prevent such clear attempts. That said Paymentech did give us access to some card screening tools that we did not have access to when this happened. I also was able to configure 3dcart to prevent the issue (I think) but had to pay for their Fraud Watch addon to do it.

Yesterday, 26 days after the first stolen credit card screening event mentioned in my previous post I received a notice from Chase titled “Your authorization activity is a risk”. The message stated that our ability to authorize transactions is at risk due to a high number of declined transactions that might be a form of “card testing”.

About the only thing I can say to this is really? Not only is it 26 days after the first group on 4/06 but it looks like the email is for a group of about 1,400 transactions that occurred on 4/18/2018. There is no acknowledgement of the much larger 8,600 and 3,500 groups from 4/06 and 4/07/2018.

I also did not realize it at the time but the gateway (Chase Paymetech) is charging us for each declined credit card attempt. No wonder their system allows the fraud attempts to occur! They charge the merchant for the privilege of being used to screen stolen credit cards!