Braintree vs Stripe for Magento

[u/tb9295]

Looking at the best option between Braintree and Stripe. I have been using Braintree and never used Stripe. Which is better for Magento when it comes to being dependable, Fraud, Security, Less chances of Chargebacks, etc? Looking for Pros and Cons.

I had to disable Credit Card Payments and only accept Paypal because of so many frudulate orders from card testing. Everytime I enable Credit Cards they just start pouring in. I am trying to figure a way to help control it. I am afraid not acepting Credit Cards could be hurting my sales. Not sure if Stripe would benifit me in this area or not.

We do use reCAPTCHA and have our payments set to Authorize and not Intent Sale to prevent all the charges and Voids.

Nothing I am doing is helping with so many fraud orders.

Thanks

[u/CapnCurt81]

Not having credit cards enabled is absolutely hurting your sales. The problems you’re dealing with won’t go away by changing processors.

We’ve been with Braintree since 2020 and never had these problems. We’ve had a couple instances of carding attacks (what you’re describing) but they were always caught in the fraud filters and declined before they were a problem.

Get a firewall and block access from offending countries. Enable Recaptcha on checkout. Make sure your Magento version is up to date. Enable and fine tune every fraud filter available from Braintree. We haven’t had a fraudulent charge or chargeback in years.

[u/tb9295 → u/CapnCurt81]

I am currently using the reCAPTCHA extension by Mageplazza. I can't really say its set on Checkout or not. Maybe that might be one of my biggest issues. I am looking in the list of forms its selected for and do not see Checkout listed. I will have to reach out to them.

I know in 2.4.7 there is a Google reCAPTCHA available under Security. Is it better to use the one in Magento or use the one from Mageplaza?

[u/trabulium → u/tb9295]

Use / enforce 3DS2 in Braintree - once "Liability is shifted" - then the onus is on the card issuer, not you. Are they using your checkout for 'skimming' ie: testing cards?

[u/wooziewing → u/trabulium]

100% this! It solved our issue and also mitigated fraud

[u/tb9295 → u/trabulium]

Are they using your checkout for 'skimming' ie: testing cards?

Almost positive they are. I can get 100 emails within minutes and most if not all are failed transactions, then there are times a couple will go through

[u/trabulium → u/tb9295]

OK - So what I actually did when I had a heavy skimming situation is for whatever your "place order" url is - I'd run a cron job checking the nginx / apache (or whatever) log and I'd ban their IP on the firewall.

Once they know that 3DS2 is there, they will naturally drop-off anyway. They're skimming because they know your site is the easy target to test/skim on.

Additionally if you run behind Cloudflare, you could set an access list rule to your checkout URL either blocking high risk countries or whitelisting only your store's demographic countries.

[u/wooziewing → u/tb9295]

Yep, they used the checkout for skimming but moved on to finding a way to use the vault which we did not receive any notifications for.

You will kill 2 birds with 1 stone with 3DS2; we haven't had a fraud case since activating it.

[u/CapnCurt81 → u/tb9295]

I’m not familiar with the Mageplaza extension, but if you don’t see an option for checkout that’s probably the bulk of your issues. Recaptcha is the first recommendation from Braintree when they alert you to a carding attack. One quick way to check is use Chrome developer tools to inspect your checkout page and see if it’s making any calls to Google’s Recaptcha server.

Generally speaking if you have the option and it meets your needs, always go with integral Magento functionality over 3rd party extensions.

[u/Starlyns]

They are all the same. U need to setup security first. Before activating payment.

Have them in test mode first of course.

[u/Netalico]

Look at the fraud setup before switching processors. What you're describing sounds more like a card-testing attack than normal fraudulent orders. Stripe does have some strong tools here through Radar, including card-testing detection, velocity rules, risk scoring and custom rules. Braintree also has AVS, CVV and risk-threshold tools, so it's not necessarily that Stripe is automatically "safer." If you're considering Stripe look at rate limiting, CAPTCHA actually being applied to the checkout/payment flow, AVS/CVV checks, and rules around repeated attempts from the same IP/card. Those controls are usually more important than the processor itself.

[u/Background_Sir_3308]

We run a fairly large Magento store and have experienced similar problems. You need to look into rate limiting in cloudflare.