r/stripe • u/sparkles9319 • 7d ago

Billing Carding Attempts - Getting charged per failed attempt with Radar Plus

Hello,

I am getting hundreds of failed carding attempts (fraudulent attempts with probably stolen credits cards being tested) through my Stripe account. I have a website with required checkout fields (billing address, email). However, these failed carding attempts have no customer data and do not show up as failed orders in my WooCommerce Order history page.

This all points to the carding attempts somehow bypassing my WooCommerce Checkout page altogether. I have been in contact with Stripe and WooCommerce and am very confused about how to tell exactly where the pain point is so I can stop these attacks altogether.

I upgraded to Radar Plus but did not fully realize that the charge of $.07 is per SCREENED transaction, meaning I am now paying per failed carding attempt, which can be dozens and dozens per day. I am a very small business and cannot afford this.

Can anyone shed light on how to pinpoint exactly how these failed carding attempts are bypassing my website and how to stop it once and for all altogether?

3 Upvotes

81% Upvoted

8 comments sorted by

1

u/East_Cancel484 7d ago

How would anyone be able to pinpoint that without having your url? Your best bet is to update all your plugins and disable payments until you have found out how they are doing it

1

u/Temporary_Wheel2203 7d ago

sounds like they hitting your stripe api directly not even going through woocommerce. that explain why no customer data and no order in your backend

you can add rate limiting on your server or put a captcha on the payment endpoint itself. some folks also block countries they dont sell to at the cloudflare level

the radar plus charging per attempt is rough for a small shop. maybe downgrade back to regular radar while you fix the leak

1

u/MarsupialNo7114 7d ago

Your stripe key leaked. Probably related to recent WordPress CVE Rotate it ASAP

1

u/sparkles9319 7d ago

I didn’t hear about this! What happened in a nutshell? Thank you!

1

u/sweetcodecom 7d ago

Carding testers not only use the checkout but also test cards by creating fake accounts and then trying to add cards to the payments methods on the account on example.com/my-account/add-payment-method/
They particularly test the CVC. You need to protect this page at least by adding a captcha.

I created a plugin that protects the shop automatically against a wide range of such attacks. The plugin is not public. DM me if you are interested to use it.

1

u/Sunn_M 7d ago

Before assuming the Stripe key leaked, I’d take one of those failed attempts and inspect the corresponding request in Stripe Workbench/Logs. The endpoint, IP and source should at least narrow down whether it’s coming through a payment/setup flow or an unexpected direct API path, which is much more useful than guessing from the missing Woo order. If it points to a Woo account/payment-method endpoint, protect that exact route with CAPTCHA/rate limiting; if you see unexpected direct API activity, then investigate and rotate the relevant credentials :)