Combatting Card Testing & Fraudulent Orders on BigCommerce: A Community Guide

Unmasking and Mitigating Card Testing Fraud on Your BigCommerce Store

The digital storefront brings immense opportunities, but also the persistent challenge of fraudulent activity. A recent BigCommerce forum thread, initiated by merchant Kim Olsen, shed light on a common yet frustrating issue: receiving numerous orders with captured funds, but suspicious customer details leading to undeliverable packages and bounced emails. This scenario, characterized by mismatched names and email addresses (e.g., 'Todd Green' with 'Sophia.Moore@gmail.com'), is a classic indicator of card testing or payment fraud, not a compromise of the BigCommerce store itself.

Diagnosing the Fraudulent Pattern

Community experts Sri Vathson and Solomon Lite quickly confirmed that Kim's experience aligns with typical card-testing fraud. Fraudsters acquire stolen credit card numbers from external breaches and use public checkout pages, like those on BigCommerce stores, to test their validity. They often use throwaway or scraped personal information for the order details, leading to the inconsistencies observed.

Immediate Actions for Existing Fraudulent Orders

• Cancel and Refund Promptly: If an order hasn't shipped, cancel and refund it immediately. Waiting to contact the 'customer' is futile as the provided email is likely fake.
• Understand Processor Fees: Be aware that canceling a captured charge typically incurs a small processor fee, which is significantly less costly than losing product to a future chargeback.
• Confirm Returns Before Refund: If an order has already shipped and is returned as undeliverable, only issue a refund after you've physically confirmed the goods are back in your possession.
• Exercise Caution with Shipping: Avoid shipping orders with mismatched billing/shipping information, AVS (Address Verification Service) or CVV (Card Verification Value) failures, or first-time high-value orders to new addresses. These are common red flags for converting card testing into actual product loss.

Proactive Strategies to Prevent Future Fraud

The BigCommerce community offered several actionable steps to bolster fraud prevention:

• Leverage Fraud Indicators: Regularly review order details for fraud indicators such as AVS/CVV results, IP address, geolocation, and any risk scores provided by your payment gateway.
• Enhance Gateway Fraud Protection: Enable or tighten fraud protection features available through your specific payment gateway.
• Utilize BigCommerce Fraud Tools: Explore and activate BigCommerce's built-in fraud protection features, which may vary by plan.
• Block Suspicious Patterns: Implement blocking for repeat IP addresses or suspicious email domains if you notice a recurring pattern.
• Monitor for Card Testing: Keep an eye out for repeated low-value orders, a common tactic for card testing.
• Stricter AVS/CVV Verification: Configure your BigCommerce store or payment processor to not just flag, but actively decline orders with AVS and CVV mismatches.
• Integrate Fraud Screening Apps: Consider adding a dedicated fraud-screening app from the BigCommerce Marketplace, such as Signifyd, NoFraud, or Kount. These apps score orders in real-time and can automatically hold suspicious transactions before capture.
• Require Account Creation: As suggested by Tanner Brodhagen, requiring customers to create an account (disabling guest checkout) can deter fraudsters using fake emails.
• Implement CAPTCHA/Rate Limits: If experiencing a burst of orders, especially in a short window, consider adding a CAPTCHA or rate limiting on checkout to combat bot-driven card testing.
• Review Admin Access: While unlikely to be a store compromise, it's always wise to periodically check your BigCommerce account for any unfamiliar admin users or API keys.
• Custom Customer Groups: Ken Persson shared an innovative approach: creating a 'SPAMMER' customer group that is unable to place orders. This allows merchants to proactively ban known fraudsters or problematic customers, significantly improving store management.

While Kim Olsen noted the challenge of finding time to implement all these solutions, the thread underscores the importance of a multi-layered approach to fraud prevention. By understanding the common tactics of fraudsters and leveraging BigCommerce's features and marketplace apps, merchants can significantly reduce their exposure to card testing and payment fraud, safeguarding their business and peace of mind.