gagemail

After all this time, I had no idea that Refund button was there. But, when I just tried to process a refund, the Refund Amount field won’t allow me to type anything in there which of course would have nothing to do with your plugin, just WC. I tried logging out and back in, but still no luck. It just won’t let me type in that field.

I did notice your plugin had an option for allow for “Refund On Cancel”. I haven’t tested it yet, but I can give that a go too. Thanks

Yes, I have been looking at reviews and I’ve seen some nasty ones for the WC Stripe plugin and this is why I was taking a look at yours. I do have to make a decision in the next day or two. The one thing good about the WC version is that there are numerous videos on YT for setup. Although I assume your setup would be almost identical so it shouldn’t be an issue. I also emailed Stripe support to see if they have any feedback.

“Response time is also another consideration which you can see via the support forums for each plugin.” I agree having been a web guy since around 2000 I very much appreciate quick response time. Your response is proof of how fast you are!

By the way, after 20+ years I’ve leaving Wells Fargo Merchant Services and Authorize.net because the support is absolutely awful these days. I will be paying higher fees with Stripe, but it will be worth it get rid of the idiots at those two companies.

Questions about WooCommerce:

1a. Is WMFO part of WooComm? If so, it needs an update. It doesn’t do enough and what is in there doesn’t seem to work. The section to block email domains doesn’t work. This current card tester creates fake or real email address from the domain: mmail.biz. So I block mmail.biz and @mmail.biz. I’ve blocked both of those and he still creates a new account with that email domain.

1b. I need to block a range of IP addresses like 172.56.xxx.xxx. He is repeatedly using a T-Mobile phone with this IP address range which comes up as Philadelphia, PA. This would solve my problem for this current issue. The last two sets of the IP keep changing so I need to block the last two sets with wild cards.

1c. If this plugin is NOT yours can you suggest a plugin that will allow me block a range of IP addresses like 172.56.xxx.xxx. and where the email domain blocking actually works?

2. Is there a way I can have WP send me an email notification whenever someone new creates an account? If so, I can block card testers before they do anything significant as I check email all day long. I do already receive emails when someone changes their password, so I would think this option should exist but I couldn’t fine it.

3. Can I make WComm show me the time as well as the date stamp when a person creates a new account. Time of day would be helpful to see if they come in at the same time every day and then I can look for them and block them.

If I can’t so these simple things quickly and cheaply, I seriously have to decide whether or not to shut down the store.

Thanks, Dave

I am getting crushed by CC testing and fraud. I am lucky to have 3-4 real orders a month, but I waste too much time every day dealing with fraud. I am still waiting to hear back from CardConnect about their plugin. I am not getting any substantial help from Woo or Authorize.net or Wells Fargo Merchant Services or the credit card companies. I have some issues with lack of substantial customer info that I can get from the WooC plugin… I will give you details on what is lacking in the next post. I don’t have a lot of time today. My only workaround has been to shut down the payment plugin during the hours that this a-hole tends to show up – it is one person repeatedly from the same range of IP addresses and I can’t block that range. I have his cell phone number (see below), but no one cares enough to do anything with it.

The following is an email I sent to Wells Fargo who are pretending like they can help. When I escalate to senior support they are essentially clueless as to how it all works and certainly are of no help. Here’s what I sent to WF last week…

===================================================================

“The little creep came in around 8pm my time (10/11/24) which is an hour before I shut off the Payment Processor plugin for the night. He created a new account and again, it’s with a new IP address which was 172.56.xxx.xxx similar to all the other ones which are all spoofed from the Philadelphia area on the T-Mobile network.”

“After he tested two cards, my Authorize.net Fraud Detection Suite cut him off, but it’s sad that with the knowledge that we have including his T-Mobile phone number which he was stupid enough to send me (I did talk with him on the phone): 1 865 371 1802, nobody cares enough to even attempt to go after him.”

“As I said on the phone, if these people are not caught and punished, why should they ever stop. As you can see below, 4 attempts were done with MasterCard and 1 with Visa.”

“I previously set up something in WooCommerce to block his email domain (which is owned by SquareSpace), but it failed. Screenshot below.”

“I guess one of the mega corporations involved in the CC process would have to care at least a little bit. So far, WooCommerce, Authorize-net, Wells Fargo, Visa, MasterCard, T-Mobile don’t care enough to solve this problem so small businesses like me have to live with it. Feel free to forward this to anyone at WFMS that you think might be able to do something.”

[I’d like to upload a couple of images, but I don’t see an easy way to do that.]

@shameemreza Not a problem, I started with coding sites over 20 years ago and I will take care of the htaccess file entry this week.

My contact at http://www.cardpaysolutions.com had been out sick for about 10 days, but we did speak yesterday. I will keep you updated as to what the original plugin programmer has to say.

Hi all, I’m still waiting to hear back from the Card Pay Solutions company. In the meantime, I was hit last night again with card testing twice. Once at 2:30am and again at 6:30am PST. Once I see it happening, I can block the IP with a WC WMFO plugin and also at Authorize.net in the FDS, but it’s still a major pain. I hope to hear back soon from this 3rd party company because as I have pointed out numerous times in this thread there is a definite vulnerability some place. If it’s with their plugin I will stop using it and they should remove it from your store. But, we need proof first.

Of course, it’s not possible to completely ever stop CC testing from happening, but the fact that a fraudster posing as a customer who can somehow put the system into TEST MODE is the problem.

Ironically, as I said earlier, I make almost no money from this store. It’s just barely enough to keep it going, but I spend a massive amount of my time dealing with this kind of BS plus many other backend BS chores like book keeping, sales tax, updates, etc.

Hi carolm29,

Yes, please keep it open. I spoke with Oscar on Friday from the company (CardConnect) that made the Authorize CIM plugin that I use: https://wordpress.com/plugins/authnet-cim-for-woo and he is going to talk with the original programmer about this issue.

Oscar explained that the only way a hacker can log in as a customer and create a sale using TEST MODE (without it or Sandbox being on) is if encryption is missing at one of the stages… either from (1) the WC checkout page to WC or from (2) WC to the Authorize CIM plugin or (3) via the Authorize CIM plugin to Authorize.net. It is one of those 3. The question is which one is the problem.

He will ask the programmer if he can join this discussion thread once he’s talked to him about it next week.

Thanks, Dave