Yesterday, for the first time in the seven-year history of our OPLF shopping cart, somebody used our shopping cart for “card testing”. A fraudster in a foreign country had purchased a bundle of stolen credit card numbers, and wanted to determine which of the cards was still valid. Such a person will engage in “card testing”. The person tries to make purchases with the credit card numbers, using an online commerce site. Yesterday, the person chose our OPLF shopping cart. By the time that we had shut out the “card testing”, the fraudster had tested about 198 credit card numbers, and had found two of the cards to be valid. (This means the card holder had not yet canceled the stolen card number.)
The service providers Woo and Stripe performed admirably in this incident.
How did we learn that the “card testing” was happening? What did we do in response? What permanent harm, if any, flowed from this incident? What protective step might we have taken earlier? Continue reading “What is “card testing”? What should you do about it?”