Your rate limits on adding and removing credit cards? Your input sanitization? Designing your system to not just disclose details around anything but that relevant to a logged in/authenticated user?
There are many practical ways to handle that sort of thing that isn't Cloudflare. It just requires thinking and a bit of dev time.
t. Been there, done that, cartels used an app to try to launder money through loyalty programs. Management was deadset against doing the one single thing that would make it impossible to do that at scale.
Ulterior motives abound everywhere but especially behind people claiming X is the only answer. Fingerprinting is far more intrusive than just only allowing one to add at max 2 cards a day per user.
Your rate limits on adding and removing credit cards?
All those requests will appear from different ip's and different browsers, made by someone who can spend months on trying to defraud you. How do you differentiate this from valid customer who happens to try to buy something between 20 tries by bots?
Your input sanitization?
All those fraud requests will give you valid credit cards which will work perfectly, but then defrauded people or banks will try to chargeback later.
Designing your system to not just disclose details around anything but that relevant to a logged in/authenticated user?
They can register as normal buyers.
It just requires thinking and a bit of dev time.
And they can spend months trying to outthink you, then will drain your service in 4 hours when you are asleep.
Management was deadset against doing the one single thing that would make it impossible to do that at scale.
So, did you actually ever implemented and checked a good solution? Cloudflare isn't perfect, but not everyone has resources to implement their own solution that is better than cloudflare.
Fingerprinting is far more intrusive than just only allowing one to add at max 2 cards a day per user.
The fraudsters will appear as completely new users each time, adding only one card and making one purchase.
It doesn’t matter that they can’t get past 3D-S, because the whole point of what they’re doing is checking what security features are enabled for a card, and whether their address and other validation data will pass. The fact that the scammers are testing so many cards that fail gets you banned from those payments providers, whether or not any payments go through. And this is ignoring all the attackers using bots for other purposes such as taking control of the website to obtain user or client data.
Comments
Your rate limits on adding and removing credit cards? Your input sanitization? Designing your system to not just disclose details around anything but that relevant to a logged in/authenticated user?
There are many practical ways to handle that sort of thing that isn't Cloudflare. It just requires thinking and a bit of dev time.
t. Been there, done that, cartels used an app to try to launder money through loyalty programs. Management was deadset against doing the one single thing that would make it impossible to do that at scale.
Ulterior motives abound everywhere but especially behind people claiming X is the only answer. Fingerprinting is far more intrusive than just only allowing one to add at max 2 cards a day per user.
All those requests will appear from different ip's and different browsers, made by someone who can spend months on trying to defraud you. How do you differentiate this from valid customer who happens to try to buy something between 20 tries by bots?
All those fraud requests will give you valid credit cards which will work perfectly, but then defrauded people or banks will try to chargeback later.
They can register as normal buyers.
And they can spend months trying to outthink you, then will drain your service in 4 hours when you are asleep.
So, did you actually ever implemented and checked a good solution? Cloudflare isn't perfect, but not everyone has resources to implement their own solution that is better than cloudflare.
The fraudsters will appear as completely new users each time, adding only one card and making one purchase.
How are they getting pass 3D-S?
If they are able to get past it, then your liability drops off.
Yes it could be designed better, but that is a separate discussion.
It doesn’t matter that they can’t get past 3D-S, because the whole point of what they’re doing is checking what security features are enabled for a card, and whether their address and other validation data will pass. The fact that the scammers are testing so many cards that fail gets you banned from those payments providers, whether or not any payments go through. And this is ignoring all the attackers using bots for other purposes such as taking control of the website to obtain user or client data.