Are the fraudsters using the charity website itself for confirmation that the ca... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

bcoates on Nov 6, 2012 | parent | context | favorite | on: Stolen Money on Gittip, Part 1

Are the fraudsters using the charity website itself for confirmation that the card works?

Could you run them off by just always displaying success for any sane-looking small value donation, without leaking the result from your payment processor?

caf on Nov 6, 2012 [–]

This seems like one of the best options - just makes sure the LUHN checks out and the expiry date is in the future, for any small value donation.

Alternately (or in addition to this), you could rate-limit form submissions from the same address.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact