Managing and Mitigating Bots

Chapter 7. Credit Card Fraud

Automated traffic categorized as credit card fraud is straightforward—it is the use of automated processes to fraudulently take advantage of credit card data.

As previously mentioned, there is often overlap between these activities and those of checkout abuse (discussed in Chapter 6) but these activities are separated due to the explicitly fraudulent intent involved.

Many of the processes put in place to protect against non-automated credit card fraud (such as Verified by Visa, 3D Secure, and post-transaction fraud checking services) will also act as protection against automated card fraud.

Good or Bad?

There is no disputing that these activities are universally bad. The objective is to use your site to process payments using credit cards without the cardholder’s permission, therefore making you liable to chargebacks.

Let’s now look at some specific examples of credit card fraud bots.

Card Validation

Often shortened to carding, this is the attempt to process small value transactions to validate the continued validity of a set of credit card data, usually before selling that card data on at a higher value or using that card for higher value transactions.

Technically these bots use the same technology as scalping bots and take the same precautions to cover their tracks to avoid detection.

Commonly lists of card data will be processed in this way through a small number of known sites (usually sites that offer low-value purchases with limited traceability). ...