Thread by @lzsthw

Simulating someone hacking the input behind the slider to inject bad numbers. I gave a validation rule that limits to 20-50 to test how to disable the payments and show an error on both ends. Then on the backend I'll confirm it again. The reason for this limitation is carding.

For those of you who don't know, carding is the process of testing banks of stolen credit cards to see which ones are still valid and can be sold. They do this by finding unrestricted donation forms and use them to post a charge for $1. If it works they sell the card.

If you allow unrestricted donations then you can get hit by a huge whack of carders, then the chargebacks come rolling in, and you have to pay $15-30 to deal with each one, even if you just do a refund and don't contest it. Stripe is actually the *worst* for this.

It's also a devious attack vector. If you happen to piss off the wrong group of people they just roll in, charge 1000 charges at $1 each, then chargeback on them. Get 1000 angry people and you're now on the hook for $15-30k in fees which could easily wipe out some people.

Ultimately though this isn't your fault and you shouldn't be paying a fee. Companies like Stripe make big money on *not* preventing fraud, which is why they charge you even if you don't contest it, and why you never win them. They aren't doing jack to contest it.

The stupidest thing is, if companies like Stripe simply blocked known VPNs, Tor, and confirmed the IP is in the same *country* as the card, they could block 80-90% of fraud. Carders always either come in from outside the US or use VPNs/Tor.

But, there's big money in fraud.

The other stupid thing--which definitely should be made into law--is the credit card companies don't track or notify of bad cards. If companies simply registered cards and the chargebacks done you could block another huge chunk of fraud.

But, there's big money in fraud.

So, until companies start sharing fraudulent cards, chargeback counts, and doing even just basic fraud protection like "is IP in same country", I highly recommend you only allow donations > $10, or even $20 to at least deter carders.