opinion

How to Halt Hackers as Fraud Attacks Rise

How to Halt Hackers as Fraud Attacks Rise

For hackers, it’s often a game of trial and error. Bad actors will perform enumeration and account testing, repeating the same test on a system to look for vulnerabilities — and if you are not equipped with the proper tools, your merchant account could be the next target.

This kind of attack is most frequently conducted using automated software, trying as many different combinations as possible until they get a hit uncovering a user’s sensitive information. When it comes to credit card hacking, leaving this risk unmitigated could lead to extensive authorization fees for each attempt and even the merchant account being shut down.

The best approach is to institute as many safety measures as possible on your site, and leverage all the robust tools your service provider has in place to fight these types of fraud.

This month, we will talk about how these fraud attacks work and how you can guard your accounts.

The Threat Is Real

Over the last year, we’ve seen an increase in enumeration attacks and account testing, and we’ve seen it firsthand. Recently, one of our merchants processing through another gateway was subjected to an attack that lasted two days and resulted in close to 4 million attempted authorizations. Neither the merchant nor the gateway provider had tools in place to combat the attack.

The results were not good. The merchant identification number (MID) — the unique code that identifies a business’s merchant account used for processing debit and credit payments — had to be shut down, and the merchant was hit with exorbitant authorization fees. After the MID was turned back on 24 hours later, the merchant added additional code to their checkout flow and the gateway added additional tools to help block future attacks.

Our acquirers are also seeing an increase in these types of attacks. Even Visa now has a solution in place as part of its new Visa Acquiring Monitoring Program (VAMP), which we will share more about next month.

What to Look For

If you haven’t experienced one of these attacks yourself, you may be wondering: “How will I know if this is happening to me? What happens during an attack?” Let’s break down and define the different types of attacks.

An enumeration attack is when fraudsters systematically submit card-not-present (CNP) authorization attempts. These attacks are concentrated on a single bank identification number (BIN) or multiple BINs, and iterate through various combinations of payment values such as a primary account number (PAN), expiration date, card verification value 2 (CVV2) or postal code. These attacks succeed when the right combination of payment values returns an approval response.

Account testing attacks occur when fraudsters submit one or two low-amount transactions to test whether a payment account is active. If the account is confirmed active, the fraudsters will later use it to commit fraud. In most cases, the attack happens on multiple payment accounts with the same issuing BIN. In some instances, payment accounts that have been successfully tested are sold to others to commit fraud. This attack is also known as BIN testing, card stuffing, card tumbling or a credit master attack.

Don’t Panic, Prepare

As a merchant, there are some best practices you can put in place to protect yourself. Here are some tips directly from Visa:

  • Implement anomaly detection, which identifies anomalies early. Sudden spikes in the daily average and declined transactions should be investigated. These spikes could indicate that the business has become a target.
  • Put an alert on transactions with a large volume of approvals or declines from a similar BIN. Also have an alert on any increase in reversals being sent. Occasionally, fraudsters will immediately send a reversal after an authorization receives an approval.
  • Analyze time zone differences and browser language inconsistency with the cardholder’s IP address and device. Classify these transactions as higher risk and perform a more stringent review.
  • Make sure to include IP addresses with multiple failed card payment data in a fraud detection blacklist database for manual review, and look for multiple tracking elements in a purchase linked to the same device — for example, multiple transactions with different payment accounts that use the same email address and same device ID. These may be a trigger for fraud classification or review.
  • Look for logins for a single payment account coming from many IP addresses.
  • Review logins with suspicious passwords, or unique encrypted hashes of passwords, that hackers commonly use. Some merchants can detect fraud based on a gray list with a set or combinations of passwords used in fraudulent transactions.

Be in Control

Velocity controls are also helpful in the fight against fraud. Monitor the velocity of small and large transactions, in particular low-amount authorization-only transactions. Account testing transactions are often less than $10. Thresholds should also be set on the number of transactions within a specified timeframe. Also, always monitor the velocity on various data elements such as an IP address, device or email.

Keep an eye on things right from the start during user account creation. Make sure to limit the number of cards that can be added per account and per session, and limit the number of accounts that can be created per IP within a set time frame. Monitor the frequency of payment method changes on accounts. Be sure to utilize Captcha for user registration, since it enables web hosts to distinguish between human and automated access to websites. Lastly, terminate guest user sessions that are pending for longer than a designated amount of time.

Know Your Tools

There are many technical tools out there that can help, and most likely at least some of these are already in place through your payment facilitator or gateway. Most are set up to prevent merchants from being hit by enumeration and testing attacks, and to make it easy to quickly identify an attack and block it. With a block, garbage transactions are stopped before they are sent to acquirers and issuers, which also stops unwanted authorization fees.

Take the time to talk to your provider and ask them what tools they have in place to protect you. The best approach is to institute as many safety measures as possible on your site, and leverage all the robust tools your service provider has in place to fight these types of fraud.

Cathy Beardsley is president and CEO of Segpay, a merchant services provider offering a wide range of custom financial solutions including payment facilitator, direct merchant accounts and secure gateway services. Under her direction, Segpay has become one of four companies approved by Visa to operate as a high-risk internet payment services provider. Segpay offers secure turnkey solutions to accept online payments, with a guarantee that funds are kept safe and protected with its proprietary Fraud Mitigation System and customer service and support. For any questions or help, contact sales@segpay.com or compliance@segpay.com.

Related:  

Copyright © 2025 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More Articles

profile

WIA Profile: Reba Rocket

As chief operating officer and chief marketing officer of Takedown Piracy, long at the forefront of intellectual property protection in adult entertainment, Rocket is dedicated to safeguarding the livelihoods of content creators and producers while fostering a more ethical and sustainable industry.

Women In Adult ·
opinion

Protecting Content Ownership Rights When Using AI

In today’s digital age, content producers have more tools at their disposal than ever before. Among these tools, artificial intelligence (AI) content generation has emerged as a game changer, enabling creators to produce high-quality content quickly and efficiently.

Corey D. Silverstein ·
opinion

How Payment Orchestration Can Help Your Business

An emerging payment solution is making waves in the merchant world: the payment orchestration platform (POP). It’s quickly gaining traction as a powerful tool for managing online payments — but questions abound.

Cathy Beardsley ·
opinion

Fine-Tuning Refund and Cancellation Policies

For adult websites, managing refunds and cancellations isn’t just about customer service. It’s a crucial factor in maintaining compliance with the regulations of payment processors and payment networks such as Visa and Mastercard.

Jonathan Corona ·
profile

WIA Profile: Laurel Bencomo

Born in Cambridge, England but raised in Spain, Laurel Bencomo initially chose to study business at the University of Barcelona simply because it felt familiar — both of her parents are entrepreneurs. She went on to earn a master’s degree in sales and marketing management at the EADA Business School, while working in events for a group of restaurants in Barcelona.

Women In Adult ·
profile

Gregory Dorcel on Building Upon His Brand's Signature Legacy

“Whether reflected in the storyline or the cast or even the locations, the entertainment we deliver is based on fantasy,” he elaborates. “Our business is not, and never has been, reality. People who are buying our content aren’t expecting reality, or direct contact with stars like you can have with OnlyFans,” he says.

Jeff Dana ·
opinion

How to Turn Card Brand Compliance Into Effective Marketing

In the adult sector, compliance is often treated as a gauntlet of mandatory checkboxes. While it’s true that those boxes need to be ticked and regulations must be followed, sites that view compliance strictly as a chore risk missing out on a bigger opportunity.

Jonathan Corona ·
opinion

A Look at the Latest AI Tools for Online Safety

One of the defining challenges for adult businesses is helping to combat the proliferation of illegal or nonconsensual content, as well as preventing minors from accessing inappropriate or harmful material — all the more so because companies or sites unable or unwilling to do so may expose themselves to significant penalties and put their users at risk.

Gavin Worrall ·
opinion

Know When to Drop Domains You Don't Need

Do you own too many domains? If so, you’re not alone. Like other things we accumulate, every registered domain means something to us. Sometimes a domain represents a dream project we have always wanted to do but have never quite gotten around to.

Juicy Jay ·
opinion

Understanding 'Indemnification' in Business Contracts

Clients frequently tell me that they didn’t understand — or sometimes, even read — certain portions of a contract because those sections appeared to be just “standard legalese.” They are referring, of course, to the specialized language used in legal documents, including contracts.

Corey D. Silverstein ·
Show More