Hacker News Reader

I work at Stripe. Could you email me at edwin@stripe.com and we can look into what went wrong here? (If a fraudster hits your account with card testing, we'd refund just the fraudulent test payments and your account status wouldn't be affected.) Additionally, do you have rate limiting or CAPTCHA in place? Either of those would mitigate further card testing. https://stripe.com/docs/disputes/prevention/card-testing

View on HN

IME many forget or neglect or don't know to implement captcha or rate limiting on checkout. It's rarely spec'd and meets resistance with product/sales/exec teams as unspec'd scope and undesirable conversion friction.

Or use popular Wordpress plugins that don’t have captchas or rate limiting

What is the best way to implement rate limiting if our site allows payment without a login? By IP?

Reply on news.ycombinator.com