As a community heads-up, a customer of ours has become a target for a scammer who is using batches of credit card numbers (about 2000/day) on low-cost products. We suspect the scammer is trying these batches of card numbers to see whether they work, so they can create small charges on them for themselves elsewhere. We've tried a few strategies—IP blocking, page rate limiting, Braintree parameter tuning, etc—but we've found we're dealing with a human with a full-time day job of doing this. Our greatest success (~99.7% rejected) came from tuning Braintree's risk threshold score; however, they're still trying a LOT of cards and they're able to get a few through. We would like to stop helping them at all. I thought the community might want to know. Also, I'd love to hear whether anyone has successfully repelled this kind of attack.

Yeah, this is a pretty standard attack, but we've seen it on a bunch of stores this month. In some cases the payment gateway actually started detecting it and blocking it without intervention. (Thanks Adyen!)

Are you by any chance reporting specific payment errors? In the past I've seen scammers like this targeting stores that report specific errors like “Your CVV is incorrect” instead of a generic payment failure message

My 2 cents... Get rid of Braintree, they suck and they're one of the most expensive processors. They had my account without 3D Secure 2 working for weeks (almost required now in EU), they blocked my Paypal account for days for no reason claiming I'm "deceiving" users (never explained what that meant). I'm so glad I finally left, my fees are almost half now and everything works great.

@Brian we had the same issue. The way we ultimately resolved it was by implementing recaptcha on our site. we had to implement it on a number of different places on our site to finally get it to work. e.g. account creation, payment page.

Hey, how'd the IP blocking go? Think it would help if we blocked all VPNs and Tor nodes?

yea this stuff is obnoxious. We’ve had success using recaptcha and cloudflare

There's also https://github.com/rack/rack-attack - any chance that could help?