Limit checkout attempts or AVS mismatch

[jrockfl]

I have examined the transaction details and see where some users have made 5 or more attempts to checkout and the card(s) were declined because of AVS mismatch or something else.

I wanted to find out if anyone has added code to limit the number of checkout attempts and something similiar.

[TJPride · Accepted solution]

The Advanced Fraud Detection Suite gives you the ability to automatically block IP's that have more than a certain number of transactions per hour. Short of that, it isn't very hard to create a database table with two fields - one for IP and one for count - and just add records / increment the count as transactions process. You have an automated routine wipe the table every hour, and you check the count for the user's IP before you allow a new transaction to process.

EDIT: What programming language are you using? PHP?

[jrockfl]

Thank you for your reply. I'm using asp.net (vb.net)

Sure, I could create something to do that. I wasn't sure if that was a common practice or not.

[TJPride]

If you set a reasonably high minimum charge ($5+), you probably won't have any trouble with stolen credit cards being tested on your site. Same for if the signup form uses a lot of complicated Javascript, as in the case of my most recent client. Outside of that, I'd guess that people won't bother implementing their own transaction volume protection until the first time they have problems with too much transaction volume.