ÃÛ¶¹ÊÓƵ

PayPal Payflow Pro active carding activity

UPDATED 2 April 2019

The PayPal Payflow Pro integration in ÃÛ¶¹ÊÓƵ Commerce is being actively targeted by carding activity, where attackers attempt hundreds of $0 transactions with stolen credit cards to check the card’s validity.

The activity currently targets versions of this Payflow Pro integration that were included in ÃÛ¶¹ÊÓƵ Commerce 2.1.x, 2.2.x, 2.3.x for Magento Open Source and Commerce (on-premises and cloud). The carding activity is inherent to the way Payflow Pro is integrated into shopping carts.

The issue affects the following ÃÛ¶¹ÊÓƵ Commerce versions:

Issue

Symptoms of these attacks include:

Solution

To help protect from these attacks, we advise adding Google reCAPTCHA (recommended) or CAPTCHA to the Payflow Pro checkout form. This includes installing the Composer packages and configuring Google reCAPTCHA or CAPTCHA in the Commerce Admin.

Install Packages

ÃÛ¶¹ÊÓƵ created two package options to add Google reCAPTCHA and/or CAPTCHA to the Payflow Pro checkout form. Installing one of these packages will update current installations and add an option that can help enhance this security to the Payflow Pro checkout form.

These packages are compatible with the following ÃÛ¶¹ÊÓƵ Commerce deployments and versions:

ÃÛ¶¹ÊÓƵ Commerce (all deployment methods) and Magento Open Source 2.1.x, 2.2.x, 2.3.x

Installation requires CLI commands to your ÃÛ¶¹ÊÓƵ Commerce instance. Developer assistance may be required.

Install Google reCAPTCHA and checkout form updates

The magento/module-paypal-recaptcha package contains integration with Google reCAPTCHA and Payflow Pro payment form updates. Even if you have the reCAPTCHA module installed and configured, we recommend you install this package.

Run the following commands to install it.

For ÃÛ¶¹ÊÓƵ Commerce on-premises:

composer require magento/module-paypal-recaptcha
bin/magento module:enable Magento_PaypalReCaptcha
bin/magento setup:upgrade
bin/magento cache:clean

For ÃÛ¶¹ÊÓƵ Commerce on cloud infrastructure:

Install checkout form updates for CAPTCHA

The magento/module-paypal-captcha package contains integration with the native ÃÛ¶¹ÊÓƵ Commerce CAPTCHA module.

Run the following commands to install it:

For ÃÛ¶¹ÊÓƵ Commerce on-premises:

composer require magento/module-paypal-captcha
bin/magento module:enable Magento_PaypalCaptcha
bin/magento setup:upgrade
bin/magento cache:clean

For ÃÛ¶¹ÊÓƵ Commerce on cloud infrastructure:

Configure Google reCAPTCHA or CAPTCHA

Having installed the package, configure Google reCAPTCHA (recommended) or CAPTCHA as described in the following docs:

The new checkout form option is:

PayPal support and contacts

Please contact PayPal Payflow Merchant Support to learn more about Fraud Protection Services. You can request the PayPal Support team to enable filters to provide the tightest control possible over payments so that you can automatically deny payments that are likely to result in fraudulent transactions and accept payments that are not typically a problem. Please note that once you turn on PayPal Fraud Protection Services filters, transactions can take up to 2 hours to settle.

PayPal Payflow Merchant Support Details

Payflow Merchant Support’s business hours are Monday through Friday from 7:00 AM - 8:00 PM CST. You can contact Payflow Merchant Support for account assistance by phone or email:

Australian Support