Fighting 15s: login using extra security at checkout

Fighting 15s has been under attack by spam bots for a couple of months. In that time we have improved our antispam security so that spam servers are identified and blocked as soon as possible, but none the less it is impossible to stop spam orders from a new, yet to be identified spam server.

The result is that I’ve been waking up each morning to a deluge of draft orders placed by spam bots. This takes time to deal with as I manually enter the IP address of the server into the blocking system. I’ve hugely reduced the number of spam orders by blocking all countries to which Fighting 15s does not send orders, but the US and EU in particular still generate spam orders. I can’t block those countries because the US is one of my biggest markets, and I’ll be reopening to the EU soon.

Making the customer login option compulsory at least stopped some orders coming through as genuine orders awaiting payment by turning them into draft orders. This doesn’t impact the sequential order numbering system, which is important for VAT: the IP address may be blocked and order deleted without consequences.

However, the bots found a way round this, and some orders came through none the less, stopped by the advanced payment security checking system. They show in the system as failed, awaiting payment. These get the IP address blocked, the customer login deleted and the order itself binned. They’re all for one of the cheapest items in the shop, and postal addresses are an unholy mix of US and UK streets, cities and postcodes. They’re quite obviously fake.

IMPORTANT LOGIN INFO

To stop these fake orders, our shop now has an anti-bot check for login. It’s a bit fickle. If you use a saved customer ID and password, say in a browser, clicking the Login button may identify you as a bot and fail the login attempt. In these instances, try not clicking Login and wait for the system to automatically use your login details. This may be entirely browser and system dependent. I get issues with Safari on my Mac, but not Chrome. What was a “you are not human message” now advises of this technique.

It’s a pain for a small, one-man business to deal with all this crap. But since the anti-bot check has been enacted I’ve not had a single spam order get past the draft stage, vastly improving my life.