A Membership payment was made successfully using our Contribute form with a new contact created such as:

name: fffff fffff

address: asdadad 4 davie, FL 33328 United States


[email protected]

Contribution says paid by Credit Card, and there is also a transaction/invoice ID.

Why is CiviCRM Paypal WPP processor allowing this contribution which obviously appears to be fraudulent? Is this due to our set up

Thank you.

Drupal 7 / CiviCRM 4.6.x

2 Answers 2


PayPal also offers some fraud filters. There's a decent starting set that come with PayPal Pro (they also offer more advanced ones for a monthly fee), their customer service is pretty good if you call and ask for some help with them and explain about the transactions you suspect are fraudulent.


I am not certain what can be done to stop people 'testing' if stolen credit card details if that is what is happening. There is a blog about it and an old forum topic you might glean something from

And this SE question is where the conversation moved to.

  • Thanks. What's alarming is it happened within the same week for two installs on separate sites, its almost like Civi is being targeted for this testing. Does a CAPTCHA on the registration form prevent this - do you think they are mostly drive-by's done by automated scripts?
    – Zachary
    Commented Mar 19, 2016 at 1:17
  • reCaptcha on sites helps to prevent spambots. Are the sites receiving the money? Wild guesses: perhaps there is some attempt to defraud PayPal going on if you are not getting the money or if a refund is immediately requested, or perhaps there is an intent to verify the card number.
    – Joe Murray
    Commented Mar 20, 2016 at 19:04
  • According to Paypal (we called) the fraudulent payments aren't covered by seller protection because we didn't require a shipping address. So we have to either keep the funds until something happens, or issue a refund (at our slight expense).
    – Zachary
    Commented Mar 24, 2016 at 1:09
  • updated answer with link to other post about flood control
    – petednz - fuzion
    Commented Mar 24, 2016 at 2:22
  • Does CiviCRM support anything like this for Paypal Website Payment Pro? paypal.com/us/cgi-bin/webscr?cmd=xpt/Marketing_CommandDriven/… Yes, it is being used on a couple of my sites to test stolen credit cards. The other posts aren't too helpful because I don't believe it is a drive-by bot operation, but I have enabled captcha just in case.
    – Zachary
    Commented Apr 9, 2016 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.