Honeypots on Donation API forms

Sara Hoffman

Hi -



We're experiencing fraudelent charges and attempts on one particular API donation form. blahblahblah... yes support ticket, yes account manager, blah. It's still going on and we'd like to try a honey pot over CAPTCHA.



Should this be something we only add on the front-end of the API form? Or should we add a dummy field to the backend (ghost) donation2 form in addition?



Whatcha think, folks?

Sally Heaven

Account manager, blah. I hear you!



My two cents, and as you know, I'm not a programmer: I'd start by adding the hidden field to only the front-end API form and including some code to not submit/post the data if the hidden field is filled out, and instead to abandon or reject the attempt, since it's almost surely a fraudulent donation. I'm not sure why you'd want to include it on the ghost form, because the idea is to prevent bad donations from getting through in the first place.



Maybe Noah Cooper has some additional thoughts to share.



Sincerely, your account manager

Ebenezer Dadzie

We had the same issue and these are the steps we followed to resolve it. Use report writer and pull a donation by IP address. Isolate the IP address that is being use to attack. Call BB support to block that IP and also if you are using Drupal as your CMS you can edit the list of blocked IPs at https://yourdomain/admin/config/people/ip-blocking.



Hope this is helpful



Ebenezer

Sara Hoffman

That's exactly what a honeypot is, Sally

Sally Heaven

Sara Hoffman:

That's exactly what a honeypot is, Sally

Right! So no need to add it to the hidden ghost form. Right? Did you try this, and did it work?

Sara Hoffman

Hi Sally -

We applied the honeypot to both the API form and the native form because we had tracked traffic to both.

We actually didn't see much of a drop off in the fraud but were able to tell that it wasn't an automated bot. We went forward with more backend solutions.