Honeypot on donation forms?

JD Piland · March 2020

Hi all,

We've been getting hammered by bots lately. Usually it's been one record trying various CCs 100s of times. This time, it was presumably one bot trying multiple CCs with different names and emails each time. So now we have thousands of bad records.

I asked about this before and a honeypot was recommended. I'm looking to see if anyone has ideas on how to accomplish that. A vendor of ours says there isn't really a solution within LO, but it is surely possible, isn't it?

Thanks in advance!

Brian Mucha · March 2020

Funny that survey's have this built in, but donation forms do not.

I think you could do it with an API form, but not with the standard form-builder form. I think the Luminate CAPTCHA field is your only choice there.

The thing is the bot is not going to be running the css and javascripts on your form, so anything you could add would be ignored. An API form simply won't work at all without JS.

BPM

Bri MacBain 2 · March 2020

Hi JD,

Here's a couple api forms that I set up for clients to do what you're asking-

https://spca.bc.ca/donations/make-a-donation/

https://foodbank.bc.ca/donations/donate/

Includes a security layer/honeypot/banning system to stop fraudulent cc transactions- give me a message if you want more info on what's effective, it's definitely doable with the api as Brian says!

JD Piland · March 2020

We were at least able to add Captcha to the offending form--and that seems to have helped--but it's not my favorite thing to look at. And I would prefer to not add that to all forms (nearly all of our donation forms are in the out-of-the-box form builder).

So it seems forms via the API really is the only option, then.

Brian Mucha · March 2020

The biggest downside is payment types. The API only supports Cards and PayPal. And ACH is just rolling out. As far as I know ApplePay, Venmo, etc are not even on the roadmap.

I complain about this to anyone that will listen.

BPM

Honeypot on donation forms?

Comments

Categories