This is a mostly terrible read on how to prevent fraud. As someone who has worked with Target and Michael's with their breaches, as well as someone who was that guy carding your sites...<p>> Our first line of defense is our payment processing provider, Stripe. They help by blocking cases where there is an expired credit card, wrong security code, or some other egregious mistake.<p>How is validating a CVV (everyone but Amazon does it) combating fraud? It's not. When you buy a card from a shop, you're given the option to sort by cards with the CVV or not. This isn't 1999. Don't get me started about Stripe's anti-fraud, either, because it's shit.<p>> Since adding reCAPTCHAs to our checkout flow in May 2016, disputed charges have decreased by 85%.<p>Okay, great, that'll stop the bots. Most of the time, though, carders will check against a site for a one-off transaction manually so they can go ahead and use the card.<p>> Requiring donors to enter zip codes had no effect on the amount of fraud,<p>I would have guessed this would have had an effect. A valid billing address on cards these days is rarely required, though it's common to see a zip code validated.<p>> Our manual review starts by reviewing the email associated with the donation.<p>This is good. Hell, check for their social media accounts and see if they reside where the request IP is from.<p>> An address that looks like something a cat made up by stepping on a keyboard is a good clue that something may be off (hello, asdfgh@aol.com!).<p>This is bad. Anyone could enter pam.beasley@theoffice.com ... it's not like you're going to require someone to confirm their email address to take their money.<p>> Stripe displays the IP address for each donation, so we can see if a credit card from South Africa is being used in France. Stripe also tells us how long somebody spent on the site and if any previous charges were disputed as fraud.<p>This is okay, but do you really think that someone who _really_ wants to validate a credit card isn't going to use a SOCKS5 that's not on a blacklist? It's trivial and inexpensive, and you might as well with card prices approaching $10 for a good BIN.<p>> As a final line of defense, we use Mailgun to verify whether our transaction emails are being sent to a real account and if they are being opened.<p>This is good, but some carders have a hoard of emails waiting to be used.<p>... if anyone wants to talk shop or has problems with fraud, my email is in my profile.