WolfPaw Fraud Protection

[bonnie1525]

Anyone out there still using Wolfpaw Anti-fraud module? I have been using Wolfpaw since 2010 when I purchased the module directly from Miva. There are some changes that I needed to make on the Wolfpaw Configuration Page, specifically update the server URL due to changes being made by Maxmind. The configuration page is no longer available on my Payment Setting Tab. Instead, Wolfpaw module wants me to enter a license key, and when I do, it indicates that it is in use. When I contacted Miva support, they say that Wolfpaw is no longer supported and that I should reach out to Wolfpaw support. When I reach out to Wolfpaw support, they believe that Miva has taken down their Wolfpaw license server and there is not anything else they can do. Just wondering if any one else has encountered this issue. Thanks in advance for your assistance.

[ILoveHostasaurus]

The license server they're referring to was a third party's license server on the domain mvcool.com, which was a module store similar to our app store, dating back to the early 2000's twenty years ago. The owner of that site ultimately closed the business, and while he did turn it over to us at that time, the site code was written with dependencies on software that went end of life about fifteen years ago. We patched it together for a few years to try to keep it functional but that ultimately became impossible and it was turned off. This particular module was not updated to make use of our license server, which has been available for more than a decade.

That module should not be used in an active store at this point, not only due to the above issue, but it has other problems from its date of release, particularly its inability to work with a type of internet address called an IPv6 address. This incompatibility means stores that use the module are prevented from receiving certain optimizations from our side.

Many payment gateways support an equivalent type of screening, or even the use of Cloudflare (free) to challenge browsers from certain origins can be a replacement, if the module is simply being used to prevent certain geographic purchases.

[willough]

Is there any way to continue integrating Maxmind fraud scores and evaluations without the Wolfpaw module? Or is there a good alternative? Maxmind's Minfraud is very useful.

[piperty]

Running into the same thing today. The new license number is 40 characters and the current module only allows 25. Still waiting for a response from Wolfpaw to see if I can get it to work.

[piperty]

When I reached out to WolfPaw about if it was possible to get this to work again:
"The short answer is no. We help out where we can but the module is not compatible with Miva 10 or the MaxMind changes and once Miva shutdown it's Miva Central licensing server you cannot install or re-install the module.

In your case you can try to insert the new license key directly into that field in the miva database. You might need to alter the table structure to support a longer key but I don't know if the longer key might crash something else in the module."

and then, from MIVA

"It's worth exploring migrating to something else since the wolfpaw module hasn't been updated years and they don't have much support for it. The developer that wrote module hasn't worked for them for a long time, probably over a decade. Some of larger clients use Signifyd. There are others but I can't recall which ones are popular."

What else are people using? Signifyd?

[Rick Wilson]

What payment processor do you use? Most gateways these days include velocity screening tools (which is what the MaxMind module mostly assisted with). We also support Kount.

I think the first step though is to see what your gateway supports?

[Patd265]

We also support Kount.

Kount is ridiculously expensive. Out of reach for smaller retailers.
We are also driving without seatbelt here.
We use Square and Paypal and while they have some fraud scanning ability, most of the fraud prevention on my sites is just me and my gut feeling that something is off.

[Mark Hood]

Kount is ridiculously expensive. Out of reach for smaller retailers.
We are also driving without seatbelt here.
We use Square and Paypal and while they have some fraud scanning ability, most of the fraud prevention on my sites is just me and my gut feeling that something is off.

I've also been a long time wolfpaw user and since disabling it have seen a large climb in fraudulent orders in just the last two months of doing so. Wolfpaw had a nice ability to just block those orders from proxy's etc.

I'm only using paypal and the big step for me and that was worth every penny was to enable chargeback protection. The catch is on those orders that have your hair standing up is to make sure you manually upload the tracking number to paypal. (Hopefully Miva will fix it so that orders in paypal can automatically get those tracking numbers and I believe it's on their very soon roadmap. We have at least been able to recover 90% of the money from those fraudulent orders.

[Bruce - PhosphorMedia]

Mark,

Just curious. Any idea why you see a large number of fraudulent orders? I ask cause with over 50 web sites we work with, we get very few actual fraudulent orders? Granted, most are using fraud protection in both native miva settings and their authorizing agency. (And a few require both shipping and billing to be the same--that said, those obviously do not ship 'gifts' and a couple do have a white list of customers who can use different addresses (i.e., using a custom customer field) and they are B2B.

[Mark Hood]

I believe a fair amount comes from the nature of our items. High end camo clothing, snowshoes & $1k coats with fur on them seem to be like candy for fraudsters. We do allow multiple addresses as long as the billing address matches the card. We are using Miva settings coupled with paypal. Wolfpaw was great at blocking people using a proxy address. With every order we received an email letting us know great information similar to this below and I've removed most of it. Basically even orders that did go through added some easy access to helpful information for deciding whether or not somebody really could be ordering 3 of those coats with fur on them for a reason and have it be legit.

This order has been DECLINED because it has a 65.82% probability of fraud which is GREATER than your risk threshold of 30%
Fraud Analysis Details
Maxmind Response:
distance=11409
countryMatch=No
countryCode=CN
freeMail=Yes
anonymousProxy=No
binMatch=NA
binCountry=
err=
proxyScore=0.00
ip_region=GD
ip_city=Jieyang
ip_latitude=I removed this
ip_longitude=I removed this
binName=
ip_isp=China Telecom
ip_org=China Telecom

[alphabet]

Mark
I'm not sure if you get a lot of orders from China but have you thought about blocking by geo.ip (country=CN,SG) at the Cloudflare level?

My business model is not set up for international commerce so I block traffic by country code of the biggest hackers (CN,IN,RU,SG,ID,NG,BR)

[Mark Hood]

Mark
I'm not sure if you get a lot of orders from China but have you thought about blocking by geo.ip (country=CN,SG) at the Cloudflare level?

My business model is not set up for international commerce so I block traffic by country code of the biggest hackers (CN,IN,RU,SG,ID,NG,BR)

Not something I had thought about but that could very well help! Thank you for the idea.

[Mark Hood]

Just want to add to this since we currently have 6 open cases and several more that have closed mostly in our favor I believe because we have the extra seller protection turned on.

My quick fun story...
Customer calls says she received a package to her address but not addressed to her name. I let her know what was in the package and discover that she had just ordered that exact item from poshmar (leaving off the last letter on purpose) The order had two different addresses but in the same town with the billing matching the credit card used.

She's calling them to see what to do before releasing the funds. Clearly at this point someone is using that other website to place orders with stolen cards and then they magically get fresh clean money once we deliver the item.

Hopefully that automatic tracking to paypal is coming soon because it would save some trouble for us. Oh and I miss the wolfpaw module

[diana]

Thank you everyone for your posts. After 2 recent chargebacks, I've been racking my brain trying to figure out why the Wolfpaw Anti-fraud module had stopped working. Still have $$ in my MaxMind account so guessing that's lost also?

[Mark Hood]

Thank you everyone for your posts. After 2 recent chargebacks, I've been racking my brain trying to figure out why the Wolfpaw Anti-fraud module had stopped working. Still have $$ in my MaxMind account so guessing that's lost also?

You should be able to get a refund if your purchase was within the last two months according to their support.
Oh and if we're keeping score I currently have 25 open cases! Sure do miss the wolfpaw/maxmind module