Require email confirmation before payment?

#1

We’re experiencing some card testing fraud and believe one solution would be to require email confirmation before allowing someone to check out/pay. Does s2Member support this, or is there a workflow that does? We are using Paypal Payments Pro forms.

#2

You can use construction like this:

[s2If is_user_logged_in()][_s2If current_user_cannot(access_s2member_ccap_freeeyes_manual)][s2Member-PayPal-…][/_s2If][_s2If current_user_can(access_s2member_ccap_freeeyes_manual)]<a class=“fe-login-button” href="/freeeyes-access/">Read docs</a>[/_s2If][/s2If][s2If !is_user_logged_in()][s2Member-PayPal-…][/s2If]

This is for access by ccap, but you can adapt it.

#3

I don’t know what ccap is, or freeeyes.

Is there some documentation or more info on this?

#4
#5

an alternative way of doing this is to:

  1. have the join form require a email address
  2. the join form sends an email to the provided email address with a link to the join page containing an encrypted version of the email.
  3. the real join form only appears if the variable in the join link is valid.

This is fairly easy to do and has the added benefit of being very very very difficult to create a fake join link, and as the variable link is an encrypted version of the email there is no need to make a record of emails sent.

#6

This doesn’t add the specific “confirm the email before payment” workflow discussed here, but today’s v261011 release adds several new protections that are relevant to the card-testing/bot problem:

Built-in Protection: Added Honeypot and configurable Speedtrap checks that can reject common automated submissions without requiring an external service. Speedtrap uses a server-signed form timestamp and has an adjustable minimum form age.

Signup Screening: Added Akismet screening for pro-forms that create new WordPress users. This check only applies to account-creation pro-forms; it does not apply to payment-only, account-maintenance, modification, update, or cancellation pro-forms that are not creating a new account.

Enhancement: Added an optional setting to check whether a user’s email domain is configured to receive mail, helping catch mistyped or unusable addresses during wp-login.php registration, account creation through pro-forms, or email changes in the s2Member Profile form.

There are also new reCAPTCHA v3 and Cloudflare Turnstile options in the same release.

:slight_smile: