WHMCS being used to validate lists of stolen credit cards

[David Shirley]

We are seeing a new attack where WHMCS is being used to validate a list of stolen credit cards.

Works like this:

1. Bad Guy creates client account in WHMCS and orders a cheap item like a domain registration

2. Bad Guy updates credit card data in their WHMCS account profile and manually triggers the outstanding invoice payment

3. Bad Guy repeats the update/trigger process until they have processed their list.

Since bad guy has written a script to automate the card update process, they can process around a thousand card numbers in just a couple of minutes.

I'd suggest that WHMCS rate limit how often a user can change their card number. That limit should rise exponentially with repeated requests and slowly decline over time between requests. This should be transparent to the legitimate users.

In the meantime, is there a way to disable the card update functions?  You can't do this just by editing the skins since the Bad Guy's script just POSTS directly and doesn't depend on the skin to operate.

[SolaDrive]

We have had this same issue and had hundreds of thousands of credit card attempts. Unfortunately WHMCS still hasn't produced any protection for this and attackers can easily use WHMCS systems to skim credit cards for working ones. What did you do you do to implement a solution to prevent this?