What are the challenges for the Baltic's largest game code online store?

How to avoid such situations?

Ask the customers for the necessary data

One of the ways is to oblige the customer to provide the necessary information about himself so that the correct buyer can be verified and to ensure the user's payment account has not been stolen.

This works effectively with the PayPal payment solution. First, to make a payment, the user must create an account for themselves, ensuring that we know their correct e-mail address (the user must confirm the account via e-mail and log in to make the purchase).

In addition, before we allow the customer to pay, they must also verify their phone number. If we have the user's e-mail and phone number, after making the payment, we can compare whether the contact details of his registered account match the contact details in PayPal. A big red flag is if they don't match, and then we have the opportunity to check the order manually.

Another security measure is that we always send purchased products to the e-mail used to register the PayPal account. This ensures that the products reach the genuine buyer's e-mail, even if the purchase was made with a stolen payment account.

Other scenarios when the order needs to be manually reviewed:

These are some examples of what kind of transactions the system detects. We can cancel a relatively large number of fraudulent orders by manual order review.

Set payment limits

Each user registered and who has made a purchase is assigned a personal purchase level on the page - bronze, silver or gold. Each customer's level depends on how much they have purchased in the last year.

User bonus levels can also be used to mitigate risks from fraudsters. A customer who has made several previous purchases without problems is a sign that their future purchases will probably be successful and problem-free.

Remove security holes from the system

When developing a system, someone must constantly review the code written by another programmer (Code review).

For example, we once identified a person who had found a way to outwit the system and get the products without paying for them. Since this fraudster bought very rarely and for small enough amounts, we could not flag the fraud for a long time. This enabled the fraudster to collect free products worth several thousand euros for themselves over several years.

Such misediting was possible because one of the developers of the page forgot to remove a line from the code that prevented verification of the bank payment. This means that if a person knows the correct URL to which the user will go after a successful payment, it was easy for them to get free products.

All you had to do was go to the correct link. Consequently, it is essential always to use a second pair of eyes who will check the code and reduce the probability that such code will be uploaded to the website.

Try to think through the eyes of a fraudster

As we mentioned, users must verify their phone number when paying with PayPal. In itself, it seems simple: The user enters a phone number. A code is sent to them. They enter the code that was sent to them. They're done. This way, the user proves that it is their phone number.

At first glance, it is a fairly rock-solid solution that is difficult for anyone to turn against us. However, it was still possible to create a fraud scheme and cause financial loss. On the first day, we got an invoice for over €600, where one confirmation of a phone number cost only a few cents. The given solution started spamming and thus created an account on the punktid.com page.

Fortunately, the solution here was simple. We allowed a maximum of 10 phone number verifications per logged-in user and from each IP address. Since it was no longer possible to make unlimited confirmations, the problem disappeared.

What did we learn? It is always important - even in the case of an apparently very foolproof system - to think through all possible aspects and situations in which a malicious user might be able to abuse the system.