Heads-up: Stripe fraudulent card activity on the donation page (nothing to do with me or this site)

[exxos]

I want to flag something openly so nobody here is caught out or gets the wrong idea.

For a while now, the Stripe donation page linked from this site has been getting hammered with what look like stolen credit card details — hundreds of attempts a day. These aren't random guessed numbers: each attempt comes with a real name, address and email belonging to the cardholder. That tells me the data has come from a breach somewhere and is being run through payment pages to find out which cards still work. The practice is known as "card testing", and small donation and checkout pages are a common target for it.

A few things I want to be completely clear about:

• This is not me, and it is not anything running on my server. The donation page is hosted entirely on Stripe's own network — all I have here is a link to it. The card data and the processing all sit on Stripe, not on exxosforum.
• Nobody is actually being charged. Every single attempt is being declined — the security checks Stripe runs are failing every time. So while the volume is alarming, no money is going through.
• The card details appear to be US-based, so this looks like leaked US cardholder data. I've no idea where it originally came from, or how recent it is.

I've reported it to Stripe directly, since it's their page on their network. (Their chatbot wouldn't give me an email address and just pushed me toward a live chat, so I've emailed their support instead. No reply yet as I write this.) Beyond that there is genuinely nothing more I can do personally — I can't see or touch their systems.

I'm posting this mainly so that if anyone here, or anyone looking into these failed donation attempts, notices the activity, they understand it's fraudulent card testing against a Stripe page — not me trying to charge anyone. It is completely outside my control, and I'll update this thread if anything changes or Stripe gets back to me.

[exxos]

Donation links temporarily disabled (ongoing card-testing fraud)

A quick follow-up to my earlier post about the fraudulent card activity hitting the donation page.

I've now temporarily disabled the donation links. The page was being hammered with stolen card details hundreds of times a day, and while every attempt was failing, that sheer volume can put my Stripe account itself at risk of being flagged or suspended — even though none of it is my doing and not a penny has changed hands. I'd sooner pull the links than risk the account, so for the moment there is no way to donate. I'll put them back once I've had a chance to lock things down properly.

A few honest words about how this has gone, because it has left a sour taste:

• The page is hosted entirely on Stripe's own network — I don't run it, I only ever had a link to it. Yet the job of stopping the abuse, and the consequences if it isn't stopped, fall entirely on me. That feels a lot like the way eBay washes its hands of problems and leaves the user to deal with it, with no real support.
• Speaking of which — their support has been next to useless. I couldn't even get an email address out of their chatbot; it just kept pushing me toward a live chat. I've emailed support and, at the time of writing, heard nothing back.
• The basic fraud protection that has been blocking these attempts is included, to be fair. But the proper tools to fully tighten things down sit behind a paid tier, and that paid tier charges per transaction it screens — fraudulent attempts included. So the message is essentially: we will wash our hands of it, but you are welcome to pay us for the better defence.

I do accept my part in this: the donation link is mine, and a public payment link is always going to be a target. But a public link can be scraped or guessed by anyone, anywhere, no matter how careful I am — so I'm not entirely convinced that "it's all on the merchant" is a fair position either.

For now: donations are paused, nothing on my server was ever involved, nobody has been charged, and I'm working on a more locked-down setup. I'll update this thread when the links are back. I'll be honest — this whole episode has me reconsidering whether Stripe is the right home for this going forward.

Thanks for bearing with me.

[exxos]

Donations are back — now for logged-in members only

A quick update now that donations are working again.

Donations have moved off the old public page and onto the forum, and you'll need to be logged in as a member to make one. Here's why.

The old public donation page was being hit by automated credit-card fraud — bots running stolen card numbers through it in bulk to find which ones still work. It's a problem that targets payment pages all over the web and has nothing to do with exxos; the forum and its systems were never compromised. The only reliable way to shut that abuse down is to take the donation links off the open page and put them behind the member login, where the bots can't reach them.

That does mean guest donations are no longer possible — you have to be a logged-in member now. It's a small ask, and it's what keeps the whole thing safe for everyone.

How it works now:

• Log in, then open the Donate page from the forum menu.
• Choose a one-off donation or a monthly subscription.
• You'll be passed to Stripe's secure page in a new tab to finish — your card details are only ever seen by Stripe, never by the forum.

As always, donating earns you the SPONSOR badge beside your name. Thank you to everyone who chips in to keep the server, forum, exxos pages and Atari Wiki online and free.

~exxos~

[kohli79]

Unfortunately, I can’t select an amount. It’s set at a fixed amount of 6 euros or 5 GBP.

[exxos]

Unfortunately, I can’t select an amount. It’s set at a fixed amount of 6 euros or 5 GBP.

You just click the change amount button.. works for me..

Capture.PNG

Or QTY for subscriptions which is in multiples of £5 now.

Capture.PNG

[kohli79]

I don’t have that button. No idea why…
I can only set the monthly frequency – how many times a month the transfer should be made – but I can’t change the amount.

exxos store — Mozilla Firefox 21.06.2026 22_02_36.png

[exxos]

I don’t have that button. No idea why…
I can only set the monthly frequency – how many times a month the transfer should be made – but I can’t change the amount.

For subscriptions, you click the QTY at the bottom of your screenshot. You can't set a amount, only QTY.

Previously it was set at multiples of £1, but by the time Stripe takes their transaction change, there's not much left anyway. One person has £3 which is better, but then multiples of £3 seems odd also. There's always a fixed donation which I believe can be set to £1 multiples.

[kohli79]

I don’t have that button. No idea why…
I can only set the monthly frequency – how many times a month the transfer should be made – but I can’t change the amount.

For subscriptions, you click the QTY at the bottom of your screenshot. You can't set a amount, only QTY.

Previously it was set at multiples of £1, but by the time Stripe takes their transaction change, there's not much left anyway. One person has £3 which is better, but then multiples of £3 seems odd also. There's always a fixed donation which I believe can be set to £1 multiples.

OK, that’s how I’ll do it. :dualthumbup:

[exxos]

OK, that’s how I’ll do it. :dualthumbup:

:thanksyellow:


But do you realise you already had a active subscription ? Do you want me to cancel the old one ?

[kohli79]

OK, that’s how I’ll do it. :dualthumbup:

:thanksyellow:


But do you realise you already had a active subscription ? Do you want me to cancel the old one ?

Yes, I know, but the amount wasn’t deducted today.
That should have happened today – it’s always on the 21st of every month. I thought I’d have to set it up again because of the problems. Yes, then cancel the old subscription. Thank you.