Honeypot on donation forms?

JD Piland
JD Piland
Ninth Anniversary Participant Facilitator 1 Loyalty Badge
in Blackbaud Luminate Online® & Blackbaud TeamRaiser® Discussions
Hi all,


We've been getting hammered by bots lately. Usually it's been one record trying various CCs 100s of times. This time, it was presumably one bot trying multiple CCs with different names and emails each time. So now we have thousands of bad records.


I asked about this before and a honeypot was recommended. I'm looking to see if anyone has ideas on how to accomplish that. A vendor of ours says there isn't really a solution within LO, but it is surely possible, isn't it?


Thanks in advance!
Tagged:

Comments

  • Brian Mucha
    Brian Mucha
    Tenth Anniversary Kudos 2 Participant Facilitator 1
    Funny that survey's have this built in, but donation forms do not.


    I think you could do it with an API form, but not with the standard form-builder form. I think the Luminate CAPTCHA field is your only choice there.


    The thing is the bot is not going to be running the css and javascripts on your form, so anything you could add would be ignored. An API form simply won't work at all without JS.


    BPM
  • Bri MacBain
    Bri MacBain
    Sixth Anniversary Kudos 1 Participant Facilitator 1
    Hi JD,


    Here's a couple api forms that I set up for clients to do what you're asking-

    https://spca.bc.ca/donations/make-a-donation/

    https://foodbank.bc.ca/donations/donate/


    Includes a security layer/honeypot/banning system to stop fraudulent cc transactions- give me a message if you want more info on what's effective, it's definitely doable with the api as Brian says!
  • JD Piland
    JD Piland
    Ninth Anniversary Participant Facilitator 1 Loyalty Badge
    We were at least able to add Captcha to the offending form--and that seems to have helped--but it's not my favorite thing to look at. And I would prefer to not add that to all forms (nearly all of our donation forms are in the out-of-the-box form builder).


    So it seems forms via the API really is the only option, then.
  • Brian Mucha
    Brian Mucha
    Tenth Anniversary Kudos 2 Participant Facilitator 1
    The biggest downside is payment types. The API only supports Cards and PayPal. And ACH is just rolling out. As far as I know ApplePay, Venmo, etc are not even on the roadmap.


    I complain about this to anyone that will listen.


    BPM

Categories