Basket page not showing user their card is declined

[danowens]

I have a donor trying to donate through a shopping cart page but after entering all data correctly (many times) the page shows the please wait message and never continues from there. Looking in the admin interface, I see the transactions are all declined, but the user never sees this and keeps trying. The user's last name is Payne and attempted donations yesterday and today as well as other times in August and September. Here's a sample order number - 1309031625152689252. The WID is 69629. I, and others, have successfully completed the transaction without problems.

I need to know why the page doesn't give the donor the correct feedback regarding the declined transaction and also why these otherwise valid cards are being declined. The donor tried 3 different cards on 4 different computers and many different browser/OS combos.

[CnP.Support]

Good day @danowens:

The patron's IP address was blocked a while back in a pattern of fraudulent card authorizations. The IP: 204.155.56.3 was in the blacklist and was removed.

The decline was due to fraud attempt and all signatures are removed.

Please let us know if we can be of any further assistance.

[danowens]

Thank you for looking into this. Why would it have failed for this user from multiple locations: home, work and a relative's house? Also, the bigger question now is why the page never gave any feedback or indication of a decline or any other issue? The page just stayed where it was when the submit button was hit. There should have been a message to the user and/or us that there was a problem.

[danowens]

I have another donor whose card is continually declined. Their most recent order number is 1309261132193692924.
Wondering if this is the same issue with the fraud on the IP address.

[CnP.Support]

Good day @DanOwens:

Is this referring to a payment by marci***@yahoo.com?

That email & IP was blocked back in 2/8/2012 for many attempts with multiple cards with an organization, all of which were declined.

I removed the information from the blacklist.

[danowens]

That was the correct person, thanks.

[danowens]

Hi Support,


I have another customer that is potentially blocked as well. Latest attempt is Order Number 1310171942023567170 - last name Payne

[CnP.Support]

Good day!

This client was blocked due to being on a network which had attacked another organization with over 50 transactions with bogus cards on 8/21/2013. The IP is listed here:

http://www.senderbase.org/lookup?search_string=75.137.148.19

I removed that IP and the emails.

Please test it and let us know if the patron still has a problem.

[danowens]

I am getting more reports for this issue. I am assuming it's the same issue because the symptoms are the same but it is impossible to know because there is no error message (or any kind of message whatsoever). I attempted a payment myself and experienced it first hand. Once I fill in the basket page info, click Process Payment, I see the popup message that it is processing, then the message goes away with nothing else happening. No error, nothing. It is just sitting there with the filled-in form and users are confused. I am confused. I login to the Portal and see that for my attempt it was declined, but no idea why.

My info:



Order Number
1311102127002571003


Status
Declined


Amount
25.00


Email
[email protected]




First Name
Dan


Last Name
Owens


Last 4 digit
1003


Transaction Date
11/10/2013 9:27:00 PM


Transaction Date TimeZone
11/10/2013 9:27:00 PM


Purchased:
Item Sold: RunSixtyFeet-Dan-Owens
Quantity: 1
Unit Price: $25.00

[CnP.Support]

Good day!

Please give us the link to your form so we can review it. Naturally if the card declines the form has to post back the decline. We need to review the case.

It will be quite helpful if you make each thread referring to the site since we can't keep track of links across multiple threads. The only thing we can do is to follow the case history by going to the top of the thread and I can't see the link to check.

Once we have the URL we can review the form.

[danowens]

I didn't include the specific link only because this has happened across multiple basket pages and the cause seemed to be due to the donor's IP being blocked for fraud reasons, but here is an example: https://co.clickandpledge.com/[email protected]&

[CnP.Support]

Good day!

Now I remember why we removed the "R" parameter from the manual and stopped letting people know of the feature.

A browser will block a post back from a secure site to an insecure site. This is a browser safety issue. If someone clicks cancel or sets the browser NOT to redirect from secure to insecure then the browser will simply stop the redirect.

When your transaction processes the browser will post back the response to: http://www.RunSixtyFeet.com/[email protected]&

The above is invalid since it has & sign in the redirect and in the base URL the & sign defines another variable which is not defined in the system.

We used to have a lot about this feature in the manual but nobody was reading it and they were creating major problem such as the one you are having so we simply removed it and stopped talking about it.

Please make the post redirect page secure so your R parameter points to: https://www.RunSixtyFeet.com

also please remove the "&" parameter from your response since that will cause issues in the URL.

I hope the above provides insight into the issue.

[danowens]

So you are saying there are 2 issues with the URL parameters - first is that the redirect (R) parameter is not secure and second that there is a superfluous & at the end of the string.


The extra & was added to account for another bug which was cutting off the last parameter value. We found that simply adding the & to the end of the string solved the problem. Although admittedly a hack, It has worked for over a year and a half.


The non-secure redirect has also not been an issue up until recently. Merely removing it from the manual isn't helpful to those trying to debug issues like this. An error message, a warning message or anything other than what is currently occurring would be useful. We only find out there is a problem when our donors complain. Who knows how many simply leave without bothering to mention their issue.

[CnP.Support]

Good day @DanOwnes,

Please note that we have no way of knowing the intention of users. We had a lot of explanation in the manual but I know that we took it out several years ago. You might have learned about it through a support request or a forum discussion.

Browsers give warning when you switch from a secure site to an insecure site. It is a feature of all browsers. When you post to an insecure site the browser will give the warning and if the user says cancel they will get a page not found and in case of default setting in the browser's settings it may just hang.

I strongly suggest that you change your page to a secure site and in the meantime remove it until your return site is secure. The "&" sign may not have any effect since it will be ignored but we don't recommend it.

[danowens]

Sorry to keep on with this but the point I am trying to make is that there is a very bad user experience happening with the basket page. You are correct, we need to point the redirect to a secure page - an oversight on our part and it will be corrected shortly. But the experience right now is that a user fills out the entire form and nothing happens. The browser hangs, so to speak, which is what you warned might happen if the page were to take the user to a non-secure page, but at least at that point their donation might be completed and even with a broken experience on our site they would at least get a receipt email to indicate something was successful.


All I am asking is for some simple messaging to indicate to at least the customer, if not also the developer, that something is not configured well. As it is now our users don't know if their computer is broken or the internet is offline or the world is ending.


For the developers, please put something in this manual page that indicates what the experience will be if the R parameter is misused so that we can recognize the symptoms. http://manual.clickandpledge.com/Simple-Basket.html