Magento: PayPal $0 Dollar Transaction Issue

Various cybercrime groups and online fraudsters use Magento’s integration with PayPal to check the relevance of stolen payment cards. The scheme is that the attacker is trying to make hundreds of transactions worth $ 0.

Such attacks are made on Magento stores that support integration with PayPal Payflow Pro. Integration with PayPal Payflow Pro is an option available to online stores that use Magento to process transactions using a PayPal business account.

The Magento team released an official statement claiming that cybercriminals use integration with PayPal Payflow Pro to check the validity of payment cards. Affected versions of Magento 2.1.x and 2.2.x.

Magento version 2.3.x may also be vulnerable, but the researchers did not find evidence of a real attack on it.

Fraudsters initiate transactions in the amount of $0 (zero), and then look at whether any errors are returned. If such errors are returned, this indirectly confirms that the stolen card is currently relevant.