CARET Pay Payment Link Payor Verification & Card Testing Protection

Overview

Public payment links (Firm PayNow) provide clients with a quick, convenient way to submit retainer deposits and payments online without requiring a client portal login or an outstanding invoice. However, because public links are openly accessible on firm websites or email signatures, firms can sometimes become targets of automated card testing—fraudulent schemes where bad actors attempt to validate stolen credit card numbers against public payment forms.

To protect your merchant account reputation, prevent fraudulent processing fees, and ensure only authorized payors can submit funds, CARET Legal introduces Payment Link Payor Verification.

This feature introduces a firm-configurable security gate on public payment links, requiring payors to authenticate before unlocking the payment form. Firms can choose between a firm-generated Access Key, an Email Address verification against contacts on file, or both.

In addition, the public payment experience has been streamlined into two distinct, structured phases (Payment Details → Payment Method), providing enhanced security and form clarity for all users.

Key Benefits

• Stops Card Testing & Automated Bots: Restricts form access so automated scripts and unauthorized visitors cannot run test transactions against your merchant account.
• Protects Merchant Processing Standing: Shields your firm from excessive authorization attempts, card-testing spikes, and potential processor holds or chargeback fees.
• Automated Rate-Limiting Protection: Built-in endpoint rate limiting restricts rapid, repeated verification attempts, preventing automated brute-force attacks against access keys or email lookups.
• Guarantees Intended Payors: Verifies that submitters are either existing firm contacts or in possession of an authorized firm access key.
• Flexible Security Modes: Tailor the security level to your firm's preference: a shared firm Access Key, an instant client email check, or dual verification.
• Completely Optional & Non-Disruptive: Payor verification is an opt-in setting. If disabled, your payment links remain accessible as standard two-phase forms with zero changes to your existing URLs.

How It Works

The Two-Phase Payment Experience

When payors navigate to your Firm PayNow link, the checkout workflow operates in two sequential stages:

1. Phase 1: Verification & Payment Details:
   • If verification is enabled, the payor must enter the required credentials (Access Key, Email, or both).
   • Once validated, the payor inputs the payment amount, reference matter/description, and contact details.
2. Phase 2: Payment Method (Secure Checkout):
   • After completing Phase 1, the secure card or ACH entry fields are unlocked. The payor enters payment details and submits the transaction securely via CARET Pay.

Verification Methods Explained

Firm Administrators can configure one of three verification methods:

Access Key Security Specifications

• Key Length: Fixed at 8 characters for simplicity and security.
• Unambiguous Character Set: Keys use uppercase letters and numbers designed to avoid character confusion (e.g., characters like 0/O and 1/I are excluded).
• Case-Insensitive Input: Even though generated keys display in uppercase, payor entry is case-insensitive (e.g., typing 3a7bc9xy matches 3A7BC9XY).
• Brute-Force Rate Limiting: Verification endpoints enforce strict rate limits to block automated scripts attempting multiple guesses.

Configuring Payor Verification (Firm Administrators)

1. In CARET Legal, navigate to Firm Settings (gear icon) > Integrations > CARET Pay.
2. Select the Payment Links tab.
3. Locate the Payment Link Security / Payor Verification section.
4. Toggle Payor Verification to On.
5. Select your desired Verification Method:
   • Access Key: Click Generate Key to create an 8-character key. Copy this key to share with your clients. You can click Generate New Key at any time to rotate it.
   • Client Email Address: Enforces that payors must enter an email address corresponding to an existing contact in CARET Legal.
   • Both: Requires payors to enter both a matching contact email address and your firm’s active Access Key.
6. Click Save Changes.

(Note: If you ever wish to disable verification, toggle the setting to Off and click Save. Your payment links will immediately return to standard direct access.)

Payor Experience

1. Accessing the Link: When a payor opens your Firm PayNow URL, the page prompts them to authenticate before displaying billing fields.
2. Submitting Credentials:
   • If Access Key is active, they enter the 8-character key provided by your firm.
   • If Email Address is active, they enter their email address.
3. Validation & Next Steps:
   • Success: Upon instant validation, the form unlocks Phase 1 (Amount, Matter Reference, and Payor Information), followed by Phase 2 (Card/ACH details).
   • Invalid Credentials: If an unrecognized email or incorrect key is entered, an on-screen message alerts the payor to verify their details or reach out to the firm. Payment entry fields remain locked.
   • Attempt Limits: Repeated unauthorized attempts trigger temporary rate-limiting blocks to prevent automated attacks.

Frequently Asked Questions (FAQs)

• Does Email Verification send a one-time passcode (OTP) or email link to the client?
  • No. Email verification performs an instant real-time lookup against your firm's CARET Legal Contacts database. As long as the email matches a contact on file, the payor gains immediate access without waiting for an email or entering a code.
• Can we change or rotate our Access Key?
  • Yes. Firm Administrators can generate a new Access Key at any time under Firm Settings > Integrations > CARET Pay > Payment Links. Generating a new key immediately deactivates the previous key. Make sure to communicate the updated key to clients submitting payments.
• What if a new or prospective client needs to pay a retainer and isn't in CARET Legal yet?
  • If Email Verification is enabled, an email lookup will fail if the individual is not yet recorded in CARET Legal. In these scenarios, we recommend:
    • Adding the prospective client as a Contact/Lead in CARET Legal prior to sending the link, or
    • Using Access Key Only mode so prospective clients can pay using the shared key provided in their onboarding or intake paperwork.
• Do our existing Firm PayNow links change when verification is enabled?
  • No. Your payment link URLs remain completely unchanged. You do not need to update your website buttons, email templates, or intake forms.
• Do clients need to create an account or sign in to a portal?
  • No. Payor verification requires no portal account, username, or password. The payor simply enters the required verification credentials directly on the payment page.
• Does this setting affect invoice-specific payment links?
  • No. This verification layer is designed specifically for public Firm PayNow links. Direct invoice payment links generated for individual billing entries are already tied directly to a specific client, matter, and invoice record.