October 29, 2026 — Card Testing Mitigation Hotfix

Note

This release strengthens TouchPoint’s protection against card testing, where automated scripts use a church’s online giving pages to check whether stolen card numbers work. Your church’s accepted payment types and giving page settings are now enforced when a payment is submitted, and every reCAPTCHA check is verified with Google. Donors giving normally should see no difference. It also adds a meeting date filter to the Data Warehouse API.

Giving — Accepted Payment Types and Giving Page Settings

  • Change Gifts, registration payments, saved payment methods and recurring gifts are now refused when they use a payment type your church does not accept for that kind of payment - for example, a card at a church that accepts bank accounts only, or a card on an involvement with No Credit Cards checked - with the message “This payment type is not accepted. Please choose a different payment method.” Previously this was enforced only by the payment options the page displayed

  • Change Apple Pay, Google Pay, PayPal and Venmo are no longer offered on a payment page that does not accept cards, since those wallets are paid by card

  • Change Giving page settings are now enforced when a gift is submitted, not only by what the page displays: a page with Require Login set to True refuses gifts from someone who is not signed in (“Please sign in to give on this page.”), a page accepts only the kinds of giving it offers (a pledge page cannot be used for a one-time gift), a disabled page accepts no gifts, and every gift must go to a fund the giving page offers

Giving — reCAPTCHA

  • Fix Every reCAPTCHA check on giving pages, registration payments, prayer requests and account deletion requests is now verified with Google; a check that passed once is no longer accepted again for later submissions in the same browser session. Donors see no change, since each submission already runs a new check

API — Data Warehouse

  • New GET /v1/DataWarehouse/Meetings accepts a meetingDate parameter that returns meetings dated on or after the given date, ordered by meeting date; the existing modifiedDate parameter on this endpoint filters on the date the meeting was created