Card testing detection and prevention means catching a burst of small, automated authorization attempts before they convert into chargebacks. Fraudsters run stolen card numbers through a checkout form in volume, keeping order values low so real cardholders rarely notice the charge. The goal is to make that pattern visible fast, then make it unprofitable to repeat.

related article

What card testing looks like on a payment page

An attacker needs two things from your site: a way to submit card data, and a signal telling them whether the number works. A decline, an approval, or even a slightly different error message is enough feedback to sort the good numbers from the dead ones. Working numbers get sold or used later for larger purchases.

related article

Because the test itself is cheap, attackers favor merchants with weak velocity controls, no bot filtering, and inconsistent decline messaging. Small digital goods, donation forms, subscription trials, and guest checkout flows are common targets because they complete without physical shipping.

Card Testing Prevention Best Practices: A Merchant Guide

Signals that point to card testing

• A sudden rise in authorization attempts with a low average order value.
• Many attempts from one IP address, one device fingerprint, or a narrow IP range.
• Repeated use of the same card BIN prefix across different card numbers.
• Sharp spikes in declines, especially invalid card number or mismatched CVV responses.
• Email addresses that look generated, disposable, or sequential.
• Traffic arriving outside your normal buying hours or from unexpected regions.
• Checkout sessions that complete in seconds with no browsing activity beforehand.

Detection methods that work

Velocity and threshold rules

Count attempts per IP, per device, per email, and per card BIN over rolling windows. A rule that blocks more than a handful of payment attempts from one source in a short period stops most scripted attacks without touching normal shoppers.

more on this topic

Behavioral and bot signals

Look at how the checkout form is filled. Real customers pause, correct typos, and move a mouse or tap the screen. Scripts submit perfect data at machine speed. Device fingerprinting, JavaScript challenges, and interaction timing all separate the two.

Risk scoring at authorization

Feed the payment attempt into a risk model alongside the card network response. Combine the issuer response, geolocation, proxy detection, and account history into one score, then apply step-up verification such as 3D Secure when the score is borderline.

Prevention and hardening

• Require CVV and full address verification on every transaction you can.
• Turn on 3D Secure or an equivalent authentication step for high-risk attempts.
• Add a CAPTCHA or proof-of-work challenge to the payment step, not only to login.
• Rate limit by IP, session, and payment instrument, with a temporary block instead of a permanent ban.
• Return one generic decline message so attackers cannot tell valid numbers from invalid ones.
• Block or challenge traffic from known hosting providers, VPN exits, and proxy ranges.
• Keep your payment integration and fraud tooling current so new signals reach your rules.

What to do during an active attack

Move to a tighter posture first, then investigate. Raise velocity limits, add an authentication step, and pause guest checkout if the volume is severe. Pull the last few hours of authorization logs and group attempts by IP, device, email, and BIN to find the shape of the attack. Report confirmed fraud to your acquirer and to the card networks through their established fraud reporting channels, and refund or void any test transactions that slipped through so real cardholders are not left disputing them.

Why fast detection pays off

Every test transaction that reaches an issuer costs you in fees, dispute ratios, and processing privileges. Monitoring programs used by card networks can place a merchant in a high-risk category when fraud rates climb, which raises costs across the whole business. Steady card testing detection and prevention keeps approval rates healthy and keeps your account in good standing.