Start with the defense, not the data

If you are evaluating tools to stop card testing fraud, buy for real-time detection first: velocity checks, device fingerprinting, and custom rules. These features catch the small authorization attempts that attackers use to validate stolen card numbers. Do not buy, sell, or test stolen card data. That is illegal and outside the scope of this guide.

What card testing fraud is

Card testing fraud happens when someone uses automated scripts to submit many low-value transactions or authorization requests. The goal is to learn which card numbers are active. A successful test may lead to larger fraudulent purchases, chargebacks, and processor penalties. Merchants often see a spike in declined transactions, especially from one IP range or one BIN range.

Common signs

• Many declines in a short window
• Small amounts like $0.10 to $1.00 repeated across cards
• Traffic from data centers, proxies, or unusual geographies
• Multiple cards used from one device or session

What to look for in a fraud prevention tool

Focus on capabilities that directly counter card testing. The tool should let you block or challenge suspicious traffic before authorization. It should also give you logs that connect attempts across cards, devices, and IP addresses.

• Velocity rules: Limits by IP, device, card BIN, email, and session.
• Device fingerprinting: Tracks devices even when cookies are cleared.
• Behavioral signals: Detects scripted timing and repeated form fills.
• Custom rules: Lets you block, challenge, or review based on risk scores.
• Reporting: Shows declined authorization spikes and attack patterns.

Parameter bands to test

Start with conservative limits and adjust with real traffic. A common starting band is 5 to 10 payment attempts per IP per hour. For a single card, allow 1 to 3 attempts in 10 minutes. For a single device, set 3 to 5 attempts per hour. Challenge rates often land between 1% and 5% of total transactions. If you see false positives, raise the band. If attacks continue, lower it and add device rules.

Pitfalls to avoid

1. Relying on AVS or CVV alone. Attackers can test those fields too.
2. Ignoring small declines. Card testing often hides in low-value attempts.
3. Blocking entire countries when the attack comes from a few proxies.
4. Whitelisting broad IP ranges and creating a bypass.
5. Skipping 3D Secure on high-risk transactions. It adds a step that many testing scripts cannot complete.

FAQ

Is card testing fraud illegal?

Yes. Using stolen card numbers to test or validate them is illegal in the US and many other countries. Merchants should report attacks to their acquirer and to law enforcement.

Can CAPTCHA stop card testing?

CAPTCHA can slow down simple bots, but advanced scripts can solve or bypass it. Use CAPTCHA with velocity limits and device checks.

Do I need 3D Secure?

3D Secure helps on card-not-present transactions because it requires an extra authentication step. It can reduce card testing success, though it may add friction for legitimate customers.

How fast should I respond to an attack?

Act within minutes. Card testing can generate thousands of attempts per hour. Have a runbook that lets you tighten rules, block IPs, and contact your processor.

Buy prevention that fits your traffic, test your rules, and keep monitoring. The goal is to make card testing expensive and unreliable for attackers.