Card testing mitigation comes down to three moves: make the attack expensive, catch the pattern early, and stop acting as a free validation service. If a fraudster can learn whether a card number is live by watching your checkout, they will keep coming back until you shut the door.

card testing mitigation v1

What card testing actually looks like

An attacker runs thousands of small authorization attempts at low dollar amounts, often $0.50 to $5, hoping most get approved silently. The signals cluster in a few recognizable ways:

more on this topic

• Many different card numbers hitting one IP address, device fingerprint, or email domain in a short window
• Sequential or same-BIN card numbers submitted in order
• Sessions that jump straight to checkout with no browsing, no cart building, no time on site
• Disposable email addresses, mismatched billing details, free email plus random name strings
• A spike in authorization attempts with a near-identical timestamp

Card testing is often the opening act. Once numbers are confirmed, the same batch gets used for larger purchases or resold, so the small charges you see are reconnaissance, not the real loss.

more on this topic

The fastest controls to switch on

1. Velocity limits. Cap attempts per IP, per device, per card BIN, and per email over rolling windows. A limit of a few attempts per hour per identifier kills most automated runs without touching normal shoppers.
2. Bot detection at the entry point. Put CAPTCHA or a challenge on checkout, account creation, and password reset. Attackers target the cheapest endpoint you expose, which is usually a guest checkout or a card-verification form.
3. Block on repeated failures. After a set number of declines from the same device or IP, block the identifier for a period instead of letting it retry forever.
4. Require CVV and AVS. These checks raise the cost per attempt and filter out bulk lists that lack the security code.
5. Step up risky traffic with 3D Secure. An authentication challenge breaks automated scripts and shifts liability on eligible transactions.

Rules that catch the pattern without punishing real customers

I would rather stack several weak signals than rely on one blunt rule. Score each transaction on device reputation, IP risk, email age and domain, billing and shipping mismatch, attempt velocity, and order value relative to your normal basket. A high score triggers a challenge or review. A low score passes untouched.

Card Testing Mitigation v7: A Practical Guide

Keep a shared deny list of card fingerprints, device IDs, and IP ranges that already produced confirmed fraud. Feed it from your chargeback data, not from guesswork. Also watch for attack waves: fraud rings reuse infrastructure, so yesterday's blocklist often stops today's run.

Do not leak the answer

Your decline messaging is part of the attack surface. A response that says "invalid card number" tells the attacker the number is dead, while "insufficient funds" tells them it is live and worth keeping. Return a generic failure for anything that fails validation, and log the specific reason internally. On the authorization side, send a clear decline code to the processor but keep the customer-facing message vague.

Metrics worth watching

• Authorization attempt volume by BIN, hour, and channel
• Decline code distribution, especially sudden growth in one code
• Share of orders from new devices versus returning ones
• Average time from landing to checkout
• Chargeback ratio and fraud-to-sales ratio, tracked weekly

Set alerts on rate of change rather than absolute numbers. A 40 percent jump in attempts over an hour is the signal, even when the raw count still looks small.

Mistakes that cost more than they save

• Blocking entire countries or regions, which loses legitimate revenue and rarely stops a determined attacker
• Declining every transaction that fails AVS when your customer base ships to gift addresses
• Retrying declines automatically, which multiplies your exposure and can trigger processor fines
• Ignoring your own verification endpoints, since those get abused first

Run the controls in layers, review them monthly against fresh attack data, and treat every confirmed fraud case as training input for the next rule set.