Card testing mitigation means blocking the small authorization attempts that fraudsters use to check whether stolen card numbers still work. The fix combines rate limits at the edge, strict address and CVV checks, velocity rules tied to the card number itself, and 3-D Secure on risky traffic. Merchants who layer these controls cut attack volume and stop paying the fees that come with thousands of declined charges.

related article

What a card testing run looks like

• Hundreds of checkout attempts in a short window, often from a small set of IP ranges.
• Small order values or donations that never ship anywhere.
• Card numbers sharing one BIN but differing in the last four digits.
• Decline codes dominated by do-not-honor and invalid card responses.
• Abandoned carts where the payment step is the only step completed.

Prerequisites

• Access to your payment gateway rule and verification dashboard.
• Logging that captures IP address, user agent, session ID, card BIN, and authorization response code.
• An alert path that reaches an on-call engineer when authorization volume spikes.

How to mitigate card testing

1. Enable per-IP and per-session rate limits on the payment endpoint. Set a burst cap and a slower sustained cap.
2. Require CVV and AVS verification on every authorization. Reject the transaction when either check returns a full mismatch.
3. Add velocity rules on the card number. Decline a BIN plus last-four pair after a few attempts inside a rolling window.
4. Turn on 3-D Secure for cross-border cards, new devices, and orders outside your normal shipping pattern.
5. Place a bot challenge in front of the checkout form. Serve it when a session shows no browsing history before payment.
6. Create a blocklist rule for the IP ranges, ASNs, and email domains seen in the attack.
7. Set alerts on authorization volume, decline rate, and average ticket size. Route them to a phone, not an inbox.
8. Review gateway logs on a fixed schedule and promote repeat offenders into permanent rules.

Detection signals to watch

A healthy store shows a decline rate in the low single digits. A spike toward 30 percent or more, paired with a drop in average ticket size, points to enumeration. Watch for many cards from one BIN hitting the same endpoint, sessions that start and end at the payment page, and traffic from hosting providers rather than consumer ISPs.

read more

If an attack is live

Raise the challenge level first, then tighten rate limits. Block the offending ranges and disable guest checkout for the next few hours if volume stays high. Notify your acquirer and gateway support so they can flag the traffic on their side. Keep the declined attempts in your logs. They are the evidence you need if the fees are disputed later.

related article

Long-term hardening

Tokenize stored cards so a leaked number cannot be reused. Keep CVV mandatory for card-not-present orders. Recheck your rules each quarter, because attackers change tools and rotate infrastructure. No single control stops card testing. The goal is to make each attempt cost more time than the number is worth.

Card Testing Mitigation V6