Card testing mitigation: the short answer

Card testing mitigation is the set of controls that block the small authorization attempts fraudsters use to check if a stolen card number works. The controls that stop it are velocity limits on checkout, CAPTCHA or device checks on the payment form, a CVV requirement, address verification, and blocks on proxy and data-center IP ranges. Most merchants see attack volume drop within 24 to 72 hours after these rules go live.

Card Testing Mitigation v10: A Comprehensive Guide

A card testing run costs the merchant in three places: authorization fees, chargebacks, and processor penalties. A run of 5,000 attempts at $0.30 per authorization is $1,500 in fees before a single chargeback posts.

card testing mitigation v2

What a card testing attack looks like

Ticket sizes sit between $0.00 and $2.00. The same BIN appears across hundreds of attempts. Decline rates on the affected checkout path jump from a 5 to 15 percent baseline to 60 percent or higher. Traffic arrives from a small set of IP subnets, often cloud hosts, and the user agents repeat.

card testing mitigation v2

Three common patterns exist:

more on this topic

• BIN attack. One merchant, many card numbers from the same issuing bank range.
• Merchant attack. One card number, many merchants, low dollar amounts.
• Account takeover test. Stolen card numbers checked against saved cards in customer accounts.

Signals in your payment logs

• Average order value drops to under $1 on a specific payment method.
• Decline code 05 (do not honor) or 51 (insufficient funds) spikes.
• Multiple card numbers share one device fingerprint or one email domain.
• Authorization attempts per minute exceed 3 times the 7-day median.
• Billing country and IP country do not match on more than 20 percent of orders.

Controls that cut volume

1. Rate limit by card, IP, and device. Cap attempts at 3 per card per hour and 10 per IP per 10 minutes.
2. Require CVV on every transaction. Stolen card data often lacks the 3-digit code.
3. Turn on 3-D Secure for high-risk BINs. The challenge step stops automated scripts.
4. Block cloud and proxy ASNs. Most residential buyers do not check out from a hosting provider.
5. Add a challenge to the payment form. A CAPTCHA or proof-of-work token raises the cost per attempt.
6. Set a minimum order value on card-not-present channels. A $0.50 floor removes the cheapest test pattern.
7. Alert on decline-rate change. Page the fraud team when the decline rate moves 25 points in one hour.

Thresholds and tuning

Baselines differ by vertical. A digital goods store may see 2,000 orders per hour, so a fixed attempt cap will block real buyers. Start with a 5x margin over the 30-day peak, then tighten over two weeks. Log every blocked request with the card BIN, IP, device ID, and timestamp. Recheck the logs after 7 days to confirm the rules did not catch repeat customers.

What does not work

Blocking one IP address or one card number fails because attackers rotate both. Blocking an entire country blocks legitimate sales. Raising the price of the test item only shifts the attack to a cheaper item in the catalog. Manual review alone does not scale when the attack sends 500 attempts per minute.

Reporting and recovery

Contact the acquiring bank within 24 hours of a confirmed run. Ask for the authorization log and the decline code breakdown. Dispute chargebacks that carry a fraud reason code with the device and IP evidence attached. Most networks give 7 to 10 days from the chargeback notice to submit a response.