Short answer

Card testing mitigation works by making each stolen card number expensive to validate and by returning as little useful signal as possible to the attacker. You cannot stop every probe, but you can make your checkout a bad place to run them. The layers that matter most are velocity limits, amount rules, verification requirements, bot defense, and a response plan you can trigger in minutes rather than days.

card testing mitigation v1

What card testing looks like in your logs

Card testing rarely shows up as one big transaction. It shows up as noise: a burst of small authorizations, a decline rate far above your normal baseline, and a cluster of attempts sharing an IP, a device fingerprint, an email pattern, or a card BIN range.

Card Testing Mitigation: A Practical Guide for Merchants

Signals I watch for:

card testing mitigation v10

• Many attempts on one card in a short window, usually minutes
• Amounts at the bottom of your price range, often under a dollar
• Sequential or near-sequential card numbers hitting the same form
• Billing ZIP or address values that fail AVS but pass CVV, or the reverse
• Traffic from data center IP ranges instead of residential or mobile carriers
• Disposable email domains and phone numbers that look auto-generated
• A spike in declines from one BIN without a matching spike in orders

One detail that gets missed: successful small orders. Testers sometimes let a cheap transaction through to confirm the card works, then use it elsewhere or resell it. A sudden run of low-value orders from new accounts with no history is worth a look even when the approval rate looks healthy.

card testing mitigation v1

Controls that stop most of it

Velocity and amount rules

Start with per-card, per-IP, per-email, and per-device limits on authorization attempts, not just on completed orders. Count declines too, since that is where the volume lives. A rule as blunt as five attempts per card per hour catches a large share of automated runs. Add a floor on order value or require a minimum cart total for guest checkout.

Verification requirements

Require CVV and enforce AVS on every card-not-present transaction, including the small ones. Testers often have the number and expiration but not the security code. Turn on 3D Secure for risky segments: new accounts, mismatched geography, high attempt counts, or orders below your normal threshold. Risk-based 3DS keeps friction off your regular customers while adding a step attackers cannot complete at scale.

Bot and device signals

Rate limiting at the edge helps, but device fingerprinting and behavioral checks catch scripts that rotate IPs. Look for form fill times that are impossibly fast, missing mouse movement, and identical headers across sessions. A CAPTCHA on the payment step is crude, but it works, and you can scope it to suspicious traffic only.

Decline messaging

Do not hand back detailed decline reasons at the checkout. Generic messages reduce the feedback loop attackers rely on. Your processor may offer settings that limit the response detail returned to the storefront, which is worth asking about.

Tuning without blocking real customers

Every rule you add costs you some legitimate orders. So review the blocks weekly for the first month. If a rule is catching returning customers with clean history, narrow it. Segment your rules rather than applying one threshold to everyone.

When an attack is live

1. Raise the velocity thresholds to their strictest setting and enable CAPTCHA for new sessions.
2. Require 3DS for the affected BIN ranges and geographies for a few hours.
3. Block the offending IP ranges and device fingerprints.
4. Contact your processor or acquirer. They can act at the network level and they have seen the same pattern on other accounts.
5. Log everything: request headers, payload shapes, timing. You will need it if the attack returns in a new form.

Measuring whether it worked

Track authorization attempts per hour, decline rate, and the ratio of declines to completed orders. A healthy result is a sharp drop in attempts with a small or no drop in conversion. Keep an eye on your overall fraud and dispute ratios, since card networks run monitoring programs that can penalize merchants with sustained high fraud, and a card testing wave can push you over a threshold you never chose.