What is card testing mitigation v7?

Card testing mitigation v7 is a layered control set that stops criminals from using a merchant's checkout to find out whether stolen card numbers still work. Attackers send many small authorizations, watch which ones approve, then keep the live numbers. Version 7 assumes the attacker rotates IPs, cards, and email addresses, so single-signal blocks no longer hold.

Card Testing Mitigation v10: A Comprehensive Guide

The goal is not to stop every attempt. It is to make each attempt cost the attacker time and money while keeping false declines low for real shoppers.

related article

How does card testing work?

An attacker loads a list of card numbers into a script, points it at a payment endpoint, and submits a low-value order for each one. Approved cards go into a live pile. Declined cards get discarded.

related article

• Small amounts, often $0.50 to $5, chosen to slip under manual review limits.
• Many attempts in a short window from a rotating set of IPs and devices.
• Billing data that does not match the card, or that repeats across many orders.
• Abandoned carts, since the attacker never plans to receive goods.

Some attacks hit the checkout page. Others call the payment gateway's API straight, which skips the storefront and any JavaScript check inside it.

Card Testing Mitigation V6

The seven control layers in v7

1. Edge rate limiting

Cap requests per IP, per session, and per card fingerprint inside a rolling window. A limit of 5 to 10 payment attempts per IP per hour catches most basic scripts and stays clear of normal buyer behavior.

2. Bot challenge at checkout

Load a JavaScript challenge before the pay button goes live. Cheap scripts fail it. Add a CAPTCHA step when risk signals rise, not on every order.

3. Card and BIN velocity

Track attempts per card number, per BIN, and per cardholder email across the whole store, not just one session. Attackers reuse a small set of BINs, so a BIN-level cap flags the run even when each card shows up once.

4. Device and IP signals

Fingerprint the device and check IP reputation. Datacenter IPs, known proxy ranges, and devices that appear across dozens of cards belong in a review queue.

5. CVV and AVS enforcement

Require CVV on every card-not-present order and reject on mismatch. Match AVS at minimum on the postal code. These checks force the attacker to hold real card data, which many lists do not include.

6. 3-D Secure step-up

Trigger 3DS when the risk score crosses a threshold. It shifts liability for fraud chargebacks and adds a step most scripts cannot complete. It does not stop a tester who has access to the cardholder's bank app.

7. Decline threshold and blocklist

Block a card, device, or IP after a set count of declines in a window. Push confirmed bad identifiers to a shared blocklist so the same actor meets friction on the next visit.

What signals show an attack in progress?

Transaction patterns

• Approval rate drops while order volume climbs.
• Average order value falls below your normal floor.
• Many orders share a shipping address, or none have one at all.
• Gateway fees and authorization counts spike without matching revenue.

Account and device patterns

• New accounts created in bursts from the same subnet.
• One device fingerprint tied to many card numbers.
• Email addresses with random strings and no order history.
• Checkout sessions that start and end in under ten seconds.

How do you roll out v7 in order?

Rolling out card testing mitigation v7 works best in stages, so you can measure each change against the false decline rate.

1. Turn on logging for every payment attempt, including declines, with IP, device, and card fingerprint.
2. Set rate limits at the edge and at the payment endpoint.
3. Add the JavaScript challenge to the checkout flow.
4. Enable card, BIN, and email velocity rules.
5. Require CVV and set AVS rules.
6. Configure 3DS step-up at a risk threshold you can tune.
7. Set decline thresholds and connect a blocklist feed.
8. Review the false decline rate after each change, and roll back any rule that pushes it up without cutting attack volume.

Which metrics prove it works?

• Authorization attempts per hour during peak attack windows.
• Approval rate for first-time buyers.
• False decline rate on known-good customers.
• Chargebacks tied to card testing.
• Cost per blocked attempt versus gateway fees avoided.

Common mistakes

• Blocking by IP alone. Attackers rotate proxies, and shared IPs catch real customers.
• Setting the decline threshold too low, which locks out shoppers who mistype a digit.
• Skipping logging. Without device and card fingerprints, no rule can be tuned.
• Applying CAPTCHA to all traffic, which lowers conversion for everyone.
• Treating the gateway's fraud tools as complete. They see one merchant's traffic, not yours.

FAQ

Does 3-D Secure stop card testing?

It reduces it. Attackers avoid merchants with 3DS because the extra bank step slows their scripts and raises their cost per check. Some still try, so keep the other layers on.

What decline threshold should I start with?

Start at 3 to 5 declines per card or device in a one-hour window, then watch your false decline rate for a week. Tighten only if attack volume stays high.

Can card testing hurt a small store?

Yes. A few thousand $1 authorizations can push a small merchant past a gateway's fraud ratio limit and trigger fines, holds, or account termination.

Do I need a fraud vendor to run v7?

No. Most payment processors and platforms offer rate limits, CVV and AVS rules, and 3DS. A vendor helps with device fingerprints and shared blocklists, which are the hardest pieces to build in house.