Short answer

Card testing is the practice of running many small transactions against a payment gateway to find stolen card numbers that still authorize. Mitigation has four parts: rate limits, verification checks, fraud scoring, and fast response when an attack starts.

more on this topic

What an attack looks like

• Hundreds or thousands of authorizations in minutes, often from one IP range or one device fingerprint.
• Amounts near $1.00 or $0.00. Attackers test with the smallest amount the gateway allows.
• Many different card numbers, one merchant. Bank identification numbers spread across banks and countries.
• Low success rate. Most attempts return "do not honor," "invalid CVV," or "pick up card."
• Off-hours timing in the merchant's local time zone.

Controls that work

Rate limits: cap authorization attempts per IP, per device, per email, per bank identification number, and per card number in a rolling window. A common starting point is 5 attempts per card per hour and 20 per IP per hour. Tune from your own baseline.

Card Testing Mitigation V8: A Comprehensive Guide

Verification: require CVV and address verification on every card-not-present order. Reject when both fail. Add 3D Secure for high-risk bank identification numbers. 3D Secure shifts fraud liability to the issuer on eligible transactions.

Card Testing Mitigation v7: A Practical Guide

Velocity rules: block a card after 3 declines in 24 hours. Block an email domain after 10 declines. Flag IPs on hosting or VPN ranges when the order value is above your average.

card testing mitigation v8

Bot controls: CAPTCHA or a proof-of-work challenge on checkout. Block headless browsers. Rate limit the payment endpoint, not only the checkout page.

Monitoring metrics

• Authorization rate by bank identification number. A drop in one segment points to an attack.
• Decline reason mix. A rise in "invalid CVV" or "do not honor" is an early signal.
• Count of unique cards per IP per day.
• Dispute count and ratio. Card networks run acquirer monitoring programs with fraud and enumeration thresholds. Numbers change, so confirm current values with your acquirer.

When an attack starts

1. Block the source IP range and device IDs.
2. Route new attempts to manual review instead of auto-approve.
3. Contact your processor. Ask for a block on the affected bank identification number range.
4. Add 3D Secure to the affected card segment.
5. Log card numbers that authorized. Void or refund them before settlement where the gateway allows.

Dispute fees for card-not-present chargebacks run about $15 to $25 each. Authorization fees on thousands of $1 attempts add up even when no chargeback follows. Response speed matters more than rule count.