Block card testing with counters and step-up challenges, not with guesswork. Track authorization attempts per IP address, per device fingerprint, per email, and per card BIN over short windows. When a counter crosses a threshold, send the session to a challenge instead of letting it fail through. In parallel, watch your issuer decline rate on small-ticket transactions. A burst of "do not honor" and "invalid card number" responses on $0 to $2 authorizations is the clearest signal that someone is validating numbers against your gateway.

read more

What card testing looks like in your logs

Card testing needs volume and speed. Someone with a list of numbers runs them through a checkout to learn which ones authorize. The pattern is consistent: many cards, few customers, small amounts, short sessions, and a high failure rate. Look for hundreds of authorization attempts from a small set of IP addresses, a wide spread of BINs hitting one endpoint, and email addresses created minutes before the order. Attackers aim at the cheapest path available: a $0.50 donation form, a free trial with card verification, or a stored-credential check with no purchase attached.

read more

Signals to instrument before you tune thresholds

• Authorization attempts per card per hour and per day
• Distinct card numbers per IP and per device in a 24-hour window
• Issuer decline codes grouped by BIN and by time bucket
• Account age at the moment of the first payment attempt
• Mismatch between IP location, billing address, and issuing country
• Email domain reputation and disposable-domain hits
• Failed AVS and CVV combinations repeated across different cards

Parameter bands that hold up in practice

Start tight and widen only after you measure false declines. These bands are a starting point, not an industry standard:

what is card testing prevention

• More than 3 declines from one IP in 10 minutes: challenge the session
• More than 5 distinct cards from one device in 24 hours: hold for review
• More than 10 distinct cards from one IP in 24 hours: block the address range
• Authorization attempts under $1.00 from accounts younger than 24 hours: require 3-D Secure or manual review
• Issuer decline rate above 25% on a single BIN within an hour: throttle that BIN
• Overall decline rate doubling week over week: escalate to fraud review

Card network monitoring programs flag acquirers when fraud-to-sales volume or chargeback ratios cross program limits, and those limits sit in the low single digits. A sustained testing attack on your account carries real settlement risk even when each individual ticket is tiny.

related article

Pitfalls that leave the door open

• Relying on a CAPTCHA alone. Solvers get past it, and the challenge does not slow scripted attempts at the authorization layer.
• Blocking all small transactions. Legitimate donations and subscription verifications get caught, and false declines cost revenue.
• Ignoring soft declines. An issuer "try again later" response still tells the attacker whether the number is live.
• Logging only successful orders. The failures are the evidence you need after an attack.
• No shared view across checkout, account creation, and password reset. Testers move between endpoints.
• Skipping 3-D Secure on card verification flows. Exemptions should not apply to untrusted sessions.

FAQ

Does 3-D Secure stop card testing?

It reduces the value of a successful test, because the attacker cannot complete a purchase without passing the challenge. It does not stop the authorization attempts themselves, so pair it with velocity counters.

How fast should a block take effect?

Within one request. Evaluate counters at the authorization step, before the request goes to the issuer, so a flagged attempt never reaches the network.

What should I do after a confirmed testing attack?

Preserve logs for the affected window, block the source ranges and device identifiers, notify your acquirer, and review any authorizations that succeeded from the same cluster.

Do I need to review chargebacks after an attack?

Yes. Successful test authorizations often turn into disputes weeks later, and unmanaged disputes push your ratio toward network program thresholds.