Ecommerce card testing prevention is the practice of blocking fraudsters who run stolen card numbers through your checkout to learn which ones still work. One testing run can produce hundreds of failed authorizations, tiny orders, and disputes that hit your processing account. The fix combines checkout verification, rate limits, fraud tools, and a fast response when failed payments spike.

card testing detection and prevention

How card testing works

A fraudster buys a batch of stolen card numbers from a dark web market or a dump site. They submit each number to a live checkout, often with a small or digital order, and watch the response. A declined result means the card is dead. An approved result means the number is live and can be sold or used for a larger purchase.

related article

Digital goods, gift cards, and donation pages are common targets because there is no shipping step. The attacker gets value without a delivery address, and you get a chargeback weeks later.

how to reduce card testing attacks

What card testing looks like in your order data

• Many orders for low-cost items inside a short window, sometimes within minutes.
• Several card numbers tried against one customer email, IP, or device.
• A burst of failed authorizations followed by a few approvals.
• Billing and shipping details that do not match, or a billing address that fails AVS checks.
• New accounts created in bulk with random strings in the email address.
• Card numbers that run in a sequence, which happens when dumps come from one issuer range.
• A jump in checkout attempts with no matching traffic to your product pages.

Which checkout controls stop card testing?

Require CVV and address verification

Turn on CVV checks and AVS for every transaction. Testers often hold the card number but not the security code, so a CVV requirement kills a large share of attempts at the door. Decline or flag orders where the security code or the ZIP code does not match.

more on this topic

Add rate limits and bot checks

Set limits on checkout attempts per IP, device fingerprint, email, and card number. Ten failed payments from one IP in an hour is a testing pattern, not shopping. Add a CAPTCHA or a bot score check to checkout and to any card validation page you expose.

Use 3D Secure for risky orders

3D Secure shifts liability for fraud chargebacks to the issuer when the check passes. Apply it to new customers, high-risk countries, and any order that trips a fraud rule. The extra step costs you a small share of conversions, so scope it to risk instead of forcing it on everyone.

Watch saved-card and account pages

Card testing does not always happen at checkout. Attackers also probe stored-card pages, subscription updates, and free trial signups. Put the same limits and bot checks on those forms.

How do you set velocity rules?

Count attempts, not just completed orders. Start with these thresholds and tune them against your own data.

• More than 3 failed payments from one IP in 10 minutes: block that IP for 24 hours.
• More than 2 different card numbers on one account in an hour: hold for review.
• More than 5 orders from one device in an hour: require 3D Secure or manual review.
• One card number tried on more than 3 accounts: block the card and every account tied to it.
• Email domains with a fraud history at your store: block at signup.

Keep these thresholds in your fraud tool rather than hardcoded in your checkout, so you can change them mid-attack.

What should you do during an active attack?

1. Raise the block level in your fraud tool and tighten velocity limits.
2. Block the offending IP ranges, device IDs, and email domains.
3. Turn on 3D Secure for all new customers until the traffic drops.
4. Call your payment processor and tell them you are under a card testing attack. They can adjust your risk profile and waive some fees.
5. Void or refund the small orders that slipped through, then close those accounts.
6. Log the card numbers, IPs, and device IDs used, so you can block repeats.

Which tools handle card testing prevention?

Most processors ship fraud rules that cover the basics. Stripe Radar, Adyen RevenueProtect, Braintree, and Cybersource all support velocity checks, blocklists, and custom rules. Standalone services such as Kount, Sift, and Riskified add device fingerprinting and shared network data. Configure one layer first, then add a second if attacks continue.

Why your chargeback ratio matters

Card networks track merchants that collect too many fraud chargebacks. Visa runs a dispute monitoring program and Mastercard runs its own; both can fine a merchant and require a remediation plan. Testing attacks generate disputes fast because real cardholders call their bank when they see a charge they do not recognize. A run blocked in the first hour never turns into a chargeback.

Card testing prevention checklist

• CVV and AVS required on every order.
• Rate limits by IP, device, email, and card number.
• CAPTCHA or bot detection on checkout and saved-card pages.
• 3D Secure triggered by risk rules, not by default.
• Velocity rules stored in your fraud tool, not in code.
• Alerts when failed authorizations rise above your daily baseline.
• A written response plan with your processor contacts on it.

Card testing is a volume game. Attackers move on when a store costs them time and returns nothing, so the goal is friction on their side and clean data on yours.