Answer first: buy control at the authorization layer

Card testing prevention is not a single product. An attacker pushes thousands of stolen card numbers through your checkout page, your payment API, or a subscription form, then watches which authorization requests come back approved. The purchase that pays off first is a control that sits at or before the authorization request and stops repeated attempts on the same card, card BIN range, device fingerprint, IP, and email before those requests reach your processor. Add bot management after that, and a review queue last. A CAPTCHA by itself will not hold once someone scripts around it, and a web application firewall alone will not catch a request that looks like a normal checkout.

Card Testing Prevention Tools: A Buying Guide

What to look for before you buy

• Detection at the payment step, not only at page load. Page-level bot scoring misses headless scripts that post straight to your API.
• Velocity controls on separate instruments: card number, BIN range, email address, device ID, IP, ASN, and billing postal code. Shared limits across all of them are easy to route around.
• Rules you can edit without a support ticket, plus a simulation mode so you can test thresholds against live traffic before enforcing them.
• Coverage of every payment endpoint you run, including stored-credential charges, one-click checkout, gift card balance checks, and password reset flows.
• A review queue with reason codes, case notes, and export, so dispute responses do not depend on screenshots.
• Alerting on attempt spikes in near real time. Discovering the attack from a chargeback notice three weeks later is the expensive path.
• No storage of CVV or full track data at any point, including temporary logs used for troubleshooting.

Parameter bands to put in your requirements

• Added latency: keep authorization screening under roughly 150 to 250 milliseconds at the 95th percentile. Test this with your own traffic, not a vendor benchmark.
• False positive rate: fewer than 1 percent of legitimate orders sent to manual review, with total review volume staying near 2 percent of orders. Ask for a monitor-mode report before you sign.
• Velocity defaults: cap attempts per card BIN per hour, per device per hour, and per IP per hour. A single device generating dozens of attempts in an hour should hit a hard stop.
• Amount clustering: flag bursts of micro authorizations and rapid upward increments from the same device or email.
• Input hygiene: disposable email domains, malformed phone numbers, and mismatched billing data checked at entry, before the authorization request.
• Rollout pace: plan one to two billing cycles in monitor mode, then enforce in stages rather than flipping every rule at once.
• Rule change turnaround: same-day self-serve edits, since attackers shift patterns within hours.

Pricing models and contract terms

Most vendors price per screening or per transaction, sometimes with a monthly platform fee. Ask for the marginal cost of a blocked attempt, the cost of a screened legitimate order, and whether monitor-only traffic bills at the same rate as enforced traffic. Read the minimum commitment, the auto-renewal clause, and the overage tiers. If pricing scales with authorization volume, an attack can produce a large invoice in a single weekend, so negotiate a written cap or a flat tier during an incident. Bundled processor risk tools usually cost less per order but give you fewer knobs; dedicated platforms cost more and take longer to integrate.

related article

Pitfalls that waste the spend

• Buying a WAF and calling the job done. Traffic shape filters do not evaluate whether a card number is being reused across sessions.
• Relying on AVS and CVV match codes alone. Attackers working with complete card data pass both.
• Leaving your own checkout API or the processor authorization endpoint unthrottled, which lets an attacker test at machine speed.
• Blocking entire countries or all VPN traffic, which removes real customers and does little to a distributed attack.
• Ignoring account creation, login, and gift card balance endpoints, all of which get used to validate cards and identities.
• Enforcing rules with no monitor period, which floods the review queue and hides the false positives that matter.

FAQ

Does 3D Secure stop card testing?

It reduces completed fraud because most stolen card data fails authentication, but the authorization attempts still hit your processor and can carry fees. Pair it with velocity limits so most attempts never reach that stage.

how to prevent card testing

Do I need bot management and fraud scoring together?

Often yes. Bot management stops automated request patterns; fraud scoring judges the order and the identity behind it. Smaller merchants can start with the risk controls bundled into their payment processor and add a dedicated layer when volume justifies the cost.

related article

How quickly can prevention go live?

Velocity caps and basic rules usually deploy the same day through a processor dashboard. Dedicated fraud platforms with custom models take longer, typically a few weeks including integration and a monitor period.

What should I log during an attack?

Keep IP, user agent, device fingerprint, email, BIN range, timestamps, and authorization outcomes. Processors may ask for this in dispute responses, and it shortens the time needed to tune rules for the next wave.