Start With CVV Verification and Hard Velocity Limits

The fastest way to prevent card testing is to require the card verification value on every transaction and cap how many failed authorization attempts a single card, IP address, or device can generate in an hour. Card testing depends on volume. An attacker pushes thousands of small authorization requests through a checkout and keeps whichever ones return an approval. When you remove the ability to submit unlimited attempts, the attack stops being profitable and usually moves on to an easier target. Merchants who add CVV checks, per-card attempt caps, and bot filtering at the payment step typically see fraudulent attempts drop within days.

card testing detection and prevention

What to Look For in a Fraud Prevention Setup

• CVV and AVS enforcement at authorization. A mismatch on the security code or billing address should decline the transaction outright, not just flag it for review.
• Velocity rules you can tune. You need limits on attempts per card, per IP, per email, per device fingerprint, and per shipping address. Static thresholds go stale, so look for a system that lets you adjust windows and counts.
• Bot detection at checkout. CAPTCHA, JavaScript challenges, and behavioral signals stop scripted submissions before they reach your payment processor.
• Authorization rate monitoring. A sudden spike in declines, voids, or one-dollar authorizations is the clearest early signal of a carding run.
• Processor-side controls. Most major processors offer built-in fraud rules and blocklists. Confirm what your provider already covers so you do not pay for duplicate tools.

Parameter Bands That Work

These are starting points, not universal answers. Test them against your own traffic and tighten where false declines stay low.

card testing fraud prevention

• Failed attempts per card number: 3 to 5 within 24 hours, then block.
• Checkout attempts per IP address: 10 to 20 per hour, then challenge or block.
• Attempts per device fingerprint: 5 to 10 per hour.
• Order value that triggers review: anything under 1.00 in your local currency, since testers favor tiny amounts.
• New account plus immediate high-value purchase: manual review.
• Geographic mismatch between IP country and billing country: step-up verification, not an automatic decline.

Pitfalls to Avoid

• Relying on CAPTCHA alone. Scripts can solve or outsource it, so pair it with server-side limits.
• Blocking entire countries or IP ranges as a first move. You lose legitimate customers and the attacker simply rotates.
• Setting velocity limits only on successful charges. Failed attempts are the attack, so count those too.
• Ignoring your own refund and chargeback fees. Even blocked attempts that reach the processor can carry per-transaction costs.
• Leaving test modes or trial endpoints open in production. Attackers scan for them.

FAQ

How do I know my store is being card tested?

Look for clusters of small-dollar authorizations, a jump in declined transactions, many orders from the same IP or device, and a spike in card-not-present attempts within a short window.

more on this topic

Do I need a dedicated fraud tool?

Not always. CVV enforcement, AVS checks, and velocity rules built into your payment gateway cover many small merchants. Higher volume usually justifies a specialized layer.

related article

Will strict rules hurt legitimate sales?

Some friction is unavoidable. Monitor false decline rates and loosen thresholds for returning customers, known devices, and trusted countries.

What should I do after an attack?

Block the offending IPs and fingerprints, refund or void the test charges, alert your processor, and document the incident for your records.