To prevent card testing, stop automated attempts before they reach your payment processor: add a challenge such as CAPTCHA, set velocity limits on cards and IPs, validate card data, and watch small authorization failures. Card testing is a fraud pattern where someone checks stolen card numbers with low-value charges or authorization requests. The goal is to find live cards before using them for larger purchases.

related article

What does card testing look like?

Card testers look for a signal: approved, declined, or an error code. They send many attempts across one site, then move to another.

card testing detection and prevention

• Many small orders or $0 authorizations in a short window.
• One IP address or device using dozens of card numbers.
• Card numbers from the same bank identification number (BIN) range in sequence.
• Failed CVV or address verification (AVS) checks on most attempts.
• New accounts that order digital goods with mismatched billing data.

Some attackers use bots. Others pay people to enter cards by hand. Both types leave patterns in your order data.

read more

How do you stop card testing at checkout?

Add a challenge before payment

CAPTCHA, a login requirement, or a short proof-of-work step raises the cost of bulk attempts. Put the challenge before the card form so bots do not reach the processor.

card testing detection and prevention

Set rate limits on cards, IPs, and accounts

Limit attempts per IP address, per card number, per email, and per account. A common rule is a small number of attempts per hour, with a longer block after repeated failures.

Validate card data and order data

Require CVV and AVS checks on card-not-present orders. Reject orders when the billing address, ZIP code, or country does not match the card issuer data. Add a phone check or a small hold for high-risk orders.

Use 3-D Secure when you can

3-D Secure adds an issuer challenge for card payments. It shifts some liability and stops many card testers because they cannot pass the bank step. Support it for high-risk orders or all card payments if your processor supports it.

Watch small transactions

Card testers start with small amounts because a $1 charge is cheap to test. Flag more than a few small authorizations from one IP, device, or card BIN in a short period.

How do you detect an attack in progress?

Look for a change from your normal order pattern, not a single failed order. The first sign is often a burst of declines, not a burst of sales.

• Decline rate jumps above your baseline.
• Many orders use the same product, the same shipping method, or the same coupon.
• Card BINs repeat across accounts.
• CVV and AVS fail on most attempts.
• Traffic comes from data centers, proxies, or one device fingerprint.

Build a daily report for these signals. A short review catches most attacks before chargebacks arrive.

What should you do when card testing hits?

1. Turn on a CAPTCHA or a stricter challenge for the affected checkout path.
2. Tighten velocity rules and block the IPs, devices, and card BINs in the attack.
3. Contact your payment processor and ask for help with the traffic pattern.
4. Void or refund test charges when you can. Keep records of the orders, timestamps, and outcomes.
5. Review account signups and remove accounts tied to the attack.
6. Tell your team and update your fraud playbook with the new pattern.

Do not block an entire country or a whole BIN range unless the data supports it. Broad blocks turn away good customers and push attackers to a new path.

How do you reduce card testing risk over time?

Card testing is a volume problem. Each layer you add makes bulk attempts slower and more costly.

• Use tokenization so your site stores no raw card data.
• Keep PCI DSS controls current and limit access to payment systems.
• Review fraud rules each month and remove rules that block too many good orders.
• Test your checkout with a fraud tool or a test card in a staging site.
• Train support staff to spot test orders and report them.

What data should you log for card testing investigations?

Log the order ID, time, amount, IP address, device fingerprint, card BIN, AVS result, CVV result, and the payment processor response. Keep these records for the period your processor and PCI DSS rules require.

• Store card data only as allowed by PCI DSS. Never keep CVV after authorization.
• Use a hash or token for card numbers so you can link attempts without storing the full number.
• Keep a short note on each block or challenge you apply.

Good logs turn a messy attack into a set of rules you can test and reuse.

FAQ

Can card testing hurt your chargeback rate?

Yes. Test charges often turn into disputes when cardholders notice them. A high chargeback rate can lead to fees or loss of card processing. Stop the attempts at the first sign and refund test orders when you can.

Is CAPTCHA enough to stop card testing?

No. CAPTCHA blocks simple bots, but attackers can solve it by hand or with a farm. Use CAPTCHA with velocity limits, AVS, CVV, and 3-D Secure.

Do small authorization requests matter?

Yes. A $0 or $1 authorization can confirm a live card without a sale. Count those requests in your fraud rules, not only completed orders.

Should you block prepaid cards?

Not by default. Prepaid cards serve legitimate customers. Block them only if your data shows a clear fraud pattern and you accept the lost sales.