Short answer

Card testing is a fraud pattern. An attacker sends many card numbers through your payment form to learn which ones authorize. A $0.00 to $1.00 authorization confirms a live card. The defense is four things: bot checks on the form, rate limits per IP and per card, strict CVV and AVS rules, and 3D Secure where the issuer supports it.

related article

What the attack looks like

A script pulls card numbers from a breach dump or a purchased list. It fills your checkout fields with one number, submits, reads the gateway response, and moves to the next number. A single host can push thousands of attempts in an hour. Most attempts fail. The ones that pass are the product.

strategies to stop card testing

Signals in your logs

• Decline codes 05, 51, 54, or 57 in a cluster.
• Many card numbers from one IP address or one device fingerprint.
• Card numbers in the same BIN range inside a 60 minute window.
• Email addresses from disposable domains.
• Billing country that does not match IP country.
• Order values under $1.00 with no shipping address.
• Authorization rate drops from 85 percent to 40 percent in a day.

Controls to turn on

1. Bot protection on the checkout page. reCAPTCHA, hCaptcha, and Turnstile all raise the cost of a script.
2. Rate limits. Cap attempts per IP, per session, and per card. Five attempts per 10 minutes per IP blocks most scripts.
3. Require CVV. Decline on a CVV mismatch. Do not store the CVV after authorization.
4. Require AVS on the street number and ZIP. Decline on a full mismatch.
5. Enable 3D Secure. In most card networks the liability shifts to the issuer once the cardholder authenticates.
6. Set a minimum order amount. A floor of $0.50 removes the cheapest test path. Keep a separate allowlist for merchants that need $0.00 auths.
7. Velocity rules in the gateway. Stripe Radar, Braintree, and Checkout.com support counters per card and per IP.
8. Block lists. Add ASNs, IP ranges, and email domains tied to prior attacks. Update the list each week.

Monitoring and review

Track three numbers each day: count of failed authorizations, count of unique card numbers per hour, and authorization rate. A rise in the first two with a fall in the third points to an active test run. Chargeback ratios matter too. Visa and Mastercard run monitoring programs, and a ratio above 0.9 percent can bring fines or account termination. PCI DSS requires you to keep audit logs for 12 months, with 3 months available for review.

strategies to stop card testing

What does not work

Blocking one IP address does little. Attackers rotate proxies and residential exit nodes. Hiding the CVV field does not stop a script that already holds the CVV. A CAPTCHA alone is not enough if the form has no rate limit. Card testing costs the merchant in gateway fees, fraud losses, and network fines, so pair every control with a log that shows it fired.

Ecommerce Card Testing Prevention: Stop Fraud at Checkout