Card testing stops with three layers: rate limits on checkout attempts, verification before authorization, and monitoring after the fact. One rule does not hold. Attackers rotate IP addresses, devices, and card numbers.

how to reduce card testing attacks

How card testing works

An attacker holds a list of card numbers taken from a breach or bought from a shop that sells stolen card data. The attacker pushes small authorization requests through a merchant's payment form to learn which numbers are live. Live numbers get sold or used for larger purchases.

Preventing Card Testing on Payment Forms: A Practical Guide

Common patterns: many attempts from few devices, charges between $0.00 and $1.00, one email address used with dozens of cards, and a spike in declines.

card testing detection and prevention

Rate limits and velocity rules

• Cap authorization attempts per IP address per hour. Start at 10 and tune.
• Cap attempts per card BIN per hour. Attackers draw from the same BIN range.
• Block an IP address that uses three or more different card numbers.
• Block a device fingerprint tied to multiple accounts.
• Throttle account creation on the same email domain.

Verification before authorization

• Require CVV on every transaction. A CVV mismatch should stop the order, not warn.
• Turn on AVS and reject postal code mismatches for first-time buyers.
• Send a 3-D Secure challenge when the risk score is high. The issuer then sees the attempt and can decline it.
• Add a CAPTCHA or proof-of-work challenge to checkout and signup forms.
• Verify email and phone before the first charge.

Blocklists and traffic filters

• Block hosting provider and data center IP ranges at the edge.
• Block open proxies and known bot networks.
• Enforce a country set per storefront. A merchant with US customers does not need traffic from 40 countries.
• Reject requests with missing or mismatched headers, or with headless browser fingerprints.

Monitoring and response

Set alerts on authorization volume, decline rate, and average ticket size. A store that runs 20 orders a day and sees 400 attempts in an hour should page someone.

more on this topic

Void pending authorizations before settlement when the pattern is clear. Refund settled charges and report the activity to the acquirer.

Signals to watch

• Authorization attempts under $1.00.
• Decline rates above 30 percent.
• Many cards, one device.
• Checkout sessions that last under five seconds.
• Spikes at 3 a.m. local time.

What does not work

Blocking one IP address. Attackers rotate. Relying on chargebacks alone. Card testing charges are small and may not reach dispute thresholds. Waiting for a fraud platform to learn on its own. Rules catch known patterns; the first wave still hits.

Limits

No public figure exists for the share of card testing attempts that a given control blocks. Results depend on traffic mix, gateway, and rule tuning. Test changes on a small share of traffic first.