Card testing defense: the short answer

Card testing defense means making it expensive and slow for an attacker to check whether stolen card numbers work. You do this with four controls working together: rate limits on every endpoint that touches a payment, bot detection on the checkout form, verification rules such as CVV and address checks, and monitoring that catches the pattern in minutes instead of days. No single control stops card testing. The combination does.

more on this topic

What card testing looks like

An attacker buys a list of card numbers and runs them through your checkout. Most numbers fail. A few succeed, and those get sold or used for larger purchases. The attack is automated, so the volume is high and the individual amounts are small.

read more

  • Many small orders placed in a short window, often at the same dollar amount.
  • Decline rates that jump from your normal baseline to 40 percent or higher.
  • Orders from a small set of IP addresses or a single data center range.
  • Disposable email addresses and billing details that do not match the card.
  • Traffic that hits the payment endpoint without visiting product pages.

Prerequisites

  • Access to your payment gateway risk and velocity settings.
  • Access to your web server, CDN, or WAF configuration.
  • A baseline of your normal order volume, decline rate, and average order value.
  • A named person who receives fraud alerts and can act within the hour.

Step-by-step defense setup

  1. Export the last 30 days of orders and record your normal decline rate, average order value, and orders per hour. This is your baseline.
  2. Turn on rate limiting for the payment and tokenization endpoints. Set a limit per IP and per session, for example 10 attempts per minute and 30 per hour.
  3. Enable CVV verification and address verification in your gateway. Reject transactions when the CVV does not match.
  4. Add a bot challenge to the checkout page, not to the whole site. Load it only when the payment form renders.
  5. Configure velocity rules: block a card number after 3 declines in 24 hours, an IP after 15 attempts, an email after 5 orders, and a device fingerprint after 10 attempts.
  6. Set a minimum order value that covers your payment processing fee and chargeback fee. Few card testers clear a threshold above a few dollars.
  7. Require 3D Secure for orders that fail any risk rule, such as a new device with a high-value cart.
  8. Block or challenge traffic from hosting providers, proxies, and VPN ranges at the checkout path.
  9. Create alerts for decline rate spikes, order bursts from one IP subnet, and repeated failed CVV checks. Route them to the person named in your prerequisites.
  10. Log every payment attempt with timestamp, IP, device fingerprint, card BIN, and outcome. Keep the log for at least 90 days.
  11. Write a chargeback response procedure. Gather order data, delivery proof, and the attempt log for each disputed charge.
  12. Review the rules every month. Attackers change tactics, and a rule set that is never tuned becomes noise.

Signals that an attack is running now

Watch your dashboard during peak hours. A decline rate that triples in 15 minutes is the clearest sign. Other markers include one IP placing dozens of orders, a spike in authorization attempts with no matching page views, and a cluster of orders using sequential card BINs. When you see these, tighten the velocity limits first and add the offending IP range to your deny list second.

related article

What not to do

  • Do not block a whole country to fix a narrow attack. You lose legitimate revenue and the attacker moves to a new range.
  • Do not raise your minimum order value above what your honest customers pay.
  • Do not rely on a single signal such as email domain. Attackers rotate disposable domains.
  • Do not ignore failed attempts. A failed attempt is still billable activity at many gateways and it signals intent.

How to measure whether it works

Track three numbers each week: authorization attempts per hour, decline rate, and chargeback count. A working defense drops attempt volume while your successful order count stays flat. If decline rate falls but chargebacks rise, your rules are letting fraudulent charges through, so tighten CVV and 3D Secure requirements. If both fall and revenue falls, your limits are too tight and you are turning away real buyers.

Card Testing Defense Mechanisms Guide

Run a test against your own checkout once a quarter. Submit ten rapid attempts from one IP with bad card data. If fewer than three are blocked, your rules need work.