What a card testing detection tool does
A card testing detection tool reads payment authorization traffic and flags attempts that come from scripts instead of buyers. Card testing is a run of small authorization requests against stolen card numbers. The attacker wants to learn which numbers still authorize. Test amounts sit near the minimum: $0.01 to $1.50 is common. Volume per attack runs from a few hundred to tens of thousands of requests in a short window.
card testing detection software
The tool answers three questions: is this session human, does this card belong to this buyer, and does this traffic match the merchant's normal sales pattern.
card testing detection service
Signals the tool scores
- Authorization attempts per IP, device, card BIN, and email in a fixed window.
- Decline ratio for one card or one IP. Attackers produce high decline rates because most tested numbers fail.
- Time between page load and card submit. Humans take seconds. Scripts post in under one second.
- AVS and CVV response codes against the billing address on file.
- Mismatch between IP country, card issuing country, and billing country.
- Card BIN sequences. Test runs walk through consecutive numbers.
- Account age, email domain age, and the count of cards linked to one account.
Detection methods
Four methods cover most deployments.
Card Testing Detection Service Buying Guide
- Rules and velocity limits. A cap on attempts per IP per hour, plus a block list of BINs, emails, and ASNs.
- Machine learning models. Gateways and fraud platforms score each authorization from 0 to 100 and return a decision.
- Device fingerprinting. The tool hashes browser and device attributes to link sessions that share hardware.
- Step-up authentication. 3-D Secure shifts liability and stops most scripted attempts because the script cannot complete the challenge.
Tool categories
Gateway features include Stripe Radar, Adyen RevenueProtect, and Braintree fraud tools. Standalone platforms include Sift, Forter, Riskified, and Kount. Bot management vendors such as Cloudflare, Akamai, DataDome, and HUMAN filter requests at the edge before they reach checkout.
Response actions
- Block the IP, ASN, device, or BIN range.
- Add a CAPTCHA or a rate limit to the payment endpoint.
- Require 3-D Secure for sessions that score above a set threshold.
- Void the test authorizations and refund any that settled.
- Notify the acquirer and the card brands when volume passes a set level.
Metrics to track
Watch authorization rate, decline rate, and dispute ratio. Visa and Mastercard each run dispute monitoring programs that fine acquirers and merchants above set thresholds. Confirm current numbers in the program documents for your region.
Limits
No tool catches every attempt. Attackers rotate proxies, use residential IP pools, and spread requests across many card BINs. Detection depends on the quality of the signals you send and how fast you tune rules after a new attack pattern appears.