Card testing prevention comes down to three controls that stop most attacks: velocity limits on checkout attempts, hard declines when the CVV or address check fails, and step-up authentication for sessions that look automated. A small store can run all three inside its existing payment gateway. A store with high volume or instant digital delivery will want a bot-management layer and a manual review queue on top. Below is what each layer does, what it costs you in conversion, and which setup fits which kind of business.
How to Prevent Card Testing: A Comprehensive Guide
What card testing looks like from the merchant side
Card testing is the practice of pushing stolen card numbers through a live checkout to learn which ones still work. The attacker does not want your product. The goal is a yes or no from the processor, and the confirmed numbers get sold or reused elsewhere. Your store absorbs the authorization fees, the chargebacks, and the risk of losing your processing account.
Card Testing Prevention System: How It Works
Signals that show up in order data:
- A burst of orders inside a few minutes, often from one IP range or device fingerprint
- Small tickets, frequently the cheapest item in the catalog
- Many different card numbers hitting the same checkout page
- Billing and shipping details that mismatch or change on every attempt
- Disposable email domains and proxy or VPN exit nodes
- A spike in declines, followed weeks later by a spike in chargebacks
Layer 1: Velocity limits and rate limiting
Velocity rules count attempts and cap them. Usual counters are per IP address, per device fingerprint, per email, per card BIN, and per shipping address. A basic rule blocks a fifth attempt from one IP inside ten minutes. A stricter rule forces a challenge after two failures.
Pros
- Low cost and usually built into the gateway you already pay for
- No added friction for legitimate buyers
- Catches scripted attacks in progress rather than after the fact
- Works the same on any processor or platform
Cons
- Shared IPs, such as offices, schools, and mobile carriers, can trip the rule
- Attackers rotate IPs, emails, and BINs to stay under the cap
- Thresholds need tuning as your traffic grows
Use it when: always. This is the floor for every card-not-present checkout, including a store doing ten orders a day.
Layer 2: CVV and AVS enforcement
Address Verification Service compares the billing address and postal code you collect against what the issuer holds. The CVV check compares the three or four digit code on the card. Both come back as part of the authorization response, and both can be set to decline on mismatch instead of flagging for review.
Pros
- Direct signal that the person at the keyboard holds the physical card
- Declines are backed by the issuer response, which supports chargeback disputes
- No extra vendor and no extra integration
Cons
- AVS coverage outside the US and Canada is uneven, and some issuers return no match result at all
- Gift cards, corporate cards, and virtual cards generate false declines
- It stops nothing on its own if the attacker already has full card data
Use it when: your volume is mostly US and Canadian card-not-present traffic. Set CVV to hard decline and AVS mismatch to review, then relax the AVS rule for known corporate buyers.
Layer 3: Step-up authentication and 3-D Secure
Step-up authentication asks the issuer to verify the cardholder mid-checkout through 3-D Secure or a similar challenge. Low-risk sessions pass through without friction, and risky sessions get a challenge or a decline.
Pros
- Shifts liability for fraud chargebacks to the issuer in many dispute cases
- Scripts that only replay card numbers cannot complete the challenge
- Risk-based rules keep most buyers out of the challenge flow
Cons
- Added steps cost conversions, mainly on mobile
- Issuer support and exemption rules vary by region and add configuration work
- Some subscription and stored-credential flows need extra setup
Use it when: you sell digital goods, ship cross-border, or carry a fraud rate that puts your processing account at risk.
Layer 4: Bot detection and infrastructure blocking
Bot management looks at device fingerprints, browser behavior, and network reputation. A large share of card testing traffic comes from hosting and data center ranges rather than residential connections, which makes those ASNs worth blocking at the edge.
Pros
- Stops distributed attacks that look like many separate customers to a velocity rule
- Cheap compared with the cost of a chargeback wave
- Can challenge the suspicious session without blocking the whole IP range
Cons
- Proxy and VPN lists go stale and need refreshing
- Corporate networks and privacy tools trigger false positives
- Adds a vendor, a script on the page, and a privacy notice
Use it when: your order logs show repeated hits from hosting providers, or when attacks keep coming back after you raise velocity thresholds.
Layer 5: Monitoring, alerts, and manual review
Rules need feedback. Watch authorization rates, decline reasons, and refund patterns, and set an alert for any sudden change in order volume or average ticket.
Pros
- Catches patterns the automated rules miss
- Produces the evidence you need for chargeback responses and acquirer conversations
- Shows you which rule is causing false declines
Cons
- Requires staff time and a queue that has to be worked daily
- Slows fulfillment for orders held in review
- Alert fatigue sets in fast if thresholds are loose
Use it when: you have someone who can work a queue, or when order values are high enough that a stalled shipment costs less than a chargeback.
Which stack fits your store
Starter store, under 200 orders a day: velocity limits, CVV hard decline, AVS review, and a CAPTCHA on the checkout form. That combination handles most scripted attacks with no new vendor.
Growing store, mixed physical and digital goods: add device fingerprinting and risk-based 3-D Secure, then keep a small review queue for AVS mismatches above a dollar threshold.
High-risk or high-volume store: run all five layers, block hosting ASNs at the edge, and assign one person to review traffic weekly and adjust thresholds.
Two rules that apply to everyone
First, never store the CVV or any other sensitive authentication data after authorization. PCI DSS forbids it, and keeping it turns a fraud incident into a data breach. Second, if test charges did go through, void and refund them, document the timestamps and IPs, and tell your acquirer and processor. Check gift card balance lookups and account pages too, since those endpoints get used for the same purpose when the checkout is locked down.