Enforce failed-authorization velocity limits first. That one rule stops more card testing than any other control, because testing depends on repetition: an attacker needs many small attempts to learn which numbers are live. Pair it with CVV and AVS checks that fail closed, then layer the remaining rules in the order below. Each rule is ranked on three criteria: how much fraud it stops, how many legitimate customers it turns away, and how much engineering work it takes to ship.

card testing rules for merchants

1. Velocity Limits on Failed Authorizations

Count declines, not orders. A tester runs dozens of attempts against one merchant account in a few minutes. Set thresholds per card number, per IP address, per device fingerprint, and per billing email over rolling windows, and reset them on success.

What Are Card Testing Rules

Pros

  • Blocks testing before a live card is confirmed and resold
  • Cheap to build with counters in your existing data store
  • Thresholds can be retuned without touching the checkout flow

Cons

  • Shared IP ranges, such as corporate NAT or mobile carriers, can trip limits for real buyers
  • Requires logging every attempt, including the ones you never turned into orders

Best for: any merchant taking card-not-present payments through a checkout or an API.

what are card testing rules

2. CVV and AVS Checks That Fail Closed

Reject on a CVV mismatch. Reject on a full AVS mismatch. The common mistake is treating a CVV failure as a soft signal and still capturing the authorization, which gives the tester the confirmation they wanted. Make the decline path explicit in your payment integration.

read more

Pros

  • Stops naive testers who only have a card number and expiry
  • No added latency for the customer
  • Signals are returned by the issuer on the authorization response

Cons

  • Full AVS mismatches can decline legitimate buyers who moved recently
  • Some regions and card products return incomplete AVS data

Best for: merchants selling physical goods with a billing address on file.

3. Device Fingerprinting and IP Reputation

Fingerprint the browser or device and store it with the attempt. Testers rotate card numbers faster than they rotate infrastructure, so a single fingerprint with twenty card numbers in an hour is a strong signal. Combine it with IP reputation data and datacenter range blocking.

Pros

  • Catches rotation across cards, which velocity limits alone miss
  • Useful for step-up decisions rather than hard blocks

Cons

  • Privacy disclosures and consent requirements vary by jurisdiction
  • Fingerprints degrade as browsers restrict tracking surfaces

Best for: higher-volume stores that already have fraud tooling in place.

4. Minimum Order Value and Attempt Caps Per Session

Testers favor small amounts because declines cost them nothing. A floor on order value, plus a cap on authorization attempts per session, removes the cheap path. Keep the floor low enough that it does not obstruct normal low-ticket purchases.

Pros

  • Removes the low-cost probe that testers rely on
  • Simple to configure in most gateways and platforms

Cons

  • Can block genuine small purchases, gift cards, and donations
  • Determined testers will simply raise the amount

Best for: merchants whose average order value is well above a few dollars.

5. 3-D Secure Step-Up Triggers

Do not challenge every transaction. Trigger authentication when a combination of signals fires: new device, mismatch on AVS, failure velocity above threshold, or a first-time buyer with a high ticket. This keeps friction off repeat customers.

Pros

  • Shifts liability for eligible transactions in many card schemes
  • Authentication cost applies only to risky attempts

Cons

  • Adds a step that some buyers abandon
  • Integration work and issuer support vary by market

Best for: subscription and digital goods merchants with repeat customers to protect.

Sequencing the Rules

Ship velocity limits and fail-closed CVV handling first, since they cover most testing traffic with the least customer friction. Add device fingerprinting next, then attempt caps, then step-up authentication. Log every decline with the reason code so you can measure whether a rule is catching fraud or just annoying buyers.

Signals Worth Alerting On

  • A spike in authorization attempts with a flat approval count
  • Many card numbers sharing one device fingerprint or IP
  • Repeated small charges from the same session
  • Decline reason codes clustered on CVV and AVS mismatch