What a card testing prevention system does
A card testing prevention system identifies and blocks automated attempts to validate stolen card numbers. The attacker submits many small authorizations, often $0.00 to $2.00, and records which ones return an approval. One merchant can receive thousands of attempts in an hour. The system sits between the checkout form and the payment processor. Its job is to separate test traffic from real customers before the authorization request leaves the site.
Signals the system reads
- Card velocity: one card number used at 20 or more merchants in a day.
- BIN velocity: many cards from one bank identification number hitting one endpoint in a short window.
- IP concentration: hundreds of attempts from one address or one subnet.
- Device fingerprint reuse across different card numbers.
- Decline rate per session. Testers accept a high decline rate and keep submitting.
- Order value near zero, with a billing and shipping address that do not match.
- Timing: fixed gaps between requests, such as one every 2 seconds.
Controls that reduce the volume
Rate limits on the checkout endpoint cap requests per IP, per device, and per card BIN. A CAPTCHA or a JavaScript challenge raises the cost of scripted submission. Requiring CVV and address verification filters cards with no matching data. 3-D Secure shifts liability and stops most automated approvals. Blocklists of known bad IP ranges and BIN ranges handle repeat sources. A honeypot field that no human fills catches bots that parse every input.
Monitoring matters as much as blocking. Store authorization logs with the IP, device ID, card BIN, amount, and response code. Review the logs for patterns after each incident.
Numbers to track
- Authorization approval rate by day. A drop of 5 points or more can signal an attack.
- Count of $0.00 to $1.00 attempts per 1,000 orders.
- Block rate and false positive rate. High false positives lose revenue.
- Dispute ratio. Visa's dispute monitoring program uses a 0.9% ratio threshold. Mastercard uses 1.5% with a minimum count of 1,000 chargebacks.
Limits
No system stops all testing. Attackers rotate IP addresses and card numbers, and some use residential proxy networks that look like normal traffic. Rules need review on a schedule because attack patterns change. A single control also shifts traffic rather than removing it; layered controls work better than one strong filter.