Does 3DS Stop Card Testing?

Partly. 3D Secure raises the cost of card testing because every attempt has to pass an issuer-side authentication step, so a scripted run of thousands of small guesses turns into thousands of challenges, one-time codes, and abandoned sessions. Merchants that switch on 3DS2 with risk-based challenges report a large drop in micro-charge and authorization-only attempts, but the traffic shifts rather than disappears. Buy 3DS as one layer in a stack, and budget for velocity rules, decline monitoring, and BIN-level throttling at the same time. If you expect authentication alone to end card testing, you will be disappointed within a week.

3DS Challenge Card Testing Detection

What card testing looks like on a live checkout

Card testing is the practice of pushing card numbers through a payment form to find which ones still authorize. The signals repeat across industries: bursts of small orders, many attempts against a narrow BIN range, repeated declines from one device fingerprint, mismatched billing data, and a spike in authorization-only traffic that never settles. Attackers favor donation pages, gift card loads, and low-value digital goods because those flows carry weak friction.

more on this topic

Where 3DS helps, and where it does not

• Helps: the challenge flow forces issuer authentication, which kills bulk automated guessing.
• Helps: authentication results and ECI values feed your rules engine as a risk signal.
• Does not help: frictionless approvals pass with no challenge, so a stolen card the issuer scores as low risk still authorizes.
• Does not help: testing moves to channels outside 3DS, such as manually keyed orders, phone orders, and card-on-file setup.
• Does not help: 3DS says nothing about bot traffic, checkout enumeration, or account takeover at the login step.

What to look for when you buy a 3DS and fraud stack

1. 3DS2 support with risk-based challenge, not a blanket challenge on every order.
2. Exemption management handled by the provider, with reporting you can audit.
3. Velocity rules you can edit at card, BIN, IP, device, email, and phone level.
4. Decline-code and response-code visibility, including auth-only attempts that never settle.
5. AVS and CVV response passthrough into the same rules engine.
6. Fraud-rate and chargeback reporting split by BIN and by country.
7. Compatibility with your acquirer and gateway, not one proprietary rail.

Parameter bands worth testing

Use these as starting ranges, then tune against your own traffic and risk appetite.

does 3ds stop card testing

• Attempts per single card number: cap at 2 to 3 within 24 hours, then block.
• Attempts per BIN per hour: flag at 20 to 50, block above 100 during a campaign window.
• Attempts per device fingerprint: 3 to 5 per hour before a step-up challenge.
• Order value under $2 paired with a new email domain: require a challenge.
• Low-value exemption under PSD2: available below EUR 100 per transaction and EUR 500 cumulative, or 5 consecutive transactions.
• Transaction risk analysis exemption: applies only when the provider fraud rate stays below 0.13% and the issuer rate below 0.06%.

Pitfalls that reopen the door

• Challenging everything, then switching it off when conversion drops.
• Ignoring authorization-only traffic because it never becomes a settled order.
• Leaving exemptions enabled for new BINs and new countries with no monitoring.
• Trusting the gateway default velocity rules and never reviewing them.
• Blending card testing and friendly fraud into one report, which hides both.
• Watching only checkout while card data gets validated at signup and password reset.

FAQ

Does 3DS stop card testing on its own?

No. It blocks the cheapest automated runs and pushes attackers toward frictionless approvals, non-3DS channels, and lower-volume patterns that mimic real shoppers.

how to prevent card testing with 3ds

Is frictionless 3DS safe from testing?

Less than the challenge flow. Frictionless means the issuer approved without asking the cardholder, so a low-risk stolen card can still pass.

What stops testing faster, 3DS or velocity rules?

Velocity rules usually show results in hours. 3DS changes outcomes across the whole population of cards you accept. Run both and compare by BIN.

Do I still need AVS and CVV checks with 3DS?

Yes. Those responses give your rules engine a second signal and help separate testing from genuine address mismatches.