Short answer

Mitigate card testing with four controls: rate limit the payment endpoint, require CVV and AVS, turn on 3D Secure, and block datacenter and proxy traffic. Attackers stop when the cost per test rises above the value of a working card number.

card testing prevention and mitigation

What card testing looks like

Card testing pushes stolen card numbers through a payment form to find numbers that still authorize. The attacker needs a card number, an expiry date, and often a CVV. They pick merchants with weak checkout controls: donation pages with free-form amounts, guest checkout, $0 and $1 authorization endpoints, and free trial signups.

related article

Signals to log: many authorizations in a short window, one IP or email using many card numbers, a jump in CVV and AVS mismatches, and a decline rate far above your baseline. Successful tests become chargebacks 30 to 90 days later.

related article

Rate limits and velocity rules

  • Count attempts per card fingerprint, per IP, per device fingerprint, per email, and per card BIN.
  • A starting rule set: 3 attempts per card per hour, 10 per IP per hour, 20 per device per day.
  • Block the card number after 2 failed CVV checks. Do not let the same card retry.
  • Cap the number of distinct cards one account can use in 24 hours.
  • Return a generic decline message. Detailed error codes tell the attacker which field failed.

Checks at the payment form

  • Require CVV for every charge. Decline on mismatch instead of sending the order to review.
  • Require AVS. Decline on a full mismatch.
  • Turn on 3D Secure with risk-based challenges. Issuers see the authentication attempt, and liability shifts on authenticated transactions.
  • Add a CAPTCHA or proof of work to the payment step.
  • Set a minimum order amount. Most tests run between $0.50 and $2.00.
  • Remove guest checkout, or require a verified email and phone number before the first charge.

Traffic filters

Most card testing runs from datacenter IP ranges and proxy networks. Block or challenge requests from hosting ASNs, Tor exit nodes, and known VPN ranges on the payment endpoint. Keep the rules narrow: a blanket block on VPNs costs sales from ordinary customers.

card testing prevention and mitigation

Processor and network side

Stripe Radar, Adyen RevenueProtect, and Braintree ship with card testing detection. Enable the rules and read the alerts. Card networks track the same activity. Visa's Dispute Monitoring Program and Mastercard's VAMP set fraud chargeback counts and fraud-to-sales ratios. A merchant above the threshold pays fines per chargeback and may need a fraud remediation plan.

Response plan

  1. Log every authorization attempt with IP, device fingerprint, card BIN, amount, and response code.
  2. Alert when attempts per hour pass a fixed number.
  3. On an active attack, raise limits to 1 attempt per card, require 3DS for all amounts, and pause the affected endpoint.
  4. Refund the test charges. Settled authorizations cost more in fees than in goods.
  5. Send the card BINs and IPs to your processor and your fraud vendor.