A Stripe card testing attack is a rapid burst of small payment attempts run through a Stripe checkout form to find out which stolen card numbers are still active. The attacker is not buying anything real. The merchant absorbs the declines, the dispute fees, the network fines, and a lower authorization rate on legitimate orders.

stripe card testing attack best

What a card testing attack looks like

Card testing is a volume game. A script submits hundreds or thousands of transactions in a short window, each one using a different card number, and each one for a tiny amount such as one dollar or less. The attacker watches the response. An approved charge means the card is live and can be resold or used for a larger purchase. A decline means the number is dead and gets discarded.

stripe card testing attack best

From the merchant side the pattern is hard to miss once you know what to look for: a wall of declined payments, a spike in Stripe Radar risk scores, and a checkout page that suddenly receives far more traffic than your ads or search rankings explain.

compare stripe card testing attack

Why Stripe integrations get targeted

Stripe is popular, well documented, and easy to integrate, which makes its payment endpoints a common target for automated card testing. Any publicly reachable checkout can be scripted against. The risk grows when a store runs a custom form with no bot protection, no rate limit, and no rule that forces authentication on suspicious payments.

stripe card testing attack compared to

Small and mid-size merchants are hit hardest because a few hundred fraud attempts can overwhelm their normal transaction volume and trip monitoring thresholds at the card networks.

Warning signs to watch in your Stripe Dashboard

  • A sharp spike in declined charges, especially with codes like card_declined or incorrect_cvc
  • Many transactions for identical, unusually low amounts within minutes
  • Dozens of different card numbers arriving from the same IP address, device fingerprint, or email pattern
  • Billing country that does not match the card's issuing country
  • A sudden jump in blocked payments and Radar risk scores
  • Chargebacks or support messages from cardholders who say they never shopped with you

How to prevent card testing on Stripe

  • Enable Stripe Radar. It scores every payment and lets you write custom rules, such as blocking a card that has failed repeatedly in a short window.
  • Add a bot check to checkout. Stripe Checkout and Elements support CAPTCHA integrations, which stop basic scripts cold.
  • Require 3D Secure for risky payments. Risk-based authentication shifts liability and breaks most automated testing loops.
  • Set a minimum order amount. A floor of a few dollars removes the cheapest testing ground.
  • Rate limit your own endpoints. Cap attempts per IP, per session, and per card fingerprint.
  • Use Stripe-hosted Checkout where possible. You inherit more of Stripe's built-in abuse controls and keep sensitive data off your servers.
  • Block or challenge mismatched geography. Flag payments where the IP country, shipping country, and card country disagree.

Responding to an active attack

  1. Turn on a temporary block for the offending IP ranges and card fingerprints.
  2. Raise the Radar risk threshold so more payments are challenged instead of approved.
  3. Switch on 3D Secure for the impacted customer set.
  4. Contact Stripe support and report the pattern so they can help filter it at the account level.
  5. Review the fallout: refund or void what you can, and respond fast to any chargebacks that appear.
  6. Document the timeline and the changes you made, since card networks may ask about your fraud controls later.

Reducing exposure over time

Treat card testing as an ongoing operations problem rather than a one-time incident. Review your Radar rules monthly, watch your authorization rate as a health metric, and keep an eye on decline ratios by country. Merchants who monitor velocity and geography consistently catch testing campaigns in the first few minutes instead of after hundreds of failed charges have already cost them money and processing privileges.

Does card testing hurt my Stripe account?

Yes. High fraud and dispute rates can trigger stricter processing terms, higher reserves, or account reviews, even when the fraudulent charges themselves are small.

Will 3D Secure stop card testing completely?

No single control stops it completely, but risk-based 3D Secure removes the friction-free approval an attacker needs and makes large-scale testing far less economical.