How to Stop Card Testing Attacks on Payment Forms
A guide to stopping card testing attacks: velocity limits, bot challenges, card verification, and decline monitoring, with pros, cons, and rollout order.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card testing defense rests on four controls: rate limits on payment attempts, CVV and AVS checks that reject mismatches, 3-D Secure step-up on risky orders, and blocklists built from your own decline data. Merchants that run all four stop most test traffic before it reaches the issuer. The rest shows up as a pattern in the decline log.
A card tester needs a live payment page and a script. Botnets or rented proxy pools submit hundreds of small authorizations, often from $0 to $1, to learn which card numbers still work.
Stolen numbers get sold in bulk, and the seller wants a clean list before reselling. Your gateway becomes the testing lab, and every approved test charge is a chargeback waiting to happen.
No single rule stops a determined tester. Layered controls do, because each layer covers the gap the one before it leaves open.
Set a hard cap on authorization attempts per session, card fingerprint, IP, and email address. Three to five attempts in an hour is a common ceiling for a normal shopper.
Count failed attempts across the whole account, not just the current session. Testers rotate sessions but often reuse the same device or email domain.
Decline on CVV mismatch instead of routing the order to manual review. Testers seldom have the printed code, so a strict CVV rule removes a large share of their attempts at the door.
Pair that with AVS street and ZIP checks. A mismatch on both, from a first-time buyer, is a solid reason to say no.
Trigger 3-D Secure on orders that score as risky: new device, billing country that does not match the card BIN, odd hour, or a high attempt count. The challenge costs a real customer a few seconds and stops a tester cold.
Keep friction low for trusted buyers by skipping the challenge on repeat purchases from a known device.
Flag sessions where the device fingerprint changes while the cart and email stay the same. Datacenter IPs, proxy pools, Tor exits, and known bot signatures all earn extra checks.
Geo mismatch between IP, billing address, and card BIN is one of the oldest signals in the book. It still works.
Feed every confirmed test attempt back into your blocklists: card fingerprint, device ID, email, IP, and shipping address. Ask your gateway and acquirer whether they run a fraud network you can contribute to.
Each attempt still hits your gateway, and most processors charge a fee per authorization even when it fails. Acquirers also watch decline ratios, so a burst of declines can flag your account.
The real damage arrives later. Test charges that cleared turn into chargebacks with fees that commonly run $15 to $25 each, plus the lost goods. A high chargeback ratio can get your merchant account frozen.
Start in monitor mode. Log what a rule would have blocked for two weeks before you switch it on.
Watch false positives on your best buyers: repeat customers, wholesale accounts, and anyone paying from a saved card. Exempt them by device or customer ID, not by card BIN.
Review thresholds each month. Attackers adjust, and a rule that worked at five attempts per hour may need to drop to three.
In part. It slows scripted attacks on the checkout form, but testers can solve or outsource CAPTCHA solving. Treat it as one layer, not the whole defense.
No. Card testing validates stolen numbers with small authorizations. Chargebacks come later, when the real cardholders dispute charges for goods you shipped.
Yes. Scanning tools look for weak checkouts and do not check your revenue. A store with a cheap test SKU and no rate limits is a target.
Within the hour for a live attack. Set a rule that adds a device or IP to the blocklist after three declines in ten minutes, and review the list each week.
Layer the controls. Rate limits catch volume, CVV and AVS catch bad data, 3-D Secure catches the rest, and blocklists keep repeat offenders out. Check the decline log each week and adjust thresholds as the pattern shifts.