Card Testing Mitigation Best Practices

Card testing is a fraud pattern where someone sends many small authorization requests to find card numbers that work. Mitigation combines rate limits, authentication, velocity rules, and monitoring. No single control stops it. Most merchants stack four or five controls and tune thresholds over time.

What card testing looks like

Attackers buy lists of card numbers. They send one or two requests per card through a checkout form, donation page, or subscription API. Requests come from many IP addresses and many devices. Amounts are small, often under $5. Cards that approve get used later for larger purchases or resold.

Controls that reduce volume

• Rate limit by IP, device fingerprint, email, phone number, and card BIN.
• Require a CAPTCHA or challenge on payment endpoints after a threshold.
• Turn on 3-D Secure for card-not-present transactions.
• Enforce CVV and AVS checks. Decline on mismatch instead of queuing for review.
• Block or flag BINs and countries tied to prior attacks.
• Set a minimum order amount, or place a small authorization hold.
• Cap attempts per session and per account.

Detection signals

• A spike in authorization attempts with a falling approval rate.
• Many distinct card numbers from one IP range or one device ID.
• Repeated $1 or $0 authorizations.
• Email addresses with random strings at free providers.
• Billing and shipping data that changes between attempts.

Response steps

1. Confirm the pattern in processor logs. Check authorization counts per hour and decline codes.
2. Block the source: IP range, device ID, session token.
3. Add a gateway or fraud-tool rule with a fixed threshold. Do not rely on manual review.
4. Contact the acquirer. Some processors apply network-level blocks on request.
5. Refund the micro-charges and release authorization holds.
6. File a report with the card networks if the attack is large.

Limits of mitigation

Card testing mitigation lowers volume. It does not remove the risk. Attackers rotate infrastructure and rewrite scripts. Merchants that store card data carry added exposure under PCI DSS. Sensitive authentication data, including CVV, cannot be stored after authorization. Card testing also drives disputes, and dispute ratios above network thresholds trigger monitoring programs with fees.