Choose from any of our gift cards to give to your loved ones
Card Testing Defense Techniques: How Merchants Stop Card Testing
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card testing protection is a layered set of checkout controls that detects and blocks automated attempts to validate card numbers against your payment gateway. It combines rate limits, bot detection, address and CVV verification, and velocity rules so a probe never becomes a settled order.
Attackers profit when a small authorization succeeds, because that confirms a usable card. Every blocked probe removes inventory, fees, and chargeback exposure from your ledger.
Most attacks arrive as a burst of low-value orders, often under a few dollars, spread across hundreds of card numbers in minutes. Decline rates climb before revenue does, and the same IP, device fingerprint, or email pattern repeats across attempts.
Successful probes often return as a second wave of higher-value orders placed with the validated cards, sometimes weeks later.
Rate limiting is the first lever: cap attempts per IP, per card BIN, and per session, and return a generic failure instead of a detailed decline reason. Add a challenge such as CAPTCHA or a device check when a session trips a threshold, and block the session outright on repeat hits.
Second, enforce CVV and AVS as hard rules rather than soft warnings. Attackers rarely hold the correct verification data, so a strict mismatch rule removes most probe traffic at the authorization step.
Third, run velocity checks across combined dimensions: card number, BIN range, email, phone, device fingerprint, and IP subnet. A single-dimension limit is easy to evade; a combined one is not.
Attackers start small because a small charge is less likely to trip manual review and cheaper to absorb if it fails. Your thresholds should therefore treat the lowest order values as the highest-risk band, not the safest.
Each attempt carries an authorization fee, and each successful probe can return as a chargeback with its own fee and dispute paperwork. Sustained attacks also damage your approval ratios, which raises processing costs across the whole account.
No. CAPTCHA reduces automated volume, but determined attackers use solver services and residential proxies. Pair it with velocity limits and strict verification rules.
Only as a temporary measure during an active burst. Blanket blocks reject legitimate customers and rarely hold once attackers rotate infrastructure.
Keep tighter thresholds for at least two weeks after the last spike. Attackers commonly return to the same target once alerts go quiet.
Yes. Strong customer authentication shifts liability and stops most probes because the attacker cannot complete the issuer challenge.
