Choose from any of our gift cards to give to your loved ones
Card Validation Attack Defense: A Buyer's Guide to Card Testing Protection
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
The highest-value setup for card validation attack detection is a layered one: authorization velocity limits, decline-code clustering, BIN and issuer anomaly scoring, and device or session fingerprinting working from the same event stream. Card validation attacks, often called card testing or card enumeration, look like ordinary checkout traffic until you examine the pattern behind the requests, so single-signal rules tend to either miss them or flood your queue with false positives. The criteria that matter when you pick tooling are coverage of the response codes your acquirer actually returns, threshold control per payment method and per market, and how fast your risk team can change a rule without waiting on a release cycle.
Velocity rules count attempts inside a rolling window and block the ones that break the pattern. A scripted card validation run typically sends dozens of attempts per minute from one source, so a simple cap on attempts per IP, per device, and per BIN prefix catches the crude version of the attack on day one.
Best for high-volume checkouts on a single storefront where you can hold a per-source counter in memory and tune the cap weekly.
Issuers return different reasons for a failure, and a validation attack produces a distinctive mix: a burst of do not honor and invalid card number responses, few insufficient funds responses, and almost no successful authorizations with matching billing data. Storing the full response code, not just a pass or fail flag, is what makes this signal usable.
Best for digital goods and subscription merchants that deliver instantly, where a successful validation hands the attacker something of value within seconds.
Score failure rates per BIN range and per issuer over a baseline window. A validation run often concentrates on a narrow set of BINs pulled from a single dump, so that range shows a failure rate far above its normal level even when total traffic looks flat.
Best for marketplaces and physical goods sellers where a single fraudulent order carries shipping cost plus chargeback fees.
A fingerprint links many card attempts to one browser or device even after the attacker rotates IP addresses and card numbers. Pair it with session signals such as form fill time, paste events in the card field, and mismatched billing and shipping countries.
Best for merchants who already run a step-up challenge such as 3-D Secure and want a reason to trigger it selectively.
Score each signal, then require two or more to agree before you block. Review a weekly sample of blocked orders to measure false declines, and keep a separate queue for soft declines that deserve a retry prompt rather than a block. Route confirmed validation attempts to your acquirer and to the card brands, since early reporting can shorten the life of a dump. Recheck thresholds after every product launch, because a new checkout flow changes the baseline that your rules were calibrated against.
