What card testing prevention is

Card testing prevention is the set of controls that stop attackers from running small, rapid transactions to check whether stolen card numbers are valid. The goal is to break the loop before a fraudster confirms a card and moves to larger purchases. You do not need a fraud team to start. You need rate limits, verification checks, and a way to spot abnormal traffic.

Before you start

  • Access to your payment gateway's fraud rules and logs.
  • Permission to change checkout settings.
  • A baseline of normal order volume and decline rates.
  • A contact at your acquirer for urgent blocks.

How to prevent card testing

  1. Turn on address verification (AVS) and CVV checks for every card-not-present transaction. Reject mismatches by default.
  2. Set velocity limits per IP, per card, and per email. For example, block more than three attempts in ten minutes from one IP.
  3. Add a CAPTCHA or a proof-of-work challenge to the checkout form after one failed attempt.
  4. Require 3-D Secure for high-risk regions or when the order total is below your average order value.
  5. Block disposable email domains and free proxy services at the form level.
  6. Monitor authorization logs for many small charges, sequential BIN ranges, and repeated declines followed by approvals.
  7. Use a fraud scoring service that flags card testing patterns in real time.
  8. Set a minimum order amount that is above the typical test charge, or add a fixed verification fee.
  9. Review your refund and chargeback process so you can reverse test charges fast.
  10. After an attack, add the offending IP ranges to a deny list and rotate your checkout keys if needed.

Warning signs

  • A spike in declined transactions under a dollar.
  • Many orders from one IP with different card numbers.
  • Mismatched billing and shipping details across consecutive orders.
  • High numbers of attempts on the same card in a short window.

After a card testing attack

Pull the transaction log for the attack window. Identify the common IPs, BINs, and email patterns. File a report with your acquirer. Refund or void the test charges. Then tighten your velocity rules and retest your checkout flow. Repeat the review weekly until the pattern stops.