Card Testing Defense: Detect and Stop Card Testing

Card testing defense in one sentence

Card testing defense is the set of controls that stop attackers from using a checkout page to find out which stolen card numbers still work. The core moves are rate limits, CVV and AVS checks, 3D Secure on risky traffic, and fast blocking of repeat fingerprints.

How card testing works

An attacker buys a batch of card numbers. The batch comes from a breach dump, a phishing page, or a card shop. Most numbers in the batch are dead. The attacker needs to find the live ones.

The attacker sends small authorization requests through a payment form. Charges sit between $0.00 and $1.00. Some attacks use a card verification request that never captures funds. The attacker reads the response code. Approvals mark live cards. Declines mark dead cards.

Volume is the tell. One IP address may hit the same endpoint 200 times in an hour. One card may appear at 40 merchants in a day.

Detection signals

• Many authorizations from one IP, device, or IP subnet in a short window.
• Order values at or near $1.00, with no shipping address.
• Sequential or near-sequential card numbers, or numbers from one BIN range.
• Email addresses built from random strings, or a new domain for each attempt.
• Failed CVV and AVS checks on most attempts, with a few passes.
• Checkout time under 10 seconds per order.
• Traffic spikes between 2 a.m. and 5 a.m. local time for the merchant.

Controls that cut losses

Layer controls. One control fails against a determined attacker.

1. Rate limit by IP, device fingerprint, card BIN, and email. Set a low ceiling, such as 5 attempts per 10 minutes.
2. Require CVV and full AVS on every authorization. Do not store or skip the check.
3. Apply 3D Secure to new devices, new countries, and orders under $2.00.
4. Add a CAPTCHA or proof-of-work challenge after 3 failed attempts from one fingerprint.
5. Block known bad IPs, data center ASNs, and proxy lists. Update the list each day.
6. Set a floor on order value. Decline authorizations under $0.50 unless the merchant segment needs them.
7. Log every authorization with IP, user agent, device ID, and response code. Keep logs 12 months.

Issuer and network side

Issuers see the same card hit many merchants. They can close the account, decline the BIN range, or flag the merchant. Visa and Mastercard run acquirer monitoring programs with fraud and dispute ratio thresholds. A merchant that passes the threshold pays fees and may enter a remediation plan.

After an attack

Count the authorizations, the approvals, and the chargebacks. Chargebacks from card testing arrive 30 to 90 days later. Refund nothing until you match the order to a real customer. Ask the processor for a BIN and IP report. Add the fingerprints to a permanent block list.

Card testing does not stop on its own. Attacks resume when the block list expires.