Stripe Card Testing: What It Is and How to Stop It

What is card testing on Stripe?

Card testing is a fraud attack that sends stolen card numbers through a live payment form to learn which ones still authorize. On Stripe it shows up as a burst of small charges, a jump in declines, and many different cards hitting one checkout page in minutes. Every attempt returns a signal to the attacker: approved, declined, or a request for bank authentication.

The merchant is the test lab. Attackers pick checkouts that accept low amounts, skip 3D Secure, and do not limit how many times one IP or one card can try. Your Stripe account absorbs the fees, the disputes, and the fraud rate that follows.

What does Stripe card testing look like in your dashboard?

The pattern is loud once you know the shape of it. Open the Payments list, filter to declined charges, and sort by time.

• Many charges for the same small amount, often between $0.50 and $2, from cards you have never seen.
• A decline rate that moves from a few percent to 40 percent or more inside an hour.
• Dozens of card attempts from one IP address, device fingerprint, or email domain.
• Billing addresses that fail AVS checks or sit in a different country than the card.
• One customer record used with 20 cards, or one card fingerprint spread across 20 records.
• Traffic spikes at 3 a.m. with no ad campaign or email send behind them.

Radar shows the same signals as risk scores and rule matches. If 60 declines land in five minutes from one IP block, someone is testing your form.

Why do fraudsters target Stripe checkout pages?

Stripe's API answers fast and returns clear decline codes, which is what a card tester wants. A public checkout form needs no account, no approval, and no relationship with the merchant. Attackers also know that many small stores run the default Radar settings and stop there.

The math favors volume. A tester with 10,000 card numbers needs a handful of live ones to profit, and a few hundred blocked attempts cost almost nothing. A merchant who takes hours to react gives away a working batch.

How much does card testing cost the merchant?

Costs start with Stripe's per-charge fee on every authorization that goes through, plus a dispute fee (Stripe charges $15 per chargeback) when cardholders file. Then come the indirect costs.

• Chargeback fees and refunded fraudulent charges.
• Lost inventory on physical goods that ship before the dispute lands.
• Card network fraud monitoring programs that track fraud and dispute ratios by merchant.
• Account reviews, rolling reserves, or lost card processing rights.

Visa and Mastercard both run programs that flag merchants above set fraud thresholds. Merchants that stay above the line can face fines or lose the ability to accept certain card types.

How do you stop card testing on Stripe?

You stop it by raising the cost of each attempt and cutting the attacker's feedback loop. No single control does the job. A stack of four or five does.

Which Stripe settings block card testing?

1. Radar rules. Add rules that block when one IP, card fingerprint, or email tries more than a set number of charges in an hour. Default rules catch some of this. Custom velocity rules catch more.
2. 3D Secure. Require bank authentication on risky payments or on everything above a threshold. Testers do not hold the cardholder's phone, so the challenge fails.
3. CAPTCHA and bot checks. A challenge on the payment step, or a filter that blocks headless browsers, cuts scripted volume at the door.
4. Minimum charge amount. Set a floor of $1 or $2 if your prices allow it. Testers depend on tiny amounts.
5. AVS and CVC checks. Block on a failed postal code or CVC, and turn on Radar's country mismatch checks.
6. Server-side rate limits. Cap requests per IP and per session before the call ever reaches Stripe.
7. Blocklists. Add repeat IPs, emails, and card fingerprints to Radar's block list as you find them.

How do you monitor for card testing after launch?

Set a webhook or a Sigma query that alerts when declines pass a threshold in a 10-minute window. Track the ratio of declines to successful charges, the count of distinct cards per IP, and new-customer volume that does not match your normal week.

Review the block list once a week. Attackers rotate IP addresses, so rules tied to one address go stale. Rules tied to card fingerprint velocity hold up longer.

What should you do during an active attack?

1. Block the source. Add the IP range, device fingerprint, and email domains to Radar's block list.
2. Raise friction. Turn on 3D Secure for the affected payment methods and drop your maximum charge amount for a few hours.
3. Void or refund authorizations from the attack before capture, if your flow allows it.
4. Contact Stripe support and describe the pattern. Support can adjust risk controls on your account.
5. Keep the logs. Save request logs and Stripe event IDs, because disputes can arrive weeks later.

Is card testing illegal?

Yes. Running stolen card numbers through a payment form is fraud and identity theft. In the US it falls under wire fraud and access device statutes, and it breaks Stripe's services agreement, which is why accounts tied to testing get closed.

This guide covers the defense side only: how merchants spot the attack and shut it down.

Frequently asked questions

Does Stripe charge a fee for declined card attempts?

No. Stripe does not charge for authorizations that fail. Failed attempts still count toward your fraud metrics and your decline rate, which card networks watch.

Can 3D Secure stop card testing for good?

No control stops it for good. 3D Secure removes most automated attempts because the tester cannot pass the bank challenge, but an attacker who also phished the one-time codes can still get through.

How fast does card testing start after a checkout goes live?

Hours to days for a public form. Scrapers and botnets scan for charge endpoints all day, so a new checkout with no rate limit often sees its first probe inside 24 hours.

What is the difference between card testing and carding?

Carding is the broader crime of using stolen card data to buy goods or move money. Card testing is the step that checks which numbers still work before the cash-out.

What is the fastest fix for a small Stripe store?

Turn on 3D Secure for payments above your average order value, then add one Radar rule that blocks more than five card attempts per IP per hour. That pair stops most scripted testing, and both settings take minutes to switch on in the Stripe Dashboard.