Stripe Card Testing Attack: Signs, Costs, and How to Stop It

A Stripe card testing attack is a burst of low-value payment attempts run through a merchant's Stripe checkout or API to find stolen card numbers that still work. Attackers pick Stripe-powered stores because a $1 authorization returns a clear approval or decline from a live processor. Merchants absorb the cost through dispute fees, network monitoring programs, and account freezes.

What does card testing look like in your Stripe dashboard?

Card testing shows up as volume, not size. You see hundreds of small charges on cards you have never seen before, often within minutes.

Common signals:

• Many declines plus a few approvals from the same IP address or device
• Order totals under $5, sometimes $0.00 to $1.00
• Emails from disposable domains, or a pattern like [email protected]
• A billing country that does not match the card's issuing country
• Card numbers that share the same first six digits (a BIN attack)
• Attempts arriving at a steady rate, around the clock

Why do attackers choose Stripe?

Stripe's API accepts card data with a single server-side request and returns specific decline codes. That feedback loop tells an attacker whether a card is live, dead, or needs another check.

Stripe also powers millions of small shops that never turn on fraud tools. A store with default settings and no rate limits is an open door.

How much does a card testing attack cost a merchant?

Each attempt costs the merchant an authorization fee, and each fraudulent charge adds a chargeback fee on top. Stripe's standard pricing is $0.30 per successful charge plus processing, and disputes run $15 each.

The larger cost sits with the card networks. Visa and Mastercard track fraud and dispute ratios, and a store that crosses a threshold lands in a monitoring program with per-transaction fines.

Stripe can hold funds, demand a reserve, or close the account. Recovery takes weeks.

How do you detect card testing on Stripe?

Watch your authorization rate

A sudden drop in approval rate, paired with a spike in traffic, points to testing. Real customers do not try ten cards in one session.

Query your Stripe data

Stripe Sigma and the Dashboard let you group charges by IP, email, card fingerprint, and BIN. Look for one email tied to many cards, or one IP tied to many declines.

Set alerts instead of waiting for statements

Webhook alerts on failed charges and Radar flags give you minutes instead of days. Most attacks end before a monthly report arrives.

How do you stop a card testing attack on Stripe?

1. Turn on Radar and add rules for CVC and AVS mismatch. Block when the postal code or CVC fails.
2. Require 3D Secure for risky charges. Authentication moves liability to the issuer and kills most automated testing.
3. Set a minimum order amount. Testing economics fall apart when the smallest charge is $5.
4. Rate limit by IP, device, email, and card fingerprint. Ten attempts per hour is generous for a real shopper.
5. Add a CAPTCHA or bot check to checkout. A script that solves CAPTCHAs at scale costs real money to run.
6. Block disposable email domains and known proxy ranges.
7. Add the offending IPs and BINs to Stripe's block list.
8. Contact Stripe support the same day. Fast reports limit fines and protect your account standing.

What should you do in the first hour of an attack?

Stop the bleeding first, then document. Every minute of open checkout adds authorization fees and dispute risk.

• Void or refund any unsettled fraudulent charge and cancel the orders.
• Turn on 3D Secure for the affected card brands.
• Block the attacking IPs, BINs, and email domains.
• Save the charge IDs, timestamps, and decline codes for your Stripe support ticket.
• Check whether any customer data or API keys were exposed, and rotate keys if needed.

Which Stripe settings matter most?

Radar is the core tool. The free tier catches common patterns, while Radar for Fraud Teams adds custom rules, review queues, and risk scores you can tune.

Stripe Checkout and Payment Links support 3D Secure settings you can adjust without writing code. For custom builds, the Payment Intents API exposes the same controls.

Does 3D Secure end card testing?

It stops most of it. Automated scripts cannot pass an issuer challenge, so tested cards fail before a charge settles.

Some attackers move to cards already enrolled in low-friction authentication flows. 3DS raises the cost, but it is one layer, not a full fix.

Frequently asked questions

What is a typical card testing charge amount?

Most attempts fall between $0.50 and $3. Attackers want the smallest amount that still triggers a real authorization.

Can card testing get a Stripe account closed?

Yes. Stripe reviews accounts with high unauthorized charge and dispute rates, and it can hold funds or terminate the account.

How fast can an attack run?

Hundreds of attempts per minute from a single script, sometimes spread across thousands of IP addresses. Speed is the point, because the window before detection is short.

Is card testing illegal?

Yes. Using payment credentials without the cardholder's permission is fraud in the US and most other countries, and it violates card network rules.

What if the charges are only authorizations, not captures?

You still pay authorization costs, and the issuer sees the attempts. Void the authorizations and report the activity to Stripe either way.