Short answer
Card testing leaves evidence at five detection points: session and device data, checkout velocity, authorization response codes, cart and order value patterns, and post-authorization behavior such as refunds and disputes. Watch those five points together. One signal firing is noise. Three or more firing on the same account, card range, or IP range is an attack.
Before you start
- Access to raw authorization logs with response codes and timestamps
- Ability to filter by IP, device fingerprint, email domain, BIN, and cardholder name
- Velocity rules you can edit without a code deployment
- A named contact at your payment processor for fraud escalation
What card testing looks like
An attacker holds a list of stolen card numbers and needs to know which ones still work. They push small transactions through your checkout, often a few cents to a few dollars, and read the authorization response. Approved numbers get kept. Declined numbers get dropped. Your gateway bills you for each attempt and your processor tracks your decline ratio, so the attack costs money even when no fraudulent order is ever fulfilled.
The footprint is wide and shallow: many attempts, many cards, few completed purchases.
Detection points by layer
1. Session and device layer
- One device fingerprint hitting the payment page dozens of times in minutes
- Many distinct cards entered from one IP, or one card entered from many IPs
- Missing or spoofed browser headers and headless browser user agents
- Email addresses on disposable domains or long random strings
- Sessions that move straight to the payment page with no product browsing
2. Checkout velocity layer
- Attempts per minute per IP, per device, per account, and per BIN
- Repeated address verification failures from the same session
- One cardholder name paired with several card numbers in short succession
- Attempt rates that ignore normal business hours for your customer base
3. Authorization layer
- Decline ratio climbing, especially on do-not-honor and pick-up-card responses
- Dense clusters of attempts inside the same BIN range
- CVV and AVS mismatch rates above your baseline
- Many small authorizations that never move to capture
4. Order and cart layer
- Average order value far below your normal range
- Digital goods, gift cards, or other items delivered the moment payment clears
- Carts built in seconds with no product page views
- Billing and shipping details that do not match across attempts
5. Post-authorization layer
- Chargebacks filed weeks later on small transactions
- Refund requests with no prior support contact
- Accounts that sign up, buy once, and never return
How to build the monitoring
- Export authorization logs for the last 90 days with response code, IP, device ID, amount, and timestamp.
- Calculate your baseline decline rate and average order value for each hour of the day.
- Set an alert threshold at three times baseline for attempts per IP per ten minutes.
- Add a second rule for attempts per BIN per hour.
- Route anything above threshold to a review queue instead of blocking it outright.
- Log every blocked attempt along with the rule that caught it.
- Review the queue daily for two weeks and tune the thresholds against real traffic.
Response steps when an attack is live
- Turn on CAPTCHA or a similar challenge at the payment step.
- Block the offending IP ranges and device fingerprints at the edge.
- Raise the minimum order amount so sub-dollar attempts fail before authorization.
- Require CVV and full AVS on every transaction.
- Notify your payment processor and send them the BIN ranges and timestamps.
- Void or refund any test transactions that were captured.
- Keep the challenge in place for at least 72 hours after the last attempt.
Common mistakes
Merchants often block on a single signal, such as a high decline rate, and cut off legitimate customers with thin credit files. Others watch only completed orders and never look at authorization attempts, which is where the attack actually lives. Set your review queue to flag, not to block, until you have two weeks of tuned thresholds behind you.