Short answer
Card testing is a series of low-value authorization attempts used to find valid card numbers. Defense uses layered controls: gateway velocity rules, per-IP and per-card rate limits, strict AVS and CVV checks, device fingerprinting, and a block on repeated declines. Each control raises the attacker's cost. No single control works alone.
What card testing looks like in logs
- Many authorizations in a short window from one IP or one device.
- Amounts near 0 to 3 USD.
- Card numbers that share a BIN range.
- High decline rates followed by a single approval.
- New accounts with mismatched billing data.
Controls to deploy
1. Gateway velocity rules
Set limits on authorization attempts per card, per IP, per device, and per customer ID. A common starting point is 3 attempts per card in 10 minutes and 10 attempts per IP in 1 hour. Tune the limits from your own decline data.
Best Defense Strategies for Card Testing
2. AVS and CVV checks that fail closed
Reject a transaction when the CVV check fails or the AVS result does not match the billing country. Do not retry a failed CVV on the same card. A retry is a free test for the attacker.
3. Device and session signals
Log device fingerprint, user agent, and TLS fingerprint. Block a device after 5 declines in 24 hours. Flag sessions where the billing address changes between attempts.
The Ultimate Guide to Card Testing Defense
4. 3-D Secure
Apply 3-D Secure to new accounts and to transactions below 5 USD. Exemptions cut friction, but an exemption on a small amount opens the test path.
5. Decline code review
Watch for issuer response codes that signal a test: stolen card, pick-up card, invalid account. Route these to a review queue. Do not send a receipt email on a failed authorization.
Metrics
Track authorization attempt rate per IP, decline rate by BIN, and the share of approvals under 3 USD from accounts younger than 7 days. A rise in small approvals from new accounts is a signal.
Limits
Rate limits cut automated tests. They do not stop a distributed test from many IPs. Pair limits with device identity and issuer checks. Card testing defense is a cost game. The goal is to make each test attempt cost more than the attacker gains.