A Stripe card testing attack is an automated attempt to push many card numbers through a Stripe payment form or API to find out which ones are live. The attacker submits small charges, reads the decline or approval code that comes back, and keeps the cards that approve. Merchants stop it with Stripe Radar rules, velocity limits, CAPTCHA on checkout, CVC and postal code checks, and 3D Secure on risky payments.
How does card testing work on Stripe?
Stripe sends each authorization request to the card network and returns an outcome code to the requester. A script can read those codes and sort a list of numbers into valid and dead. Because each request looks like an ordinary checkout, the pattern only becomes visible when volume or failure rates jump.
What are the warning signs in the Stripe Dashboard?
- A sharp rise in failed payments with codes such as incorrect_number, incorrect_cvc, or generic_decline.
- Many charges for the same small amount, often under one dollar.
- High request volume from a narrow set of IP addresses, devices, or countries.
- Card numbers that fail once and never appear again.
- Payment Intents with no matching customer record or order detail.
Why does card testing hurt a merchant?
Every authorization attempt carries a cost, and approved charges that the real cardholder disputes turn into chargebacks plus dispute fees. Card networks track excessive fraud and dispute ratios through monitoring programs, and a sustained attack can put a merchant account at risk. Small businesses often absorb the loss because the fraud is spread across many tiny transactions.
How do you stop a Stripe card testing attack?
- Turn on Stripe Radar and add rules that block high-risk patterns before the charge is authorized.
- Require CVC and postal code verification on every payment.
- Add a CAPTCHA or bot challenge to the checkout page.
- Set velocity limits per card, per IP address, per email, and per device.
- Apply 3D Secure to payments that score as elevated risk.
- Disable payment methods and currencies you do not actually use.
- Enforce a minimum charge amount on your checkout form.
Which Stripe Radar rules help the most?
Useful rules block on risk score thresholds, card country mismatches, repeated failed attempts from one source, and custom lists of blocked IPs or card fingerprints. Run new rules in log-only mode first so you can measure false positives before you enforce them. Review the results weekly, because attack patterns shift quickly.
What should you do after an attack?
Void or refund fraudulent charges, review the Radar logs to find the entry point, and tighten the rules that let the traffic through. If you suspect your API keys or checkout form were compromised, rotate the keys and redeploy. Report the incident to Stripe support and keep records of the timeline.
Frequently asked questions
Does Stripe block card testing automatically?
Stripe Radar applies default protections and machine learning models to all accounts, and it can flag or block suspicious traffic. Default coverage is not complete, so merchants still need custom rules and checkout controls tuned to their own traffic.
Is card testing illegal?
Yes. Card testing relies on stolen or unauthorized card numbers, which makes it payment fraud and identity theft under US federal law. Merchants and processors report these incidents to law enforcement and the card networks.
Can card testing happen on a small store?
Any public checkout form is a target, regardless of store size. Automated tools scan the web for payment pages, so a low-volume shop can see a burst of attempts overnight.