How do I recognise a card-testing attack?

Look for shape, not just volume. Common signs include many small authorisation attempts, a sudden rise in declines, repeated failures tied to related devices or networks, many new accounts, and changing customer details across similar attempts. Normal decline noise is usually more varied; card testing often has clustered timing, values, sources or checkout paths.

Why not block every suspicious payment?

Because suspicious is not the same as fraudulent. Every rule has false positives, and those can mean lost orders, angry customers and extra support load. A stricter rule is justified only when the expected reduction in fraud, disputes and operational cost is worth more than the legitimate business it blocks or slows down.

What is a risk threshold?

A risk threshold is the point at which your system changes treatment for a payment attempt. Below it, the transaction may be allowed; above it, you might add friction, send it to review or block it. The threshold should be chosen using business impact, not a vague desire to be maximally safe.

Fraud, Card Testing & Risk Rules

Fraud, card testing and risk rules are the payment controls used to identify suspicious checkout attempts, especially attackers probing stolen cards, and decide whether to allow, block, review or add friction. They work by scoring signals such as decline patterns, velocity, identity details, device data and transaction value against business risk.

Card testing exists because a checkout can become a validation oracle for stolen payment details. An attacker does not need to buy anything valuable; they need to learn which cards authorise. The symptoms are often operational rather than dramatic: bursts of low-value attempts, unusual decline spikes, many newly created accounts, repeated failures from related sources, or changing names, emails, devices and billing data around otherwise similar transactions.

Risk rules turn those observations into actions. A payment attempt is evaluated against signals such as how quickly similar attempts are arriving, whether the card, account, IP, device or email has been seen before, and whether the details look internally consistent. Rules can block outright, allow, send to manual review, or add step-up friction such as CAPTCHA or extra verification. In practice, these rules are layered rather than relying on a single clue.

The tradeoff is that fraud prevention is a classifier with costs on both sides. Loose rules let more abuse through, causing disputes, refunds, support work, processor attention and possible account limits. Strict rules catch more attackers but also reject or inconvenience real buyers. Travellers, new customers, VPN users, shared households, gift-card users and unusual devices can all look risky. The honest threshold answer is: it depends on fraud loss, margin, support cost and tolerance for false positives.

Engineers meet this in checkout dashboards, payment processor settings, dispute workflows, alerting and incident response. A useful investigation separates normal decline noise from coordinated probing by grouping attempts across time, card fingerprints, accounts, devices, networks and order values. A useful rule proposal states what it will stop, which legitimate customers it may affect, how it will be monitored, and when it should be relaxed, tightened or replaced.

Go deeper

PaymentsFraud, Card Testing & Risk RulesRecognise a card-testing attack running against your own checkout, and set a risk threshold knowing what it costs you in real customers.Open the lesson

Common questions

How do I recognise a card-testing attack?: Look for shape, not just volume. Common signs include many small authorisation attempts, a sudden rise in declines, repeated failures tied to related devices or networks, many new accounts, and changing customer details across similar attempts. Normal decline noise is usually more varied; card testing often has clustered timing, values, sources or checkout paths.
Why not block every suspicious payment?: Because suspicious is not the same as fraudulent. Every rule has false positives, and those can mean lost orders, angry customers and extra support load. A stricter rule is justified only when the expected reduction in fraud, disputes and operational cost is worth more than the legitimate business it blocks or slows down.
What is a risk threshold?: A risk threshold is the point at which your system changes treatment for a payment attempt. Below it, the transaction may be allowed; above it, you might add friction, send it to review or block it. The threshold should be chosen using business impact, not a vague desire to be maximally safe.

Every term