06.03 · Concept
Fraud, Card Testing & Risk Rules
Recognise a card-testing attack running against your own checkout, and set a risk threshold knowing what it costs you in real customers.
Card testing shows up as abnormal checkout behaviour: bursts of small payment attempts, elevated declines, repeated retries, and shifting identity or device signals. Risk rules should be treated as cost-sensitive classifiers, not moral judgements, because every tighter control also blocks or slows some genuine buyers.
What this lesson answers
- how to detect card testing in checkout metrics
- when should a payment risk rule block customers
- how to balance fraud prevention against false positives
Notes
Card testing is when an attacker uses your checkout to discover which stolen card numbers still work. They usually run many small, fast payment attempts, often with changing names, emails, IPs, devices, or billing details. To your system it may look like a sudden spike in declined payments, tiny authorizations, repeated failures per customer or IP, or many new accounts attempting low-value purchases.
The useful mental model is that fraud prevention is a classifier with business costs on both sides. If you let too much through, you pay dispute fees, refunds, operational time, processor…
References
Common questions
- What does a card-testing attack look like in production?
- It often looks like a sharp rise in declined payments, many low-value authorisations, repeated attempts from related accounts or addresses, and inconsistent customer details across attempts. The key signal is not one bad payment, but a pattern of fast retries that differs from normal checkout failure behaviour.
- Should risk rules block every suspicious payment?
- No. A strict block rule can reduce fraud while also rejecting legitimate customers, especially people with unusual travel, devices, networks, or billing patterns. A better approach is to map risk levels to actions: allow, add friction, request extra checks, queue for review, or block.
- How do I justify a fraud threshold to the business?
- Explain the threshold as a tradeoff between expected fraud losses and the cost of false positives. Include the bad attempts it is likely to stop, the real customers it may slow or reject, and the operational burden it adds. The right threshold is an economic decision, not a purity test.
Short definition: what is Fraud, Card Testing & Risk Rules?