What Is Card Testing and How Do Velocity Checks Stop It?
Card testing is an automated attack where fraudsters push large volumes of transactions through an online checkout to find out which stolen card numbers are still valid. The individual amounts are usually tiny — sometimes just an authorisation with no capture — because the goal is not to buy anything, but to sort a stolen card list into "working" and "dead" cards that can then be used or resold.
Any publicly reachable payment form can become a target, and businesses often discover an attack only when they see thousands of declined transactions overnight. Even though most attempts decline, the attack still hurts.
Why is card testing a problem if the transactions decline?
- Fees. Authorisation attempts can carry costs even when declined, and a large attack means a large volume of attempts.
- Decline ratios. Issuers and card schemes monitor merchants with abnormally high decline rates, which can trigger scrutiny or penalties.
- Chargebacks. The small percentage of successful test transactions become fraud chargebacks when the real cardholders notice.
- Infrastructure load. Bot traffic can degrade your checkout for genuine customers.
- Downstream fraud. Cards validated on your checkout are used for larger fraud elsewhere, and your business becomes known to attackers as a useful testing ground.
What are velocity checks?
Velocity checks are rules that limit how many payment attempts are allowed within a time window, based on shared attributes. Instead of judging each transaction alone, they spot patterns across transactions, for example:
- More than a set number of attempts from the same IP address in a few minutes
- Many different card numbers used from the same device or session
- Repeated attempts on the same card number with varying details
- A spike in attempts against a single merchant account far above its normal baseline
- Many attempts sharing the same email address, delivery address or fingerprinted device
When a threshold is breached, the rule can block further attempts, add friction such as a CAPTCHA or 3D Secure challenge, or flag the traffic for review. Genuine customers rarely hit these limits, so well-tuned velocity rules stop attacks with little impact on real sales.
What other controls stop card testing?
- CAPTCHA or bot detection on the payment form, ideally triggered only when traffic looks automated so genuine customers are not inconvenienced.
- 3D Secure, which forces cardholder authentication that bots cannot complete. See 3D Secure and fraud prevention.
- Requiring CVV and running AVS checks, which raise the bar for stolen card lists that lack full details.
- Rate limiting at the API layer, so scripted attacks are throttled before they reach the payment provider. This matters especially for payment APIs and payment links that can be called without a browser.
- Disposable or single-use payment links rather than long-lived open payment pages.
- Monitoring and alerting on decline rates and attempt volumes, so an attack is spotted in minutes rather than discovered on the next invoice.
What should you do during an active attack?
- Enable or tighten velocity rules and CAPTCHA immediately — your payment provider can usually help apply emergency limits.
- Block the offending IP ranges, device fingerprints or attack patterns where identifiable.
- Review any transactions that succeeded during the attack and refund them proactively before they become chargebacks.
- Keep logs of the attack for your provider and for any scheme queries. See logging, masking and audit trails.
- Afterwards, review why the attack was possible — an unauthenticated payment endpoint or missing rate limits — and fix the gap.
Card testing is one of the clearest examples of why fraud prevention needs to be layered: no single control stops it, but velocity checks, bot detection and authentication together make your checkout an unattractive target.
Related topics
Payment Fraud
The main types of payment fraud affecting South African businesses, from stolen cards and friendly fraud to invoice scams and refund abuse.
Account Takeover
How account takeover, phishing and social engineering attacks lead to fraudulent payments, and the controls that protect customers and staff.