A card testing bot is an automated script that submits a large number of card numbers to a payment form to learn which ones still authorize. The bot sends a small charge, reads the approval or decline response, and saves the cards that approve. Those validated numbers get sold or reused. From the merchant side, the visible result is a burst of tiny transactions, a spike in declines, and fees from the card networks.
Signs your checkout is being tested
- Hundreds of authorization attempts within minutes from a small set of IP addresses
- Many different card numbers sharing one cardholder name or email pattern
- Order values clustered at the minimum, often under a few dollars
- A high decline rate with a thin mix of approvals
- Billing details that fail address verification or CVV checks
How to stop card testing bots
Prerequisites: access to your payment gateway logs, permission to edit checkout rules, and a fraud tool or rules engine that supports custom conditions.
- Pull the last 24 hours of authorization logs and sort them by IP address, card BIN, and amount.
- Block the IP addresses and IP ranges that produced the largest share of declines.
- Switch on velocity limits so one IP, email, or card BIN can only attempt a set number of charges per hour.
- Add a CAPTCHA or bot challenge to the payment step, not just the login page.
- Require CVV and address verification for every order, and auto-void any order that fails both.
- Set a minimum order value, or hold low-value orders for manual review.
- Configure alerts that fire when declines from one IP cross a threshold you choose.
After the burst
Void or refund any approved test charges before settlement so you avoid chargebacks. Report the activity to your acquirer and payment processor, since they track fraud patterns across merchants. Review the blocked list once a week, because attackers rotate through new IP ranges. If test charges settled, expect disputes within the next few months and keep the log evidence on file.