The top pick for card testing defense is a layered stack: edge rate limiting and bot detection in front of the checkout, plus authorization velocity rules enforced at the payment gateway. The criteria used here are detection speed, false-positive risk, integration effort, coverage of card-not-present channels, and cost per blocked attempt. Card testing rarely fails on one weakness, so a single control leaves a gap that attackers rotate around by changing IP addresses, card numbers, and email addresses between attempts.

Layer One: Edge Rate Limiting and Bot Detection

This layer sits between the attacker and your payment form. It counts requests per IP, session, device fingerprint, and checkout endpoint, then challenges or blocks traffic that looks automated. Because the block happens before an authorization request, you avoid interchange costs and decline noise on your merchant account.

  • Pros: catches high-volume sweeps early, keeps junk authorizations off your statement, and tunes easily on top of an existing CDN or web application firewall.
  • Cons: determined attackers spread attempts across residential proxies, aggressive rules can block shared corporate IPs and mobile carriers, and someone has to read the logs.

Use this layer when you sell low-ticket digital goods or anything with instant fulfillment, where a valid card can be spent before a human review happens.

Layer Two: Authorization Velocity Rules at the Gateway

Set limits on how many authorization attempts a single card, BIN range, email address, or customer ID can make inside a rolling window. Issuers see the same pattern you do and will flag your descriptor. Most gateways and fraud tools let you decline at thresholds such as three to five attempts per card per hour and per device per day.

  • Pros: works even when traffic bypasses your edge controls, limits damage from a partial card leak, and shows up in approval rate dashboards you already watch.
  • Cons: tight card-level limits can trip on legitimate retries after a typo or a soft decline, and you need processor coordination to avoid declining good customers into a spiral.

Use this when your checkout is API-driven or you store cards on file, since scripted attacks there move faster than any manual review queue.

Criterion: Signal Quality

A defense is only as good as the signals it reads. Useful ones include IP reputation and network type, device fingerprint stability, disposable email domains, a billing country that does not match the card BIN country, and the interval between page load and form submit. One mismatch proves little. Three or more at the same time is a strong predictor of a probe.

  • Pros: richer signals reduce blunt blocking and let you score risk instead of guessing.
  • Cons: each signal adds integration work, privacy review, and tuning time, and stale data creates quiet gaps.

Criterion: Authorization Tactics That Refuse the Probe

Require the card verification value on every transaction, enforce address verification, and route suspicious attempts to 3-D Secure authentication. Attackers test numbers because they want a cheap yes or no; a challenge that asks the real cardholder to authenticate removes that answer. Honeypot fields and short form timers add friction for scripts at almost no cost to shoppers.

  • Pros: shifts the verification burden to the issuer, produces clean accept and decline data, and deters repeat attempts.
  • Cons: added friction can cost conversions, and authentication is not available for every card or region.

Criterion: False Positives and Operating Cost

Every block you add has a price. Rate limits that are too tight reject loyal customers, and blanket country blocks cut off real demand. Track approval rate, decline code mix, refund rate, and chargeback ratio side by side so you can see whether a rule is stopping attacks or just stopping sales. Card network monitoring programs exist for merchants whose fraud and dispute ratios stay elevated, and enrollment there is expensive in fees and time.

  • Pros: honest measurement keeps rules defensible and protects revenue.
  • Cons: monitoring takes engineering hours, and the right thresholds shift with seasonality and product mix.

Containment Playbook for an Active Attack

  1. Confirm the pattern: many small authorizations, low average ticket, high decline rate, and a narrow time window.
  2. Raise velocity limits to block mode for cards and devices, not for entire regions.
  3. Enable or tighten CAPTCHA on the checkout path and the account creation path.
  4. Require authentication for any order that trips two or more risk signals.
  5. Alert your processor and, if volume is high, your acquirer so they expect the decline spike.
  6. Review the rules after 48 hours and relax anything that blocked known customers.

For most small merchants, the edge layer plus gateway limits covers the common sweep. High-volume sellers with instant delivery should add authentication and a dedicated fraud scoring service, because a blocked probe that turns into a fulfilled order costs far more than the rule that prevented it.