Stop card testing on your checkout

How to do it

Card testers send thousands of small payments to find cards that work. Each decline costs a fee and hurts your standing with the networks. Allow a few attempts, such as 5 an hour per account, 20 per IP address and 3 per card fingerprint. After 3 declines in a session, require a CAPTCHA or sign-in. Turn on the provider's card testing protection. The general method is in limit requests and free tier abuse.

Example

const LIMITS = [
  { key: req => `pay:acct:${req.accountId}`, max: 5, windowSeconds: 3600 },
  { key: req => `pay:ip:${req.ip}`, max: 20, windowSeconds: 3600 },
  { key: req => `pay:card:${req.cardFingerprint}`, max: 3, windowSeconds: 3600 },
]

async function allowPaymentAttempt(req) {
  for (const limit of LIMITS) {
    const count = await redis.incr(limit.key(req))
    if (count === 1) await redis.expire(limit.key(req), limit.windowSeconds)
    if (count > limit.max) return false
  }
  return true
}

LIMITS = [
    (lambda req: f"pay:acct:{req.account_id}", 5, 3600),
    (lambda req: f"pay:ip:{req.ip}", 20, 3600),
    (lambda req: f"pay:card:{req.card_fingerprint}", 3, 3600),
]

def allow_payment_attempt(req) -> bool:
    for key_of, max_attempts, window_seconds in LIMITS:
        key = key_of(req)
        count = redis.incr(key)
        if count == 1:
            redis.expire(key, window_seconds)
        if count > max_attempts:
            return False
    return True

How to check

A script sends 30 payments with a declining test card from one IP address within a minute. After the limit, your server answers 429, and the provider receives no further attempts.