Stolen card numbers are validated in small or zero-value transactions. You pay for every attempt — in gateway fees, in chargebacks, and eventually in your merchant risk rating.
Card testing is the most expensive attack in this set because the cost is per-attempt and it lands on your payment account rather than your bandwidth. It is also easy to catch early: a real customer and a card-testing script are doing visibly different things on your checkout, and the difference is in the client and the cadence, not in the card. Blocking before the authorisation request is the only point where the attack costs you nothing, because once the request reaches the gateway the fee is incurred whether the card is valid or not.
php (pre-authorisation hook)
Full endpoint reference and an interactive tester are in the API docs. Get a key from the free tier — no card required.
Charged per failed authorisation. A burst of a few thousand attempts is a real invoice before you have noticed anything is happening.
Every successful test charges a real cardholder, and each dispute carries its own fee and count toward your risk rating.
Sustained card testing is grounds for a payment processor to place reserves on your account or drop you. This is the one that threatens the business.
Test orders that pass enter your fulfilment queue and have to be found and cancelled by hand.
Partly. A high rate of declines from one IP is visible after the fact, which is exactly the problem — the attempts have already cost you money. Scoring before the authorisation is the only point where they are free.
No. The API takes an IP, a domain and a User-Agent and returns a verdict. Nothing in this call touches a card number, and it should stay that way.
That is the costliest false positive there is, so a checkout block should always offer a way through — a support message, not a dead end. Check the blocked list weekly; genuine customers appear there, and whitelisting them is a normal part of running this.
Free tier, real verdicts, and documentation with a built-in tester.
Get started free →