In this article
You open your store’s dashboard in the morning and find dozens, sometimes hundreds, of orders you don’t recognize. Most are for a dollar or two. The names are gibberish, the emails look random, and your payment processor shows a long run of declines. Nobody is buying anything. Someone is using your checkout to find out which stolen card numbers still work.
That’s card testing, and it’s one of the most common attacks on small online stores. It’s fixable, and the fix starts the moment you recognize it.
What is a card testing attack?
Card testing is when criminals run stolen card numbers through a real store’s checkout to see which ones are still active. Stripe describes it as checking whether stolen cards work, often through small payments or by saving cards to an account. Small stores get picked because their checkouts are often easy to automate and nobody is watching them overnight.
How do I know it’s happening?
The signs usually show up together:
- a sudden spike in failed or declined payments, often with generic decline reasons
- a burst of very small orders or authorizations, sometimes on your cheapest product
- customer names and emails that are clearly made up
- many attempts arriving minutes apart, frequently in the middle of the night
- new customer accounts or saved cards you can’t explain
One odd order is fraud. Fifty in an hour is card testing.
How do I stop a card testing attack right now?
Put a bot check on checkout, slow down repeated attempts, and refund the charges that went through. Then close the easy openings that made your store attractive. The specifics depend on your platform.
On WooCommerce, WooCommerce’s own guidance is to:
- add a CAPTCHA such as Cloudflare Turnstile or reCAPTCHA to the checkout
- make sure no product can be bought for nothing
- turn off saved cards temporarily while the attack lasts
- consider requiring customers to create an account before checking out
With Stripe, whatever your platform, Stripe recommends:
- using its Payment Element or Checkout rather than a custom card form
- verifying CAPTCHA results on your server as well as in the browser
- rate limits on payment attempts
- Radar rules that block high-velocity attempts and failed security code checks
On Shopify, report it to Shopify Support and your payment provider right away. Shopify runs the checkout, so most of the defenses sit on its side, but it needs to know an attack is underway.
Why should I refund the charges that went through?
Because the real cardholders will dispute them. Stripe advises refunding fraudulent card-testing charges quickly. A refund now is cheaper than a pile of chargebacks later, each with its own fee, and a high dispute rate can put your payment account at risk.
Don’t ship anything from these orders, and don’t email the “customers.” The addresses are usually fake or belong to the victims.
How do I keep it from coming back?
Card testers move on when a store stops being easy. Keep the checkout CAPTCHA in place permanently, set a sensible minimum on order totals if your products allow it, and keep your payment plugin and platform updated. Turn on alerts from your processor for spikes in declines, so you hear about the next wave in minutes instead of the next morning.
If your store kept getting hit even after these fixes, look harder at the checkout itself. An outdated payment plugin or a custom checkout endpoint can leave a door open. Our WooCommerce security checklist covers what to look for.
A note for Tampa Bay stores
Card testing doesn’t care how big you are. A Tampa Bay boutique or coffee roaster with a few hundred online orders a month is a perfectly good target, and often a better one than a big retailer with a fraud team. The good news is that the same few defenses work at any size.
Need help?
If you’re in the middle of an attack, call 813-531-9400 or use our emergency support page and we’ll help you shut it down. Once things are calm, our website security audit reviews your checkout setup, payment plugins, bot protection and alerts so it doesn’t happen again.
Common questions
Did the criminals get my customers’ card details? Card testing uses cards that were stolen somewhere else. It doesn’t mean your store leaked anything. If you see signs of a skimmer on your checkout, that’s a different problem, and our hacked website repair page covers it.
Will my payment processor shut down my account? Processors watch decline and dispute rates. Acting fast, adding protections and refunding fraudulent charges shows them you’re handling it.
Why did they pick my store? Usually because its checkout was easy to automate: no CAPTCHA, no rate limits and cheap products. It’s rarely personal.