Understanding Card Testing
Card testing (also called card checking or carding) is when criminals use automated tools to make small purchases on your store to verify that stolen credit card numbers are still valid and have available funds.
Once verified, the working cards are used for larger fraudulent purchases elsewhere or sold on dark web markets. Your store serves as the testing ground, and you're left with chargebacks even on the small test transactions.
Why Card Testing Matters for Shopify Stores
Card testing attacks can result in hundreds of small chargebacks, damaging your chargeback ratio and potentially triggering payment processor penalties. Blocking bot traffic and VPNs reduces your exposure to automated card testing.
How SecurEcommerce Helps with Card Testing
IP Blocking
Block malicious traffic by IP address, range, country, region, or ISP
- • Individual IP address blocking
- • IP range (CIDR notation) blocking
- • Country-level blocking with bulk selection
VPN & Proxy Blocking
Detect and block visitors using VPNs, proxies, and anonymizing services
- • VPN detection via ProxyCheck.io integration
- • Proxy server detection
- • Provider identification (NordVPN, ExpressVPN, etc.)
Frequently Asked Questions
Frequently Asked Questions
How do I know if my store is being used for card testing?
Signs include many small-value orders in quick succession, orders from the same IP or device, multiple failed payment attempts, and orders with different cards but the same shipping address.
How can I prevent card testing?
Block VPN and proxy traffic, implement rate limiting on checkout, require CAPTCHA for suspicious activity, block datacenter IPs, and set minimum order amounts.
Related Terms
Bot
Security ConceptsAn automated software program that performs tasks on the internet, often used for purchasing, scraping, or attacks.
Credential Stuffing
Security ConceptsAn automated attack that uses stolen username/password combinations to attempt logins across multiple sites.
Chargeback Fraud
Ecommerce SecurityWhen a customer disputes a legitimate charge with their bank to receive a refund while keeping the purchased product.
Related Security Threats
Bot Attacks: Automated Threats to Your Shopify Store
Bots scrape your content, abuse promotions, and drain inventory. Learn how automated attacks work and how to stop them.
Credential Stuffing: Automated Account Takeover
Attackers use stolen passwords to access customer accounts. Learn how credential stuffing works and how to protect your store.