One of the most common threats to online stores is the card attack, also known as card testing or carding. Even small shops are targeted, and bots don’t discriminate. In fact, it seems like small shops may get targeted more often, because the assumption is that they’ll have limited knowledge and resources to deal with issues.
Many of my clients have already been through the pain of these attacks, but I’d like to share a little more about them for everyone!
What Is a Card Attack?
A card attack happens when criminals use lists of stolen credit card numbers and test them on your checkout to see which ones still work. They’re not trying to buy anything meaningful from you — your store is simply a convenient, automated testing ground.
If a card successfully passes your payment gateway’s “is this valid?” checks, the attacker now knows that card is still “alive,” and they’ll use it later for larger fraudulent purchases elsewhere.
How Card Attacks Work
Card attacks are usually automated. Bots send hundreds or thousands of transactions through your checkout in a short window of time.
Depending on your payment processor, this may look like:
- Repeated failed payments
- Many $1.00 or $0.01 attempts (or the lowest-priced products available)
- A rush of declined orders, often with mismatched names and billing addresses
- Rapid-fire attempts from the same IP address, VPN ranges, or foreign proxies
- Attempts that appear normal but never complete the checkout
These bots run 24/7 and target stores — especially ones without added security layers.
Why Attackers Do It
The goal is not to steal from your store. The goal is to verify stolen credit cards.
If they find a card that:
- Isn’t expired
- Has a valid CVV
- Gets past the gateway
- Looks like a normal small purchase
…then they mark it as “good” and sell it, or use it for a larger purchase somewhere else.
You never see that follow-up fraud, but you’re left with:
- Fee charges from your payment processor
- Possible rate hikes (Stripe is especially strict)
- Risk of being flagged as high-risk
- Higher dispute/chargeback potential
- A degraded checkout experience for legitimate customers
During the holidays, testing volume may spike because criminals expect fresh stolen card data.
What to Watch For
If you operate an online store — especially WooCommerce — keep an eye out for these red flags:
- A sudden surge in failed transactions 99% declines? That’s not normal.
- Orders with strange formatting Random names, junk email addresses, mismatched zip codes.
- Many attempts for very small dollar amounts $1.00, $2.00, $5.00 test purchases. Sometimes, they’ll start with a slightly larger attempt – say $30 – then work their way down to see if they have more success.
- Stripe or payment processor warnings Stripe often flags high failure rates or unusual activity.
- Unusual checkout behavior Attempts using alternate gateways, unusual currencies, or rapid retries.
- CPU or server spikes Bots hammering checkout pages can create performance drops.
How to Reduce Card Attacks
The main defenses against card attacks are to:
- Enable CAPTCHA at checkout (Cloudflare Turnstile or Google reCAPTCHA v3)
- Enable “3D Secure / SCA” where supported – although I rarely see this as an option that processors offer, at least in the USA.
- Limit failed payment attempts with plugins or gateway settings
- Block high-risk IP ranges or countries (Cloudflare, Wordfence) – but the “competent” hackers constantly jump IP addresses.
- Use Stripe’s “Radar” rules (even the free ones help)
- Avoid offering multiple gateways unnecessarily
All of these dramatically reduce bot activity, and most are free.
Bottom Line
Card attacks aren’t personal, and you don’t have to be a big brand to get targeted. Bots love smaller sites because they often have fewer protections in place. Holiday traffic also gives attackers cover — it’s harder to notice anomalies when real customers are also active.
If you have any issues, I can take a look to see if more can be done. Sometimes, the only choice is to wait these attacks out, since they don’t “look” any different than any other purchase, at least to the site’s software.