Card Testing Rules for Merchants Guide
Discover essential card testing rules for merchants in the US, crucial for want-to-buy cvv transactions.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card testing rules are the fraud controls that flag, slow, or block the small rapid transactions criminals use to check whether stolen card numbers still work. The rules set limits on velocity, order value, geography, device signals, and decline patterns, then route anything outside those limits to review or a hard decline. A tuned rule set stops most card testing before it reaches the chargeback stage.
Card testing (also called card checking) is the practice of running a list of stolen card numbers through a payment form to find the ones that still authorize. The attacker wants the yes or no from the issuer, not the merchandise. That is why test orders stay small, repeat fast, and often ship nowhere or to a drop address.
Fraud groups sell or trade the card numbers that pass. The merchant that got tested pays the gateway fees, the chargebacks, and sometimes the loss of card processing rights.
Most fraud engines group their rules into six buckets. Each bucket catches a different part of the attack pattern.
Velocity rules count how many attempts come from one source inside a set window.
One IP that tries 15 different card numbers in 10 minutes is not a shopper. That is a test run.
Test orders run tiny, because the attacker wants the smallest possible authorization. Rules that review or block orders under a floor amount, or that require a minimum cart value, cut a large share of test traffic. Pair the floor with a cap on how many low-value orders one customer can place.
These rules compare the billing country, the IP country, and the shipping country. A mismatch between all three is a common trait of test orders. Proxy and hosting-provider IP ranges deserve their own rule, since attackers rotate through them.
BIN rules read the first six to eight digits of the card. Cards from banks a merchant never sees real customers from, plus prepaid and gift BINs, push the risk score up. A BIN rule should raise a flag, not trigger a block on its own.
AVS compares the billing address to what the issuer holds. CVV checks the three or four digit code. Testers guess these values because the data they bought is incomplete, so a failed AVS plus a failed CVV on a first-time order is a strong signal.
Decline ratio rules look at the pattern across attempts rather than a single order. A card number that produces several declines followed by an approval is a classic test result. The same applies to an IP that generates a high share of do-not-honor responses.
There is no universal number, and any vendor that quotes one is guessing. The right threshold comes from your own baseline: pull 90 days of orders and see what normal looks like for your store.
As an example, a store with 200 orders a day might set a soft review at three declines from one IP in an hour and a hard block at ten. A store with 20,000 orders a day would set those limits higher, since normal traffic already produces more collisions.
Geographic rules and generic high-risk country lists catch the most real customers, especially for stores that ship worldwide. Single-signal rules cause most of the damage. "Foreign IP" alone is weak evidence.
Fix this by combining signals instead of relying on one. A foreign IP plus a first-time buyer plus a cart under two dollars plus a failed AVS is a very different picture from a foreign IP on its own. Combination rules keep the catch rate high and the false decline rate low.
Yes. A digital goods store needs strict velocity rules because delivery is instant and the loss is immediate. A store that ships physical goods has more time to review an order before it leaves the warehouse, so soft rules work better there.
It helps. 3D Secure pushes authentication back to the issuer, and most attackers cannot pass that step with a stolen number. Many merchants apply it only to risky orders so regular customers skip the extra prompt.
Rules run at authorization, so the answer returns in the same second as the payment request. Manual review that takes hours lets a test run finish long before anyone looks at the queue.
No. CAPTCHA raises the cost of automated attacks, but fraud groups solve them with scripted human labor. Treat CAPTCHA as one layer and keep the payment rules running behind it.