Choose from any of our gift cards to give to your loved ones
Card Validation Attack Defense: How to Stop Card Testing
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Layered velocity controls combined with address verification (AVS) and CVV checks at the authorization step is the top pick for stopping card validation attacks. It wins on the criteria that matter most to a card-not-present merchant: how fast it catches a burst of test transactions, how few legitimate customers it turns away, how much engineering work it takes to switch on, and whether it still holds up as order volume grows.
A card validation attack, sometimes called card testing or card enumeration, is a flood of small authorization attempts run against a payment page to find out which card numbers are live. The attacker is not trying to buy anything. They are checking whether a stolen number, expiry date, and security code will return an approval.
Common signals in your own data:
These patterns matter because a successful validation run makes your store a target for chargebacks later, and card networks can place your merchant account under monitoring if the volume is high enough.
This is the first control to turn on because it sits inside the authorization flow you already have. You set limits on how many attempts a single card, email, IP, or device can make in a rolling window, and you require a matching AVS or CVV response before the order proceeds.
Use it when: you are a small or mid-size card-not-present merchant without a dedicated fraud team, and you need coverage this week rather than next quarter.
Bot management tools score the client before the request reaches your payment form, looking at automation signals, headless browsers, and request timing.
Use it when: your logs show repeated attempts from automated clients, or you already see high traffic on login and signup flows.
3-D Secure shifts liability for fraud chargebacks to the issuing bank when authentication succeeds, and it makes bulk testing expensive for the attacker because each attempt needs the cardholder.
Use it when: you sell higher-ticket goods, ship internationally, or your chargeback ratio is already under scrutiny.
Card networks and processors publish their own fraud intelligence and risk scoring, often bundled with your merchant account. These scores combine data across many merchants, which single-store rules cannot see.
Use it when: you process meaningful volume and want a second opinion layered on top of your own rules.
Score each control on four things: time to detect a validation burst, false decline rate measured against your own approval data, setup cost in engineering hours, and how well it holds when attackers change tactics. Most merchants end up with velocity rules as the base, a bot layer for automated traffic, and 3-D Secure or a network risk score for high-value orders.
