What is a card testing alert v6?

A card testing alert v6 is a fraud notification that fires when your payment page sees a burst of low-value authorization attempts across many card numbers. The "v6" tag marks the sixth revision of the detection rule set behind the alert, which blends velocity checks, BIN spread, and decline-rate thresholds. The alert points to someone probing stolen card data. It does not mean your checkout has been hacked.

Which signals push the rule past its threshold?

The v6 rule set scores each session against several signals. A single signal seldom trips it. The combination is what matters.

• Authorization velocity: dozens of attempts from one IP, device, or session in a short window.
• Amount clustering: charges of $0.00 to $1.00, or repeated random small amounts.
• Decline ratio: a high share of "do not honor" and "invalid card number" responses.
• BIN spread: many card numbers from different banks on one device or IP.
• Sequence patterns: card numbers that increment or share a prefix.
• Geo mismatch: IP country, billing country, and card BIN country that disagree.
• Reused data: the same email, phone, or shipping address with changing card details.

How is card testing different from normal failed payments?

Real shoppers fail a payment for a reason: a typo, an expired card, a bank block. They retry once or twice, then leave or call. Card testing looks different in shape and volume.

• One visitor, many cards. A shopper uses one or two cards, not forty.
• Tiny amounts. Testers pick the smallest allowed charge to keep losses low.
• Speed. Attempts land in seconds, often through scripted requests.
• No cart. The order total matches the minimum, or the cart is empty.

What should you do in the first 30 minutes?

1. Confirm the pattern in gateway logs. Pull the last hour of authorizations and group them by IP, device ID, and BIN.
2. Check the decline code mix. A run of "invalid card" or "do not honor" on small amounts is the classic signature.
3. Pull the ASN behind the IP. Cloud hosting and VPN ranges almost never belong to real customers.
4. Pick a containment response: block, challenge, or watch. Block ranges with no order history. Challenge everything else.
5. Write the timestamp and rule ID into the ticket so the next shift can trace the event.

How do you contain it without killing sales?

Hard blocks on a whole country or payment method cost real revenue. Use the narrowest control that stops the traffic.

• Rate-limit the authorization endpoint per IP and per session.
• Turn on CAPTCHA or a JS challenge for sessions that fail the velocity test.
• Require CVV and AVS match on any order below $2.
• Force 3-D Secure step-up on the flagged traffic.
• Block cloud provider ASNs and known proxy ranges at the edge.
• Flag disposable email domains and block them at checkout.

Which thresholds should rule v6 start with?

Exact numbers depend on your processor and traffic mix. These are starting points to tune, not fixed law.

• More than 10 authorization attempts per minute from one IP.
• More than 5 distinct card numbers per device in an hour.
• Decline rate above 60% on a low-value amount band.
• More than 3 BIN countries on one session.
• Order total under $1 with a new account.

Run any new threshold in log-only mode for a week before you enforce it. Compare the hits against your order data to see how many are real customers.

What belongs in the alert ticket?

A short, factual record beats a long narrative. The next analyst needs the numbers, not a story.

• Alert name, rule version (v6), and the timestamp.
• Attempt count, decline ratio, and the amount band.
• Top IPs, ASNs, and device IDs involved.
• Any confirmed losses or chargebacks tied to the window.
• The action taken (block, challenge, or monitor) and its end time.

What mistakes should you avoid?

• Dismissing the alert because each charge is small. Fees and scheme penalties add up fast.
• Blocking a whole country when three IP ranges caused the event.
• Turning off the payment page during peak hours. You lose good orders and the tester waits.
• Skipping the rule feedback step, so the same pattern returns next month.

How do you tune v6 to cut false positives?

Whitelist the accounts that retry on purpose: subscriptions in dunning, B2B buyers with several cards, and gift card buyers who split payments. Review the alert queue against your refund and chargeback data each month. If a rule fires more than it catches, raise its threshold or add a scoring weight.

FAQ

Is card testing illegal?

Yes. Testing stolen card numbers is payment fraud in every jurisdiction that regulates card payments. Merchants who process the attempts can face scheme fines and lose processing rights.

Can a v6 alert fire on real customers?

It can. Shared corporate IPs, travel, and address mismatches sometimes mimic the pattern. That is why log-only mode and manual review matter before a hard block.

Does a failed authorization cost money?

In most cases yes. Many processors charge a per-authorization fee, and a high decline rate can raise your account risk score. Chargebacks from successful test charges add fees on top.

How long does an attack last?

Most bursts run from a few minutes to a few hours. Some testers return with new infrastructure within days, so keep the rule active and review it each week.