Understand Card Testing Fraud
Fraudsters often target websites with online payment forms in the run-up to Christmas.
Card testing, also known as card cracking, card dipping, or force testing, is a method used to check whether stolen or purchased card details are valid.
This typically involves:
Using bots or scripts to submit thousands of low-value transactions.
Testing card numbers, expiry dates, and CVC values using brute-force methods.
If successful, fraudsters then use or sell the validated card details elsewhere.
You may notice unusual names or address details appearing on transactions when card testing succeeds.
Understand the Impact on Your Organisation
Card testing fraud has several negative consequences.
You may incur chargebacks and chargeback fees.
Staff time is diverted to handling disputes and investigations.
Genuine supporters may be affected if cards are compromised.
Monitor Online Donation Activity
Donorfy provides tools to help you keep track of online transaction activity.
Go to Financial, then click Online Donations.
Review the available tabs regularly.
History Tab
Use this tab to:
View donor names.
Check transaction amounts from the last 30 days.
Errors & Info Tab
Use this tab to:
Review failed card attempts.
Identify unusual spikes in failed transactions.
Repeated low-value failed transactions are a common indicator of card testing.
Ensure Payment Pages Are Secure
Keeping your payment pages up to date is essential.
Campaign Pages are already upgraded to support SCA compliance.
Upgrade any Web Widgets created before 12 September 2019.
Confirm that all newly created Web Widgets include SCA compliance by default.
Older widgets are more vulnerable if they are not upgraded.
Refresh Forms and Page Identifiers
Regularly refreshing payment endpoints can disrupt fraudulent activity.
Change the Web Widget ID.
Request a reset of your Campaign page.
Copy an existing Form, update the URL on your website, then delete the old Form.
These steps invalidate links that may have been targeted by bots.
Adjust reCAPTCHA and Stripe Settings
You can strengthen protection by tightening your payment security settings.
Increase reCAPTCHA sensitivity, for example to 0.6.
Go to Settings, then click Stripe Connect to apply changes.
Higher reCAPTCHA thresholds reduce automated traffic while still allowing genuine donors to complete payments.
Use Stripe Fraud Prevention Tools
Stripe provides additional tools to help prevent card testing.
Activate Stripe Radar to block transactions with null CVC values.
Review flagged transactions within the Stripe dashboard.
Stripe Radar carries a small per-transaction cost, which may be waived depending on your pricing plan.
Increase Minimum Transaction Amounts
Raising the minimum donation amount can significantly reduce card testing attempts.
Open your Stripe Dashboard.
Increase the minimum transaction amount, for example from 30p to £5.