Card testing is what happens when someone pushes a stack of stolen card numbers through your checkout to find out which ones still work. Gift shops get hit because the orders are small and boring: a greeting card, a candle, a box of chocolates. Nobody questions a twelve dollar sale. The fix is not one setting you flip. It is a mix of checkout rules, order review, and a payment processor you can actually reach when the chargebacks land.
What it looks like in your order list
Most attacks are obvious once you know the shape of them. I look for clusters, not single orders.
- Ten or twenty orders in a few minutes, often after midnight in your time zone.
- Different card numbers, same shipping address. Or the reverse: same card, a dozen addresses.
- Billing and shipping details that do not match, especially across countries.
- Free shipping thresholds hit exactly, or the cheapest item in the catalog bought alone, over and over.
- Email addresses that look generated: random letters, a number, a common mail provider.
- A spike in failed authorizations followed by a handful of successes.
One of those alone means nothing. Three together in the same hour means someone is testing you.
Why small shops are the target
Fraudsters do not go after the hardest target. They go after the easiest one that still works. A big retailer has velocity checks, device fingerprinting, and a fraud team. A shop running on a basic cart with no address verification is a soft spot, and the attacker does not care that your average order is eighteen dollars. They care that you will ship before the bank tells you the card was stolen.
Card networks push liability toward merchants when the transaction does not meet their fraud requirements. That is the part that stings. You lose the goods, you lose the payment, and you pay a chargeback fee on top. Ten of those in a month can wipe out a good week of gift sales.
What actually slows it down
- Turn on address verification and CVV checks. Your processor has both. If they are off, turn them on today.
- Require the shipping address to match the billing address for first-time buyers, or hold those orders for a manual look.
- Add a small delay before you fulfill. Even two hours catches a lot of testing runs, because the attacker moves on to the next site.
- Set a velocity limit: more than three orders from the same IP or same email in an hour triggers a review.
- Use a CAPTCHA or bot check on the checkout page, not just the contact form.
- Watch refund requests. Testing often turns into a refund attempt on a card that later gets reported.
Avoid the temptation to block whole countries. You will cut off real customers who buy birthday gifts for family overseas, and you still will not stop a determined attacker using a proxy.
What to do when it happens
Do not ship the suspicious orders. Contact your processor the same day and tell them what you are seeing. Keep the order records, the IP addresses, and the timestamps. If the volume is large, they can put a block on the card numbers involved. If you already shipped, respond to every chargeback with the delivery confirmation and the order details. Some of them get reversed. Most do not, but the paper trail matters if your account ever comes up for review.